HIPAA is a U.S. federal law that sets requirements for protecting patient health information. It applies to health-care providers, health plans, clearinghouses, and companies handling protected information on their behalf. LLM systems processing health-care data may therefore need to meet HIPAA requirements. section 11.5.3
HIPAA’s safe-harbor method requires removing 18 types of identifiers from health information.
- Identifiers include names, addresses, dates other than year, phone numbers, email addresses, medical-record numbers, account numbers, and unique identifying characteristics. section 11.5.3
- People older than 89 must be aggregated into a single age category. section 11.5.3
- HIPAA compliance for LLMs also raises unresolved questions about training, inference, and data retention; some organizations require explicit consent and avoid training on health data. section 11.5.3
class HIPAADeIdentifier:
# Requires: import re; from typing import Dict
def __init__(self):
self.safe_harbor_patterns = { #1
'names': r'\b[A-Z][a-z]+\s+[A-Z][a-z]+\b',
'dates': r'\b\d{1,2}/\d{1,2}/\d{4}\b',
'phone': r'\b\d{3}-\d{3}-\d{4}\b',
'email': r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b',
'mrn': r'\bMRN:?\s*\d{6,10}\b',
'address': r'\b\d+\s+[A-Za-z\s]+(?:Street|St|Avenue|Ave)\b'
}
self.age_over_89 =
r'\b(?:9[0-9]|[1-9]\d{2,})\s*(?:years?\s*old|y/?o)\b' #2
def de_identify_medical_text(self, text: str) -> Dict:
de_identified = text #3
removed_elements = [] #3
for identifier_type, pattern in self.safe_harbor_patterns.items(): #4
matches = re.findall(pattern, de_identified, re.IGNORECASE)
if matches:
removed_elements.append(f"{identifier_type}: {len(matches)}")
de_identified = re.sub(
pattern,
f'[{identifier_type.upper()}_REMOVED]',
de_identified,
flags=re.IGNORECASE
)
if re.search(self.age_over_89, de_identified, re.IGNORECASE): #5
de_identified = re.sub(self.age_over_89,
'[AGE_>89_REMOVED]', de_identified)
removed_elements.append("ages_over_89: 1")
return {
'de_identified_text': de_identified,
'removed_elements': removed_elements,
'safe_harbor_compliant': True
}
See a regex-based text de-identification sketch covering examples such as names, dates, phone numbers, email addresses, medical-record numbers, addresses, and ages over 89. These patterns illustrate an implementation approach, not all 18 identifier categories. section 11.5.3
