Ad Tech Compliance
Is a hashed email, cohort or clean-room output de-identified under HIPAA?
Published · Last updated
A hashed email, a cohort or a clean-room output is de-identified under HIPAA only if the actual release meets safe harbor or expert determination. Hashing and audience size do not settle it. State laws and GDPR apply different tests, and experts and lawyers differ on releases that keep a join key.
Contents
Key facts
- Expert determination calls for a qualified person to assess and document very small identification risk for an anticipated recipient. 45 CFR 164.514(b)(1).
- Safe harbor lists identifiers to remove, including email addresses, device identifiers, web addresses and internet protocol addresses. 45 CFR 164.514(b)(2)(i).
- Safe harbor also requires no actual knowledge that the remaining information can identify the person. 45 CFR 164.514(b)(2)(ii).
- A code for re-identification has separate conditions on derivation, use and disclosure of the mechanism. 45 CFR 164.514(c).
- Washington’s definition calls for reasonable measures, a public commitment and recipient contract duties. RCW 19.373.010, deidentified data.
- European Union law distinguishes pseudonymisation from data that does not relate to an identifiable person. GDPR Article 4(5) and Recital 26.
Definition
De-identified information under the Health Insurance Portability and Accountability Act (HIPAA) is health information meeting the standard and implementation specifications in 45 CFR 164.514(a) and (b).
What the rule text says
6 of 6 rows
45 CFR 164.514(b)(1) | Expert determination calls for a qualified person to assess and document very small identification risk for an anticipated recipient. | |
45 CFR 164.514(b)(2)(i) | Safe harbor lists identifiers to remove, including email addresses, device identifiers, web addresses and internet protocol addresses. | |
45 CFR 164.514(b)(2)(ii) | Safe harbor also requires no actual knowledge that the remaining information can identify the person. | |
45 CFR 164.514(c) | A code for re-identification has separate conditions on derivation, use and disclosure of the mechanism. | |
RCW 19.373.010, deidentified data | Washington’s definition calls for reasonable measures, a public commitment and recipient contract duties. | |
GDPR Article 4(5) and Recital 26 | European Union law distinguishes pseudonymisation from data that does not relate to an identifiable person. |
45 CFR 164.514(b)(1)
- What it says
Expert determination calls for a qualified person to assess and document very small identification risk for an anticipated recipient.
- Source
45 CFR 164.514(b)(2)(i)
- What it says
Safe harbor lists identifiers to remove, including email addresses, device identifiers, web addresses and internet protocol addresses.
- Source
45 CFR 164.514(b)(2)(ii)
- What it says
Safe harbor also requires no actual knowledge that the remaining information can identify the person.
- Source
45 CFR 164.514(c)
- What it says
A code for re-identification has separate conditions on derivation, use and disclosure of the mechanism.
- Source
RCW 19.373.010, deidentified data
- What it says
Washington’s definition calls for reasonable measures, a public commitment and recipient contract duties.
- Source
GDPR Article 4(5) and Recital 26
- What it says
European Union law distinguishes pseudonymisation from data that does not relate to an identifiable person.
- Source
Table by this library, CC BY 4.0.
The safe harbor list covers identifiers of the person as well as those of relatives, employers and household members. It also has a category for other unique identifying numbers, characteristics or codes. The actual-knowledge condition applies even after removal of the listed types. 45 CFR 164.514(b)(2).
The re-identification provision concerns a code assigned by the covered entity. The rule limits codes derived from or related to information about the individual. It also limits using or disclosing the code for other purposes and disclosing the means to re-identify. A hash of a known input and a random value assigned within a controlled system pose different questions. 45 CFR 164.514(c).
An expert determination considers information held by the anticipated recipient or reasonably available to it. A report about one release can describe particular fields, keys, safeguards and a specific recipient. A later release with extra fields or a different recipient can bring a different set of facts. 45 CFR 164.514(b)(1).
Washington’s consumer health law includes a separate test. It links the definition to measures against association, a public commitment to use the data in deidentified form and contracts with recipients. In the European Union, the General Data Protection Regulation (GDPR) looks at means reasonably likely to be used to identify someone. The GDPR defines pseudonymisation by reference to additional information and controls over that information. RCW 19.373.010; GDPR Article 4(5), Recital 26.
