Ohio Consumer Protection Rules When Clinics Sell De‑Identified Patient Data to Brokers

De-Identification of Health Information

When Ohio clinics consider selling datasets to brokers, the first gate is whether the information is truly de‑identified under HIPAA. Properly de‑identified data is no longer protected health information (PHI) and may be disclosed or sold without patient authorization, subject to contractual limits and ethical considerations you choose to adopt.

De‑identifiable health information becomes de‑identified only after you apply methods that reduce the likelihood of identifying a patient to a very small risk. Until then, it remains PHI. Because data brokers often combine files from many sources, you should assess re‑identification risk in the specific context of the broker’s likely data environment and intended use.

Methods of De-Identification

HIPAA Safe Harbor

Safe Harbor requires removing specific identifiers about the individual, relatives, employers, or household members. Categories include: names; geographic subdivisions smaller than a state (with special ZIP code rules); all elements of dates (except year) related to an individual; telephone and fax numbers; email addresses; social security and medical record numbers; health plan and account numbers; certificate/license and vehicle identifiers; device identifiers and serial numbers; URLs and IP addresses; biometric identifiers; full‑face photos or comparable images; and any other unique identifying numbers or characteristics. Ages over 89 must be aggregated into a single 90‑and‑over category.

HIPAA Expert Determination

An expert applies accepted statistical and scientific principles to determine that the risk of re‑identification is very small, documents the methods and results, and advises on appropriate data transformations and release conditions. This pathway is flexible for high‑utility datasets, but it requires rigor, documentation, and periodic review as external data landscapes evolve.

Managing Re-Identification Risk in Practice

• Limit precision (e.g., aggregate geography or dates) and suppress rare combinations.
• Use technical safeguards such as k‑anonymity, l‑diversity, or differential privacy where appropriate.
• Apply contractual controls that prohibit re‑identification, restrict downstream sharing, and require incident reporting.
• Continuously reassess re‑identification risk as brokers acquire new auxiliary datasets.

Ohio Administrative Code on De-Identification

Ohio does not establish a wholly separate definition of de‑identification apart from HIPAA. Instead, state entities and public hospitals implement HIPAA through institutional rules. For example, Ohio Administrative Code 3364-90-05 (applicable to the University of Toledo’s health enterprise) adopts HIPAA‑consistent procedures for transforming PHI into de‑identified data and outlines internal responsibilities for doing so.

Private clinics typically mirror this approach via written policies that reference HIPAA Safe Harbor or Expert Determination, designate responsible privacy officials, and require documentation of the de‑identification method used. If your clinic follows institutional rules akin to Ohio Administrative Code 3364-90-05, ensure your documentation supports the chosen pathway and your data broker contracts reflect the same standards.

Ohio Consumer Sales Practices Act Overview

The Ohio Consumer Sales Practices Act (CSPA) prohibits unfair, deceptive, or unconscionable acts in consumer transactions. While the sale of de‑identified datasets from a clinic to a broker is usually a business‑to‑business transaction—not a direct consumer sale—the Act can still be relevant to how you represent privacy practices to patients when offering healthcare services.

In general, courts are cautious about applying the CSPA to professional medical services. However, privacy or marketing statements made to patients can be scrutinized if they are misleading in connection with the services sold to those patients. If you claim, for instance, “we never share data,” but later sell de‑identified patient data without adequate disclosure, those statements could be challenged as deceptive under the Ohio Consumer Sales Practices Act.

Ohio Attorney General's Role in Consumer Protection

The Ohio Attorney General enforces the CSPA, investigates unfair or deceptive practices, and can seek injunctive relief, restitution, and civil penalties. In the data context, the AG’s focus often includes whether your privacy notices, consent flows, and patient communications accurately describe data sharing—including the sale of de‑identified information—and whether your practices align with those representations.

The AG may also issue guidance and participate in coordinated enforcement with other states when industry conduct affects large numbers of Ohio consumers. Maintaining accurate, plain‑language disclosures and honoring opt‑out promises helps reduce enforcement risk.

