auditing-safe-harbor-checklist

A HIPAA Safe Harbor coverage review checks de-identified clinical text against all 18 HIPAA Safe Harbor identifier categories to find residual re-identification risk. It applies to post-de-identification coverage reviews, clinical note release decisions, and human sign-off under 45 CFR 164.514(b)(2).

Checking de-identified clinical notes for all 18 HIPAA Safe Harbor categories involves mapping OpenMed detections to Safe Harbor classes and flagging unresolved concerns. The review produces a category coverage report to guide final compliance assessment and human sign-off.

Residual re-identification risks to look for during a HIPAA privacy audit include ages over 89, date and ZIP-code transformations, rare geography, fax numbers, biometrics, full-face images, and combinations of quasi-identifiers that automated masking may miss.

Yes, you can use OpenMed extraction outputs for HIPAA de-identification compliance checks by combining extract_pii and deidentify results with residual-risk assessment. This guides reviewers through final compliance assessment and handoffs to audit or policy workflows.

The limitations of automated masking for HIPAA Safe Harbor de-identification include missing residual re-identification risks like ages over 89, rare geography, biometrics, and quasi-identifier combinations. Human sign-off and expert-review workflows are required to resolve these unresolved Safe Harbor concerns.