On this page
Public evidence map
| Research question | Evidence to read | Safe interpretation |
|---|---|---|
| How is data de-identified? | HIPAA Safe Harbor and Expert Determination guidance | A method and residual-risk review are required; a label alone is not clearance |
| What labels exist? | Dataset documentation, cohort definitions, annotation protocol, missingness notes | Labels describe the collection and its limits, not clinical validity |
| Who may use it? | Data-use agreements, institutional approvals, vendor and transfer terms | Access rights can be narrower than ownership or publication rights |
| How is value structured? | A dated public collaboration or licensing record | Record the structure and source; do not turn it into a per-record rate |
| What changes over time? | Consent withdrawal, deletion, model use, retention, and security updates | The program needs a maintained governance record |
The HIPAA de-identification guidance HHS, (opens in a new tab) describes two de-identification methods and notes that de-identification reduces, but does not eliminate, risk. GDPR Article 9 Official Journal of the European Union, (opens in a new tab) treats health data as a special category of personal data. The US bulk-data rule Federal Register, (opens in a new tab) adds a separate transfer and access question for certain sensitive personal data and covered persons. These sources are reasons to pause and review, not a checklist that makes a collection safe by itself.
General information, not legal advice.
Keep status categories separate
Publicly reported means a source describes a program or transaction. Documented means the program publishes its method, scope, and governance evidence. Eligible for Rightmark intake is a separate product decision and is currently false for health data. Do not collapse these labels into one readiness mark or use a public collaboration to imply consent, de-identification, or approval of a new collection.
Narrower research conclusion
The public record can support a taxonomy of program components. It does not change Rightmark's current decision not to accept health data. A disclosed collaboration structure is evidence of that public arrangement, not a price for another collection. When comparing programs, retain the record ID, source date, permitted use, and limitations. Do not infer an intake path or an offer from a public announcement.
Fictional status worksheet
For a hypothetical university research program, mark each line publicly documented, needs counsel, or not evidenced:
- collection purpose and permitted AI uses;
- de-identification method and residual-risk analysis;
- consent, notice, withdrawal, and deletion route;
- data-use agreement, institutional approval, and vendor terms;
- labels, provenance, missingness, and quality controls;
- transfer, access logging, retention, and breach response;
- revenue share or access structure, if a dated public record states one.
Do not attach a patient file to this worksheet. A synthetic description is enough for the research exercise.
Sources
- HHS: Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (opens in a new tab)
- Official Journal of the European Union: Regulation (EU) 2016/679 (General Data Protection Regulation), Article 9: Processing of special categories of personal data (opens in a new tab)
- Federal Register: Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons (opens in a new tab)
- Rightmark: Trust
- Rightmark: Deal Tracker