{"page":"/blog/hipaa-de-identification-ad-audiences","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Reading","What it holds","What it relies on","What it means for a design"],"rows":[["A cautious reading","Any persistent key that leaves with the data, such as a device ID, cookie ID, IP address or hashed email, defeats safe harbor. With an ad platform as recipient, an expert will rarely find a very small risk, because the platform holds extensive other data. Such releases are treated as PHI.","The identifier list and the code rule in 164.514(b)(2) and (c); the \"anticipated recipient\" test","Only aggregate outputs without keys leave; anything keyed follows the PHI rules"],["A permissive reading","Expert determination is a risk test, not a list. With tested controls, such as cell-size floors, query limits, a non-derived token, a contractual ban on re-identification and a recipient with limited other data, an expert can certify a specific release.","164.514(b)(1); the documented methods of the expert","Keyed or cohort releases are possible for a named recipient under a dated expert report"]],"sourceUrls":[[],[]]}