Skip to main content

Health Insurance Portability and Accountability Act (HIPAA)

Jump straight to Avatar compliance regarding HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a U.S. federal law that regulates the use, storage, and transmission of protected health information (PHI).

What is Protected Health Information (PHI)?​

PHI includes any individually identifiable health information:

  • Medical history
  • Diagnoses and treatment information
  • Prescription records
  • Laboratory results
  • Insurance details

HIPAA Covered Entities and Business Associates​

HIPAA applies to:

  • Healthcare providers (hospitals, clinics, doctors)
  • Health insurance companies
  • Third-party vendors handling PHI (business associates)

De-Identification and HIPAA Compliance​

HIPAA allows two main methods for de-identifying PHI so that it is no longer regulated:

  1. Safe Harbor Method: Removing 18 specific identifiers.

    • Names
    • Geographic subdivisions smaller than a state (e.g., street, city, ZIP code), excluding the first 3 ZIP digits when populations are >20,000
    • All dates directly related to an individual (except year), and all ages over 89 (can be grouped as "90 or older")
    • Telephone numbers
    • Fax numbers
    • Email addresses
    • Social Security numbers
    • Medical record numbers
    • Health plan beneficiary numbers
    • Account numbers
    • Certificate/license numbers
    • Vehicle identifiers and license plate numbers
    • Device identifiers and serial numbers
    • Web URLs
    • IP addresses
    • Biometric identifiers (e.g., fingerprints, voiceprints)
    • Full-face photos and similar images
    • Any other unique identifying number, characteristic, or code (except as allowed in the “Re-identification” section)

  2. Expert Determination: A qualified expert certifies that data has minimal risk of re-identification.

Once data is de-identified, it is no longer considered PHI and is exempt from HIPAA restrictions.

The Avatar method offers a privacy by design approach that specifically aim to prevent re-identification. Direct identifiers are no longer present in the data generated in accordance with the Safe Harbor Method. The method also offers a privacy evaluation toolkit to assess the residual re-identification risk. This evaluation aligns with the recommended Expert Determination. The use of the method and the synthetic data generated with it are therefore compatible with the HIPAA regulation.