De-identify hospital discharge summaries under HIPAA Safe Harbor – CCPA/HIPAA-compliant de-identification per 45 CFR §164.514(b)(2)
Hospital discharge summaries contain a concentrated set of HIPAA Safe Harbor identifiers — patient name, admission and discharge dates, diagnosis codes, and physician names — within a single document. anonym.legal applies the §164.514(b)(2) Safe Harbor method to discharge summaries, removing all 18 identifier categories while preserving diagnosis codes, procedure records, and discharge medication lists for clinical audit and benchmarking.
When this applies
Apply this workflow when discharge summaries are extracted for quality-improvement audits, hospital benchmarking consortia, or external clinical review, and the reviewing parties require episode-level clinical data without patient or clinician identity.
How anonym.legal handles it
- Upload discharge summaries individually or in batch (PDF, DOCX, or HL7 CDA format).
- The engine identifies all 18 Safe Harbor identifier categories in document headers, structured fields, and free-text narrative sections.
- Patient name, MRN, admission date, discharge date, date of birth, address, phone, and insurer beneficiary number are removed or generalized; dates are reduced to year-only per §164.514(b)(2)(i)(C).
- Attending and consulting physician names are removed; provider role labels (e.g., 'attending physician', 'hospitalist') are retained.
- ICD-10-CM diagnosis codes, CPT procedure codes, and discharge medication names are preserved in full as non-identifying clinical content.
- A de-identification certificate is generated per the Safe Harbor compliance record requirement.
- The de-identified summary batch is exported for audit or benchmarking use.
What you provide
- Discharge summary documents (PDF, DOCX, or HL7 CDA)
- Patient encounter identifier list (to verify batch completeness)
Limitations & cautions
- Discharge summaries describing unusual clinical presentations or rare procedure combinations may retain re-identification risk even after Safe Harbor de-identification; apply Expert Determination review for rare-condition cohorts.
- Admission and discharge dates are generalized to year-only; time-series analyses requiring month or day granularity should use the limited data set pathway under §164.514(e) with a data-use agreement.
- The tool does not validate clinical coding accuracy — a separate clinical coding review is required.
FAQ
Can de-identified discharge summaries be shared with a hospital benchmarking collaborative?
Yes. Once de-identified under the Safe Harbor standard, the summaries are no longer PHI and may be shared with benchmarking collaboratives without patient authorization or Privacy Rule restrictions, even if the collaborative is not a HIPAA covered entity.
Are physician DEA numbers treated as an identifier requiring removal?
DEA numbers are certificate or license numbers and fall under identifier category (11) in §164.514(b)(2)(i)(K). They are removed as part of Safe Harbor processing.
How are co-morbidities coded in the de-identified output?
ICD-10-CM comorbidity codes are retained in full — they are clinical classification codes, not identifiers. Only personal data fields (name, dates, MRN, etc.) are removed. The clinical coding record remains intact for audit purposes.
What is a discharge summary, and what penalties apply if one is shared with identifiers intact?
A discharge summary is a clinical document created at the end of a hospital stay that records the admitting and final diagnoses, treatment course, and follow-up instructions. According to HHS Office for Civil Rights guidance, HIPAA — enacted in 1996 and expanded to reach business associates directly under the 2013 Omnibus Rule — authorizes penalties across four culpability tiers: $100 to $50,000 per violation for violations without knowledge, $1,000 to $50,000 per violation for reasonable-cause violations, $10,000 to $50,000 per violation for corrected willful neglect, and not less than $50,000 per violation for uncorrected willful neglect, with an annual cap of $1,500,000 for identical violations, as reported by published OCR enforcement data. Because a single discharge summary concentrates many Safe Harbor identifiers in one file, batch review before release is strongly recommended.