The Court of Justice discussed pseudonymised data in a case under the rules for European Union institutions. The relevant definition is in the separate regulation for those institutions. Regulation (EU) 2018/1725, Article 3(1), (6). It distinguished the sender’s position from that of a recipient unable to identify the person by means reasonably likely to be used. The Court also addressed the timing of a controller’s own information duty. EDPS v. SRB, C-413/23 P, paras. 78–87, 107–116.
Where readings differ
2 of 2 rows
A cautious reading | Any persistent key that leaves with the data, such as a device ID, cookie ID, IP address or hashed email, defeats safe harbor. With an ad platform as recipient, an expert will rarely find a very small risk, because the platform holds extensive other data. Such releases are treated as PHI. | The identifier list and the code rule in 164.514(b)(2) and (c); the "anticipated recipient" test | Only aggregate outputs without keys leave; anything keyed follows the PHI rules |
A permissive reading | Expert determination is a risk test, not a list. With tested controls, such as cell-size floors, query limits, a non-derived token, a contractual ban on re-identification and a recipient with limited other data, an expert can certify a specific release. | 164.514(b)(1); the documented methods of the expert | Keyed or cohort releases are possible for a named recipient under a dated expert report |
A cautious reading
- What it holds
Any persistent key that leaves with the data, such as a device ID, cookie ID, IP address or hashed email, defeats safe harbor. With an ad platform as recipient, an expert will rarely find a very small risk, because the platform holds extensive other data. Such releases are treated as PHI.
- What it relies on
The identifier list and the code rule in 164.514(b)(2) and (c); the "anticipated recipient" test
- What it means for a design
Only aggregate outputs without keys leave; anything keyed follows the PHI rules
A permissive reading
- What it holds
Expert determination is a risk test, not a list. With tested controls, such as cell-size floors, query limits, a non-derived token, a contractual ban on re-identification and a recipient with limited other data, an expert can certify a specific release.
- What it relies on
164.514(b)(1); the documented methods of the expert
- What it means for a design
Keyed or cohort releases are possible for a named recipient under a dated expert report
Table by this library, CC BY 4.0.
Where the readings collide. A hash can be derived from a listed identifier even when its text looks random. An expert may ask what other data the recipient has, how often releases repeat, and whether differences between reports expose small groups. A recipient change or new join key can also change the fit of an earlier report.
Facts that change the answer
- What fields and keys leave in each release?
- Which recipients can join the key to data they already hold?
- What is the smallest reported group, and which query controls apply?
- What tests cover repeated queries and differences between releases?
- Which recipients, fields and dates does the expert report cover?
- What limits on re-identification appear in recipient contracts?
- Which states are represented in the records?
- Does the release cover people in the European Union or United Kingdom?
A sample file is useful when it shows the schema and cardinality with made-up values. A system’s join map can then show where matching happens, which key is shared, and who can use it. Counsel and the expert can consider the release without needing a fresh transfer of real patient data for the meeting.
A count by campaign can hide a small group when the report covers the entire month. Filters for time, geography and treatment may produce a much smaller group. An observer can sometimes compare two totals to learn about a person added to one of them. A log of actual queries helps separate a theoretical limit from a control in use.
A new recipient may hold a richer lookup table than the one described in a report. Releasing the same hashed audience to each gives them the same text but different means of matching it. A record of recipient changes helps identify when to review the previous evidence. A recipient’s access can change without a change to the exported file. Imagine that the recipient starts receiving a second campaign report containing the same key and more precise dates. The file assessed earlier can still be byte for byte identical, but a person who can join the two reports has more information.
The scope of the expert record can matter as much as the date. Some releases are one-time exports and others repeat by schedule. A record that describes both the data and the release plan gives counsel a way to compare the program as it was assessed with the program as it operates.
The test plan can also name who has access to data retained after each release.
Questions to take to your counsel
- Which de-identification method do we rely on for each release, and where is it documented?
- Does any key in the release count as a listed identifier or as a code derived from one?
- Does the expert determination name this recipient, these fields and this release schedule, and when does it expire?
- What must the recipient contract say, and which public commitments do state laws require?
- If EU or UK persons are in the data, what is the separate analysis?
- What do we do if the recipient later gains data that changes the risk?
Bring the fact sheet from the counsel briefing kit so that counsel answers your flow, not a generic one.
