De-identify HIPAA security incident reports for administrative safeguard compliance – CCPA/HIPAA-compliant de-identification per 45 CFR §164.308

The HIPAA Security Rule at 45 CFR §164.308(a)(6) requires covered entities to implement policies to address security incidents, including documentation of incidents and outcomes. Security incident reports that reference affected patient records or ePHI systems constitute PHI when they contain patient identifiers. anonym.legal de-identifies these reports for sharing with leadership, insurers, and regulators without compounding PHI exposure.

When this applies

Apply this workflow when Security Rule incident reports — covering unauthorized access, malware events, or insider threats affecting ePHI — must be shared with the board, cyber-insurer, HHS, or external forensic investigators and the reports contain PHI that should be minimized before disclosure.

  1. Upload the security incident report (PDF or DOCX) to anonym.legal.
  2. The engine identifies PHI embedded in the incident narrative: patient names in affected record inventories, MRNs referenced in log excerpts, diagnosis categories mentioned in system descriptions.
  3. Patient-level PHI is replaced with case reference codes; the nature of the ePHI affected, number of records implicated, and incident timeline are preserved.
  4. Technical indicators of compromise — attacker IP addresses, malware signatures, vulnerability identifiers — are preserved for forensic and regulatory purposes.
  5. Affected system names and ePHI data category descriptions are preserved at the category level (e.g., 'medical records system') without individual patient reference.
  6. The de-identified incident report is packaged with a processing certificate for external disclosure.

What you provide

  • Security incident report document (PDF or DOCX)
  • List of affected ePHI data categories and approximate record counts
  • Forensic investigation summary (if available)

Limitations & cautions

  • Security incident documentation must be retained under §164.308(a)(6)(ii); this workflow produces a de-identified copy for external sharing — the original report must be preserved.
  • Under §164.308(a)(1)(ii)(D), covered entities must conduct a periodic risk analysis; de-identified incident reports can support the risk analysis process but identified records may be needed for the internal investigation.
  • Incident reports describing highly specific attack vectors or very small affected patient populations may remain re-identifying even after individual identifier removal.

FAQ

What is a 'security incident' under the HIPAA Security Rule?

Under 45 CFR §164.304, a 'security incident' means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. Not all security incidents are breaches under HITECH; the incident response policy under §164.308(a)(6) applies to all security incidents, while HITECH notification obligations apply only to breaches of unsecured PHI.

Must security incident reports be provided to HHS during a compliance audit?

Under §164.308(a)(6)(ii), covered entities must document security incident responses. HHS Office for Civil Rights may request this documentation during a compliance review or investigation. De-identified versions may be prepared for board reporting; the identified original should be available for OCR review.

Can de-identified security incident reports be used for industry threat-intelligence sharing?

Yes. De-identified incident reports that contain no PHI may be shared with information-sharing and analysis organizations (ISAOs) or sector-specific threat intelligence communities without HIPAA restrictions, supporting collective cybersecurity awareness.

Healthcare Records

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our servers live in Falkenstein, Germany.

We use Hetzner. They hold ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.