# Is a hashed email, cohort or clean-room output de-identified under HIPAA?

## Where readings differ

| Reading | What it holds | What it relies on | What it means for a design |
|---|---|---|---|
| A cautious reading | Any persistent key that leaves with the data, such as a device ID, cookie ID, IP address or hashed email, defeats safe harbor. With an ad platform as recipient, an expert will rarely find a very small risk, because the platform holds extensive other data. Such releases are treated as PHI. | The identifier list and the code rule in 164.514(b)(2) and (c); the "anticipated recipient" test | Only aggregate outputs without keys leave; anything keyed follows the PHI rules |
| A permissive reading | Expert determination is a risk test, not a list. With tested controls, such as cell-size floors, query limits, a non-derived token, a contractual ban on re-identification and a recipient with limited other data, an expert can certify a specific release. | 164.514(b)(1); the documented methods of the expert | Keyed or cohort releases are possible for a named recipient under a dated expert report |

**Where the readings collide.** A hash can be derived from a listed identifier even when its text looks random. An expert may ask what other data the recipient has, how often releases repeat, and whether differences between reports expose small groups. A recipient change or new join key can also change the fit of an earlier report.

## Questions to take to your counsel

1. Which de-identification method do we rely on for each release, and where is it documented?
2. Does any key in the release count as a listed identifier or as a code derived from one?
3. Does the expert determination name this recipient, these fields and this release schedule, and when does it expire?
4. What must the recipient contract say, and which public commitments do state laws require?
5. If EU or UK persons are in the data, what is the separate analysis?
6. What do we do if the recipient later gains data that changes the risk?

[Read the full checkpoint](https://adsovereign.com/blog/hipaa-de-identification-ad-audiences) · [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/)