HIPAA requires the removal of PHI that can be used to identify an individual before it is released to the public.
HIPAA de-identification
requirements are stricter than the Medicaid de-identification requirements.
For example, under HIPAA, PHI may not be released by ZIP code if the total population
for the ZIP code is less than 20,000.
Consult with legal staff or the HHSC Privacy Officer on de-identification or special data release requests.