Skip to main content

HIPAA 30 Percent Rule

Meaning

The HIPAA 30 Percent Rule, often misconstrued, refers to a critical provision within the Health Insurance Portability and Accountability Act’s de-identification standards. This rule stipulates that even if protected health information has undergone formal de-identification methods, it is not considered truly de-identified if a covered entity possesses actual knowledge that the remaining information could be used, alone or in combination with other available information, to identify an individual. The ’30 percent’ aspect is not a direct numerical threshold within the regulation itself but rather an informal reference to statistical re-identification risk assessments sometimes employed in data science, highlighting the ongoing responsibility to protect patient identity.