How business strategy and risk appetite enter
Advertisers may value attribution at an individual or household level more than simple campaign totals. The benefit depends on the decisions the report actually supports. A broader release may also carry more costly controls, including limits on recipients, monitoring for differencing and a fresh expert assessment when the release changes.
Consider two measurements used for the same budget decision. One returns weekly totals by market and the other returns a matched set of audience rows for a vendor. A business may find they support different decisions even when both are described as measurement. Counsel can look at the benefit of each output alongside the uncertainty it introduces.
3 of 3 rows
Aggregate reporting without keys | Shares totals that can inform spending and delivery. | Small cells or repeated totals can still expose individuals. | Reports can change without migrating identity keys. |
Expert-assessed cohorts for named recipients | Gives a specified recipient cohort signals under documented assumptions. | The report’s scope, controls and future data changes matter. | A change to fields or recipient can require another assessment. |
Release treated as protected health information (PHI) | Keeps the health-data framework in the design discussion. | Recipient roles, agreements and authorizations remain separate questions. | Existing recipients and any stored data need closeout plans. |
Aggregate reporting without keys
- What it gives the business
Shares totals that can inform spending and delivery.
- What stays open
Small cells or repeated totals can still expose individuals.
- How hard it is to reverse
Reports can change without migrating identity keys.
Expert-assessed cohorts for named recipients
- What it gives the business
Gives a specified recipient cohort signals under documented assumptions.
- What stays open
The report’s scope, controls and future data changes matter.
- How hard it is to reverse
A change to fields or recipient can require another assessment.
Release treated as protected health information (PHI)
- What it gives the business
Keeps the health-data framework in the design discussion.
- What stays open
Recipient roles, agreements and authorizations remain separate questions.
- How hard it is to reverse
Existing recipients and any stored data need closeout plans.
Table by this library, CC BY 4.0.
Which option fits is a business decision taken with counsel. It depends on how much the program is worth to you, how much uncertainty you accept and who signs for it.
Status and recent developments
The Court of Justice referred EDPS v. SRB back to the General Court on 4 September 2025 for examination of the second plea. The European Data Protection Board’s consultation record shows Guidelines 01/2025 on pseudonymisation as a consultation version on the page checked. C-413/23 P, paras. 124–126 and operative part, checked 10 November 2026; {V02b:Guidelines 01/2025 consultation record, checked 10 November 2026}.
Related references
FAQ
Is a hashed email PHI?
What is the difference between safe harbor and expert determination?
Does a minimum audience size de-identify data?
Is HIPAA de-identified data anonymous under GDPR?
How this works on owned infrastructure
Owned infrastructure can keep the input file, the identity map and the report builder within separate access boundaries. A release log can name the recipient and record whether the output contained keys, which thresholds applied and which filters were used. This can help an expert reproduce the release conditions from a dated record.
AdSovereign can run in an environment the operator controls. The architecture can be compared with the actual storage and query paths. Counsel and an expert still assess the recipient’s other information, what left the environment and how subsequent releases change the facts.
Sources
- 45 CFR 164.514(b)(1). Checked 10 November 2026.
- 45 CFR 164.514(b)(2)(i). Checked 10 November 2026.
- 45 CFR 164.514(b)(2)(ii). Checked 10 November 2026.
- 45 CFR 164.514(c). Checked 10 November 2026.
- RCW 19.373.010, deidentified data. Checked 10 November 2026.
- GDPR Article 4(5) and Recital 26. Checked 10 November 2026.
- Regulation (EU) 2018/1725, Article 3(1), (6), personal data and pseudonymisation. Checked 10 November 2026.
- 45 CFR 160.103, protected health information definition. Checked 10 November 2026.
- 45 CFR 164.502(d), uses and disclosures to create de-identified information. Checked 10 November 2026.
- 45 CFR 164.514(a), general de-identification standard. Checked 10 November 2026.
More sources (3)
- GDPR Article 4(1), identifiable natural person. Checked 10 November 2026.
- Court of Justice, EDPS v. SRB, C-413/23 P, paras. 78–87, 107–116, 124–126. Checked 10 November 2026.
- European Data Protection Board, Guidelines 01/2025 consultation record. Checked 10 November 2026.
Changelog
- 10 November 2026: Published.