Handling of Personal Information and Security Breaches

Ohio’s breach‑notification law requires businesses to notify affected residents when unencrypted “personal information” (typically a name combined with sensitive data elements like Social Security, driver’s license, or financial‑account credentials) is accessed and likely to cause a material risk of harm. If the dataset is truly de‑identified under HIPAA, it generally falls outside breach‑notification triggers, but mixed datasets or keys that enable re‑identification can change that analysis.

Ohio’s Data Protection Act provides a safe‑harbor affirmative defense to certain data‑breach tort claims if your organization maintains a written cybersecurity program that reasonably conforms to recognized frameworks (e.g., NIST, ISO/IEC) and is appropriate to your size, complexity, and data sensitivity. Even when selling de‑identified information, implementing robust consumer data security requirements—role‑based access, encryption, key management, vendor oversight, and incident response—demonstrates diligence and reduces risk.

• Map what you share: confirm no direct identifiers or linkage keys leave your control unless contractually justified.
• Segregate and protect re‑identification keys; restrict them to a minimal team with audited access.
• Conduct and document risk‑of‑harm and re‑identification risk assessments before each Limited Data Set Disclosure or de‑identified release.
• Align breach‑response playbooks to both HIPAA and Ohio notification requirements for non‑PHI personal information.

Data Use Agreements for Limited Data Sets

A Limited Data Set (LDS) under HIPAA excludes direct identifiers but may include elements such as city, state, ZIP code, and relevant dates. Because an LDS remains PHI, you must execute Data Use Agreements that define permitted uses and disclosures, mandate safeguards, prohibit attempts at re‑identification or contact, and require reporting of inappropriate uses by recipients.

By contrast, fully de‑identified data does not require a Data Use Agreement under HIPAA, though you should still use contracts to bar re‑identification, control downstream transfers, and set audit rights—especially with data brokers. If a vendor performs services on your behalf involving PHI, a Business Associate Agreement may also be necessary in addition to, or instead of, a DUA depending on the data and role.

Conclusion

In Ohio, clinics can sell properly de‑identified patient data to brokers, but success hinges on rigorous de‑identification, clear patient disclosures, strong contracts, and security practices aligned with recognized standards. Use HIPAA Safe Harbor or Expert Determination, mirror institutional rules like those reflected in Ohio Administrative Code 3364-90-05, and pair any Limited Data Set Disclosure with robust Data Use Agreements to manage Re‑Identification Risk and maintain trust.

FAQs.

What defines de-identified patient data under Ohio law?

Ohio generally relies on HIPAA’s definition: information is de‑identified when it either meets Safe Harbor (specified identifiers removed) or an expert documents that the risk of identifying an individual is very small. State institutional rules—such as Ohio Administrative Code 3364-90-05 for a public health system—implement those HIPAA standards in practice.

How does the Ohio Consumer Sales Practices Act apply to data sales?

The Act primarily targets unfair or deceptive practices in consumer transactions. A clinic’s sale of de‑identified data to a broker is usually not a direct consumer transaction, but misleading privacy statements to patients about data sharing can be challenged under the Ohio Consumer Sales Practices Act if made in connection with the healthcare services provided to them.

What protections exist against re-identification of data?

Protections include sound de‑identification techniques (aggregation, suppression, statistical thresholds), ongoing Expert Determination where appropriate, and contractual terms that ban re‑identification, restrict downstream transfers, require security controls, and permit audits. Technical safeguards and continuous monitoring help manage evolving Re‑Identification Risk.

When is a data use agreement required for sharing health data?

A Data Use Agreement is required when disclosing a HIPAA Limited Data Set because the dataset still constitutes PHI. Fully de‑identified data does not require a DUA under HIPAA, but many clinics still use contracts to control use and prohibit re‑identification. If a vendor handles PHI on your behalf, a Business Associate Agreement may also be needed alongside any Limited Data Set Disclosure.