Patient Identification With Diagnostic Data: Efficiency and Compliance

"Patient identification" is one of the most misunderstood phrases in precision medicine commercialization. In a clinical or trial context, it can mean finding specific people. In a commercial media context, it should mean something narrower: finding where eligible patients are likely being seen, so that the right HCPs get the right testing and treatment information. Mixing those two meanings in a brief is how teams end up in a difficult privacy review three weeks before launch.

This article is part of the series on diagnostic data in precision medicine launches.

What compliant patient identification looks like

A compliant workflow usually looks like this:

1. A lab or data partner holds identifiable test records under its own HIPAA obligations.
2. Records are de-identified under HIPAA before they reach a commercial vendor or the manufacturer.
3. The vendor attributes de-identified records to HCPs or accounts and aggregates them.
4. Small counts are suppressed or banded.
5. The manufacturer receives HCP-level or account-level signals and uses them for targeting, field planning, and measurement.
6. Any outreach to patients happens through the HCP's own decisions or through a separate, consented patient program.

The manufacturer never sees who the patient is, and no media is targeted to patients based on their test results.

HIPAA de-identification: Safe Harbor and expert determination

HHS guidance describes two ways to de-identify protected health information. Safe Harbor removes 18 categories of identifiers, including names, most geographic detail below the state, most date elements, and record numbers, and requires that the entity has no actual knowledge the remainder could identify someone. Expert determination relies on a qualified expert applying statistical or scientific methods and concluding that the risk of re-identification is very small, often with documented conditions on how the data may be used and combined.

For commercial lab data, expert determination is common because it can preserve more analytic value, such as finer timing. The cost is conditions. Ask your vendor for:

• Which method applies to the dataset you are licensing
• Who performed the determination and when it was last renewed
• The conditions: permitted linkages, prohibited combinations, minimum cell sizes
• Whether your planned use, such as onboarding to a DSP or joining to CRM, falls within those conditions

If you plan to join the data with other sources, the original determination may not cover the combined dataset. That is a common gap.

What is off limits

The last row catches teams off guard. Even aggregated counts, delivered with enough detail to a rep, can let a physician work out which patients are meant. Keep reps on tiers, not counts. The broader distinction between allowed data and appropriate use is in consent, permission, and fitness for use.

State health privacy laws and consumer data

HIPAA is not the only rule. Several states have passed consumer health data laws that reach data outside HIPAA, Washington's My Health My Data Act being the most cited. These mostly matter on the DTC side, but they can affect how you combine HCP-level diagnostic signals with consumer data, and they can affect the vendors in your supply chain. The FTC's Health Breach Notification Rule may also apply to some health apps and services. See state consumer health data laws and pharma media and where HIPAA applies in pharma advertising. Check current versions of these laws; they change.

Making it efficient without cutting corners

Efficiency in this context means less wasted reach, not more data about patients. The levers:

• Better HCP attribution. Correct ordering-to-treating attribution does more for efficiency than any patient-level detail would.
• Account-level views for health systems. Where individual attribution is weak, plan at the account and use field to identify the decision makers.
• Geographic signals for DTC. If you run patient-facing media at all, use aggregate geographic testing data to weight markets, not individuals.
• Testing education where the gap is. The cheapest patient found is one whose physician starts testing. See biomarker testing gaps and HCP media.

The privacy review checklist

1. De-identification method and current certification on file
2. Planned linkages listed and confirmed within the determination's conditions
3. Suppression threshold documented and applied before data reaches media or CRM
4. Rep guidance written: tiers only, no counts, no patient inference
5. Creative reviewed by MLR for any implied patient knowledge
6. Vendor contract prohibits re-identification and limits downstream sharing
7. Data flow diagram from lab to DSP signed off by privacy

Practical takeaway

Draw the data flow from the lab to every system where your testing tiers will land, including CRM, the warehouse, and each DSP or HCP platform, and send it to the vendor and your privacy lead with one question: is every arrow in this diagram covered by the current de-identification determination? Fix any arrow that is not before the first audience is built.

Editorial note. Analysis and frameworks are the author's own and do not represent Acxiom or any current or former employer, client, or named platform. Examples labeled hypothetical or illustrative are not results from real campaigns. Nothing here is legal, regulatory, or medical advice.