Guided Notes
Privacy, De-identification & Data Governance
HIPAA for analysts — PHI, minimum necessary, de-identification (Safe Harbor's 18 identifiers, Expert Determination), limited data sets, data use agreements, small cells and governance.
PHI and the analyst
Slide 1 / 5Protected health information (PHI) = individually identifiable health information held by a covered entity (provider, health plan, clearinghouse) or its business associate. Analysts handle PHI daily, so they must: • use only approved tools and storage (never personal email, laptops or public AI tools), • follow 'minimum necessary' — only the fields needed, • share outputs appropriately (aggregate when possible), • report any suspected breach immediately.