Medical Writer’s Guide to HIPAA Compliance for Identifiable Case Study Drafts

HIPAA Authorization Requirements

When a HIPAA Authorization is required

If your case study contains protected health information that cannot be fully de-identified, you must obtain HIPAA Authorization from the patient or their legally authorized representative. This is essential for Case Report Privacy when publishing identifiable narratives, images, or timelines.

Core elements of a valid authorization

• Specific description of the information to be used or disclosed (text, images, audio, video).
• The person/role authorized to disclose and the recipient (e.g., journal, publisher).
• The purpose of disclosure (publication, education).
• Expiration date or event (e.g., “upon publication”).
• Patient signature and date; if a proxy signs, include relationship and authority.
• Statements describing the right to revoke, the consequences of refusing, and potential redisclosure once published.

Patient consent documentation and workflow

Use standardized Patient Consent Documentation, version-controlled and stored securely. Confirm identity of the signer, language comprehension, and access needs. Record any revocation and pause submission while you verify scope and timing.

Common pitfalls to avoid

• Using a broad clinical consent instead of a publication-specific HIPAA Authorization.
• Letting authorizations expire during revisions or resubmissions.
• Failing to secure separate authorization for full-face images or audio/video containing identifiers.
• Overlooking minors, incapacitated adults, or multi-subject cases that require multiple authorizations.

De-Identification of Patient Information

De-Identification Standards: Safe Harbor and Expert Determination

You can avoid authorization if you meet HIPAA De-Identification Standards. Under Safe Harbor, remove all 18 identifiers. Under Expert Determination, a qualified expert documents that re-identification risk is very small given your data and context.

What to remove under Safe Harbor

• Names.
• Geographic details smaller than a state (street, city, county, ZIP beyond allowed rules).
• All elements of dates directly related to the individual (except year); ages 90+ must be aggregated to “90 or older.”
• Telephone and fax numbers; email addresses.
• Social Security, medical record, health plan beneficiary, and account numbers.
• Certificate/license numbers.
• Vehicle identifiers and license plates.
• Device identifiers and serial numbers.
• Web URLs and IP addresses.
• Biometric identifiers (e.g., finger and voice prints).
• Full-face photographic images and comparable images.
• Any other unique identifying number, characteristic, or code.

Practical techniques for narratives

• Generalize dates (e.g., “early 2024”), ages (“mid-40s”), and locations (“a regional hospital in the Northeast”).
• Remove facility names, clinician initials, and appointment timestamps.
• Suppress rare details (uncommon procedures, highly specific timelines) or combine them into broader descriptors.
• Apply date shifting consistently across the draft and captions to preserve clinical logic while protecting identity.

Managing Unique Identifiers

Understanding Unique Patient Identifiers

Unique Patient Identifiers—such as medical record numbers, study IDs, claim numbers, or device UDIs—can enable linkage attacks even if obvious fields are removed. Treat them as high-risk and exclude them from the manuscript.

Pseudonymization and key management

• Replace direct identifiers with neutral study codes (“Case A”) that carry no embedded meaning.
• Store any re-identification key separately, with need-to-know access and audit trails.
• Avoid hashing or encoding real identifiers in filenames, figure labels, or supplementary materials.

Device and encounter details

• For devices, describe function and category, not serials or UDIs (e.g., “second-generation implantable cardioverter-defibrillator”).
• For encounters, abstract exact dates/times and omit appointment identifiers or bed numbers.

Removal of Biometric Identifiers

Biometric Data Compliance essentials

HIPAA treats biometric identifiers—such as finger and voice prints—as direct identifiers. Exclude them from drafts. If other biometric modalities (e.g., retinal or iris scans) could reasonably identify a person, remove or irreversibly transform them before sharing.

Working with derived features

• Use summarized metrics (scores, measurements) instead of raw biometric templates or audio waveforms.
• Confirm that any derived feature cannot be reverse-engineered to recreate an identifying signal.
• Document your transformation steps as part of Biometric Data Compliance.

