Skip to main page content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Access keys NCBI Homepage MyNCBI Homepage Main Content Main Navigation
. 2022 Aug 3;10(8):e37756.
doi: 10.2196/37756.

Twenty Years of the Health Insurance Portability and Accountability Act Safe Harbor Provision: Unsolved Challenges and Ways Forward

Brittany Krzyzanowski  1 , Steven M Manson  1
Affiliations

Twenty Years of the Health Insurance Portability and Accountability Act Safe Harbor Provision: Unsolved Challenges and Ways Forward

Brittany Krzyzanowski et al. JMIR Med Inform. .

Abstract

The Health Insurance Portability and Accountability Act (HIPAA) was an important milestone in protecting the privacy of patient data; however, the HIPAA provisions specific to geographic data remain vague and hinder the ways in which epidemiologists and geographers use and share spatial health data. The literature on spatial health and select legal and official guidance documents present scholars with ambiguous guidelines that have led to the use and propagation of multiple interpretations of a single HIPAA safe harbor provision specific to geographic data. Misinterpretation of this standard has resulted in many entities sharing data at overly conservative levels, whereas others offer definitions of safe harbors that potentially put patient data at risk. To promote understanding of, and adherence to, the safe harbor rule, this paper reviews the HIPAA law from its creation to the present day, elucidating common misconceptions and presenting straightforward guidance to scholars. We focus on the 20,000-person population threshold and the 3-digit zip code stipulation of safe harbors, which are central to the confusion surrounding how patient location data can be shared. A comprehensive examination of these 2 stipulations, which integrates various expert perspectives and relevant studies, reveals how alternative methods for safe harbors can offer researchers better data and better data protection. Much has changed in the 20 years since the introduction of the safe harbor provision; however, it continues to be the primary source of guidance (and frustration) for researchers trying to share maps, leaving many waiting for these rules to be revised in accordance with the times.

Keywords: HIPAA; Health Insurance Portability and Accountability Act; data privacy; health; maps; patient privacy; safe harbor; visualization.

PubMed Disclaimer

Conflict of interest statement

Conflicts of Interest: None declared.

Figures

Figure 1
Figure 1
Three-digit zip code boundaries.
Figure 2
Figure 2
Five-digit zip code boundaries.
Figure 3
Figure 3
Five-digit zip codes nested within three-digit zip codes.
Figure 4
Figure 4
(A) All the 5-digit zip codes beginning in “563.” (B) An aggregation of 5-digit zip codes that all begin with “563” and contain >20,000 people.
Figure 5
Figure 5
The aggregation process as seen within (A-C) 3-digit zip codes (D-F) and 5-digit zip codes. Zip codes with populations <20,000 people are suppressed. To address suppression, low-population zip codes are merged with neighboring zip codes to meet Health Insurance Portability and Accountability Act requirements. It is not in adherence with Health Insurance Portability and Accountability Act Safe Harbor to use 5-digit zip codes as the unit of aggregation.
Figure 6
Figure 6
Three-digit zip codes (100-999) ordered least to greatest by population from 2020 estimates from the American Community Survey.
See this image and copyright information in PMC

References

    1. Guidance regarding methods for de-identification of protected health information in accordance with the health insurance portability and accountability act (HIPAA) privacy rule. Guidance on De-identification of Protected Health Information. 2012. [2022-06-22]. https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/... .
    1. Gupta A, Lai A, Mozersky J, Ma X, Walsh H, DuBois JM. Enabling qualitative research data sharing using a natural language processing pipeline for deidentification: moving beyond HIPAA Safe Harbor identifiers. JAMIA Open. 2021 Jul;4(3):ooab069. doi: 10.1093/jamiaopen/ooab069. http://europepmc.org/abstract/MED/34435175 ooab069 - DOI - PMC - PubMed
    1. Clause SL, Triller DM, Bornhorst CP, Hamilton RA, Cosler LE. Conforming to HIPAA regulations and compilation of research data. Am J Health Syst Pharm. 2004 May 15;61(10):1025–31. doi: 10.1093/ajhp/61.10.1025. - DOI - PubMed
    1. Curtis A. From healthy start to hurricane Katrina: using GIS to eliminate disparities in perinatal health. Stat Med. 2008 Sep 10;27(20):3984–97. doi: 10.1002/sim.3260. - DOI - PubMed
    1. Paul O. Broken promises of privacy: responding to the surprising failure of anonymization. UCLA Law Rev. 2009;57:1701.

LinkOut - more resources