The De-Identification Dividend: How HIPAA's Safe Harbor Became a Commercial Gateway for Health Data

Health data in the United States is often described as protected by HIPAA. That description is accurate only up to a point. The Privacy Rule governs identifiable health information held by covered entities and their business associates. Once information is de-identified under the rule's safe harbor or expert determination standard, it falls outside HIPAA's restrictions. It can be used, disclosed, and sold with far less oversight. That boundary is not a loophole in the colloquial sense. It is a deliberate policy choice. But in 2026, it functions as a commercial gateway that patients rarely see and regulators rarely examine.

How De-Identification Works

The HIPAA Privacy Rule provides two routes to de-identification. The safe harbor method requires the removal of 18 specified identifiers, including names, dates, geographic subdivisions smaller than a state, and certain account numbers. The expert determination method allows a statistician to certify that the risk of re-identification is very small. Both routes can be legitimate. Both can also be applied in ways that leave data more identifiable than the label suggests.

The safe harbor is particularly consequential because it is mechanical. A covered entity can strip the listed fields and treat the remainder as de-identified without an ongoing assessment of re-identification risk. That makes it administratively attractive. It also means that the adequacy of protection depends on whether the original dataset contained other information, such as rare diagnoses, detailed dates, or geographic patterns, that could be combined with external data to re-identify individuals.

The Market It Enables

De-identified data supports valuable work. Researchers use it to study treatment patterns, insurers use it to detect fraud, and public health agencies use it to track population trends. The problem is not commercialization as such. It is the absence of a clear boundary between uses that serve a public purpose and uses that primarily serve a commercial one.

Health systems and data brokers can package de-identified data for analytics, marketing, and product development. Patients are generally not asked for consent, because consent is not required once the data is de-identified. Contracts may impose use restrictions, but those contracts are rarely public. Data brokers that are not covered entities may fall outside HIPAA entirely, even when they handle information derived from health records. The result is a market in which the most sensitive information about a person's health can travel through commercial channels with little transparency about who holds it or why.

Re-Identification Is Not Theoretical

The claim that de-identified data is safe because identifiers have been removed is too confident. Research has repeatedly shown that auxiliary data can be used to re-identify individuals from supposedly anonymous datasets. Location traces, rare conditions, date ranges, and demographic combinations can narrow a population to a single person. The risk is not evenly distributed. People with rare diseases, residents of small communities, and patients whose care generates distinctive patterns are more vulnerable.

Expert determination is meant to address this risk, but it is not a public process. The methodology may be sound, yet patients and regulators have little ability to evaluate it. In an era of large-scale data linkage and machine learning, the margin between de-identified and re-identifiable is not fixed. It changes as external datasets grow. A determination that was reasonable at the time of disclosure may become less protective over time.

Fragmented Oversight

The Department of Health and Human Services enforces HIPAA through its Office for Civil Rights, but de-identified data is outside the rule's core protections. The Federal Trade Commission can act against deceptive or unfair practices, but it does not administer a general health privacy statute. State laws vary, and some are stronger than HIPAA, but they do not create a uniform national baseline. The result is a regulatory gap that is difficult for patients to navigate and easy for sophisticated actors to exploit.

A Purpose-Limitation Agenda for 2026

A stronger framework would begin with purpose limitation. De-identified data should be available for research, public health, and quality improvement, but not for unrestricted commercial use. That distinction would require Congress or the states to define permitted purposes and to require data use agreements that are transparent and enforceable. It would also require a public registry of de-identified data transfers, at least at the aggregate level, so that patients and policymakers can see how health information moves through the economy.

Consent should not be the only tool, because requiring consent for every secondary use could impede valuable research. But opt-in requirements for commercial sale, combined with clear notices at the point of care, would give patients a meaningful choice. Audits of re-identification risk should be periodic, not one-time. And the Federal Trade Commission should have explicit authority to review health data practices that fall outside HIPAA.

The safe harbor was intended to protect privacy while enabling beneficial use. It has done both, but it has also created a commercial dividend that patients did not authorize and cannot easily trace. In 2026, the policy question is not whether de-identified data should exist. It is who should benefit from it, and on what terms.