Handling Full Face Photographic Images

Authorization or de-identification

Full-face photographs and comparable images are identifiers. Publish them only with explicit HIPAA Authorization, or replace them with images that cannot identify the patient.

Anonymization techniques for visuals

• Crop to remove facial features; if necessary, mask eyes and distinctive marks with irreversible methods.
• Redact tattoos, name bands, and room signage that could reveal identity or location.
• Strip image metadata (EXIF) and ensure filenames contain no identifiers.

Preferred alternatives

• Use diagrams, clinical illustrations, or standardized exemplars when possible.
• For procedural photos, frame tightly on the field of interest to eliminate identifying context.

Ensuring HIPAA-Compliant Publication

Publication-ready checklist

• Decide early: pursue full de-identification or obtain HIPAA Authorization.
• Apply De-Identification Standards to text, tables, timelines, images, audio, and video.
• Conduct a second-person privacy review focused on Case Report Privacy.
• Maintain Patient Consent Documentation and retain it per policy; confirm it aligns with the final version.
• Record editorial decisions that affect identifiability (e.g., added photos, granular dates).

Coordinating stakeholders

• Engage the privacy officer or IRB when using Expert Determination or limited data sets.
• Inform co-authors and illustrators about prohibited identifiers and file-handling rules.
• Ensure publishers and conference organizers receive only privacy-vetted materials.

Version control and provenance

• Redact at the source and track changes to prevent reintroduction of identifiers.
• Label final files as “De-identified” or “Authorized” and store the basis memo for audit readiness.

Preventing Patient Re-Identification

Understanding re-identification risk

Even without direct identifiers, combinations of rare facts can expose identity. Public records, news, or social media may enable linkage. Plan Re-Identification Risk Mitigation from the first draft.

Techniques to reduce risk

• Generalize small cells (e.g., rare diseases, unusual procedures) and combine categories where needed.
• Coarsen geography to state or region; avoid facility names and precise travel histories.
• Limit temporal precision; use ranges for symptoms, admissions, and procedures.
• Remove nonessential context (occupation, celebrity status, exact event venues).
• Run a “linkage test”: could an informed outsider match this case using publicly available details?

Quality assurance before submission

• Perform a structured privacy QA with a fresh reviewer.
• Verify that captions, alt text, figure callouts, and supplementary files follow the same standards.
• Document your risk assessment and rationale for final disclosures.

Conclusion

Effective HIPAA compliance for identifiable case study drafts blends rigorous De-Identification Standards with clear HIPAA Authorization when needed. By controlling Unique Patient Identifiers, enforcing Biometric Data Compliance, and applying practical Re-Identification Risk Mitigation, you protect patients while preserving clinical value for publication.

FAQs.

What constitutes identifiable information under HIPAA?

Individually identifiable health information includes any data that can directly or indirectly identify a person. Beyond obvious fields like names and contact details, this covers dates tied to care (except year), detailed geography below state level, Unique Patient Identifiers (e.g., MRNs), full-face images, certain device and vehicle numbers, web and IP addresses, biometric identifiers, and any other unique characteristic that could single out the patient.

How can medical writers ensure proper patient authorization?

Confirm that de-identification is insufficient, then obtain a publication-specific HIPAA Authorization describing what will be disclosed, by whom, to whom, and why, with an expiration and required statements. Verify identity of the signer, provide language-appropriate forms, store the Patient Consent Documentation securely, and re-check validity before submission and resubmission.

What are the key identifiers to remove for de-identification?

Remove the 18 Safe Harbor identifiers: names; detailed geography; all elements of dates except year (and aggregate ages 90+); phone and fax; email; Social Security; medical record, health plan, and account numbers; certificate/license numbers; vehicle and device identifiers; URLs; IP addresses; biometric identifiers; full-face and comparable images; and any other unique identifying number, characteristic, or code.

How is biometric data handled in case study drafts?

Treat biometric data as inherently identifying. Exclude finger and voice prints and any modality that could reasonably identify a person. If biometric insights are clinically essential, present aggregated measurements or non-reversible derivatives, and document transformations as part of Biometric Data Compliance before sharing or publishing.