Regulation · HIPAAUS · Health

HIPAA and test data: de-identify PHI before it reaches dev and test

HIPAA has no carve-out for test environments. Lab reports, discharge summaries, claims and member call notes copied into dev are still protected health information, unless they have been de-identified by one of the two methods the Privacy Rule allows.

Get a 48-hour proof All regulations

What it says

“Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information.”

45 CFR 164.514(a)

What HIPAA asks of data outside production

PHI is PHI in every environmentThe Security Rule protects electronic PHI wherever it is created, received, kept or sent. A test copy has no exemption.45 CFR 164.306

Minimum necessaryUses and disclosures of PHI are limited to the minimum necessary for the purpose. Most testing needs realistic data, not real patients.45 CFR 164.502(b)

Two ways to de-identifySafe Harbor removes 18 kinds of identifiers, with no actual knowledge the rest could identify someone. Expert Determination has a qualified expert find the risk very small and document why.45 CFR 164.514(b)

Re-identification codesYou may keep a code to re-link records, if it is not derived from information about the person and the way to re-identify is not disclosed.45 CFR 164.514(c)

The 18 Safe Harbor identifiers

45 CFR 164.514(b)(2), of the patient and of relatives, employers and household members

01Names02Geographic units smaller than a state03Dates (except year) and ages over 8904Telephone numbers05Fax numbers06Email addresses07Social Security numbers08Medical record numbers09Health plan beneficiary numbers10Account numbers11Certificate and licence numbers12Vehicle identifiers13Device identifiers14Web URLs15IP addresses16Biometric identifiers17Full-face photographs18Any other unique identifying number or code

ZIP codes may keep their first three digits only where that area has more than 20,000 people. See them marked on a sample lab report.

Documents in scope

Lab reports Discharge summaries SOAP and progress notes Explanations of benefits Medical bills and claims Prescriptions Radiology report text Referral letters Member call transcripts

Where they end up outside production

EHR and claims system test copies
Interface engines and HL7 message logs
Analytics and data science sandboxes
Vendor and offshore test teams
AI scribe and clinical NLP pilots

How Synthesized helps

Each capability carries its status today, so you can plan around what exists.

Engineer-ledMask clinical documentsPDF, Word and PowerPoint files, including scans, with names, dates and numbers replaced, tokenized or redacted per category.

Engineer-ledSynthetic clinical documentsLab reports, discharge summaries and notes for synthetic patients, with a file of the true values.

Engineer-ledFaxes, images and archivesText in scanned faxes, screenshots and mixed exports, read with OCR and masked in place.

Engineer-ledEvidence for an expertRun records and output re-scans an expert can review for an Expert Determination. We supply evidence; we are not the expert.

Before the next test refresh

List every system holding PHI outside production, including file shares and logs.
Choose per environment: Safe Harbor, Expert Determination or synthetic data.
Remove every date element except the year, and group ages over 89.
Include free text, attachments and scanned pages, not just database columns.
Keep any re-identification key away from test teams.
Re-scan the output before each release to test.

Get the full controls checklist

Clinical notes and documents Sample lab report Dev and test environments All regulations

Questions about HIPAA

Is masked data automatically de-identified under HIPAA?

No. Data counts as de-identified only if it meets Safe Harbor or an expert determination. Masking is how you get there; the method and the evidence are what make it count.

Can a vendor with a BAA test on real PHI?

A business associate agreement lets a vendor handle PHI on your behalf, but the minimum necessary standard still applies. For most testing, de-identified or synthetic data removes the question.

Can we keep ZIP codes?

Under Safe Harbor, only the first three digits, and only where the area they cover has more than 20,000 people. Otherwise they become 000.

This page summarises the rules for planning purposes. It is not legal advice; check how they apply to you with your counsel or DPO.

The platform underneath, in production

Clinical documents run on the same platform health companies already trust with sensitive health data.

Documents and text use the same policies, the same engine and the same deployment as these results.

Health · masking20bn+rows masked and subsetted in hours, not weeks, with all manual configuration removed.Global HealthTech leaderCase study Health · lab systemsMinutesto mask 30 to 200 GB per environment for a digital pathology lab system, so patient data never reaches test.HealthTech lab system providerCase study

Published results from database and synthetic data work on the Synthesized platform.

Get PHI out of test before the next refresh

Start with one document type and one environment. We'll show what is found, what is replaced and what still needs a person.

Get a 48-hour proof