Contract analysis

I. EXECUTIVE SUMMARY This memorandum presents our analysis of whether the de-identified healthcare claims dataset to be licensed by Arbor Health Technologies Inc. ("AHT") from Pinnacle Claims Analytics LLC ("PCA") under the Data License Agreement (AHT-PCA-DLA-2024-001, Effective Date July 1, 2024) (the "Data License Agreement" or "DLA") qualifies as de-identified information falling outside the scope of the Health In

II. BACKGROUND A. The Parties Arbor Health Technologies Inc. AHT is a Delaware-incorporated, Massachusetts-headquartered healthcare-services and software-as-a-service company that develops and commercializes predictive-analytics tools for health systems, payers, and employer-sponsored health plans. AHT's current annualized recurring revenue is approximately $62 million. The company was acquired in 2021 by Cedarpoint

III. HIPAA DE-IDENTIFICATION ANALYSIS A. Regulatory Framework The HIPAA Privacy Rule, codified at 45 C.F.R. Part 164, Subpart E, establishes national standards governing the uses and disclosures of Protected Health Information by covered entities (health plans, healthcare clearinghouses, and healthcare providers that conduct standard electronic transactions) and their business associates. PHI is defined as individual

1. Eighteen Identifier Categories. The Safe Harbor method requires the removal of eighteen categories of identifiers from the health information. We have reviewed PCA's Data Dictionary (Exhibit B to the DLA, specifying 247 data fields) and PCA's representations regarding its de-identification methodology against each of the eighteen categories. Our analysis of each category is set forth below: (i) Names. All patient

2. No Actual Knowledge Requirement. In addition to the removal of the eighteen categories of identifiers, the Safe Harbor method requires that the covered entity or business associate have "no actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information." 45 C.F.R. § 164.514(b)(2)(ii). This is a subjective standard tha

3. Assessment. Based on PCA's representations and warranties set forth in the DLA and our review of the data dictionary (Exhibit B), the licensed dataset appears to satisfy the requirements of the HIPAA Safe Harbor method under 45 C.F.R. § 164.514(b)(2). All eighteen categories of identifiers have been removed or appropriately generalized, geographic data has been limited to the state and three-digit zip code prefix

1. Requirements. The Expert Determination method provides an alternative pathway to de-identification that does not require the mechanical removal of the eighteen Safe Harbor identifier categories. Instead, this method requires that a qualified expert—specifically, "a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information

2. PCA's Expert Determination Certification. PCA engaged Ridgeline Statistical Sciences LLC ("Ridgeline") to perform the Expert Determination analysis for the licensed dataset. Ridgeline is an independent statistical consultancy based in McLean, Virginia (1750 Tysons Boulevard, Suite 600, McLean, VA 22102). Ridgeline specializes in privacy-preserving data analytics, statistical disclosure control, and HIPAA de-identi

3. Assessment of Expert Determination. The Ridgeline certification appears facially adequate under 45 C.F.R. § 164.514(b)(1). The certification is issued by a qualified expert, references the application of generally accepted statistical and scientific methods, reaches a conclusion that the risk of re-identification is "very small," and appears to document the general methods employed. The HHS De-Identification Guida

1. Mosaic Effect and Longitudinal Data Risks. While the licensed dataset appears to qualify as de-identified under both HIPAA methods, it is important to acknowledge the residual re-identification risks inherent in large-scale longitudinal datasets. The academic literature on data privacy has extensively documented the phenomenon known as the "mosaic effect," whereby the combination of multiple individually innocuous

2. Quarterly Refresh Data. The DLA provides for quarterly data refreshes to be delivered by PCA for a period of 36 months following the Effective Date (through June 30, 2027). Each quarterly refresh will introduce new claims data for the most recent calendar quarter, potentially including claims from new patients not previously represented in the dataset. PCA's de-identification representations and warranties under t

IV. AHT'S STATUS UNDER HIPAA A. Covered Entity / Business Associate Analysis AHT is not a "covered entity" under HIPAA. HIPAA's Privacy Rule applies to three categories of covered entities: (1) health plans, (2) healthcare clearinghouses, and (3) healthcare providers that conduct standard electronic transactions (such as electronic claims submission). 45 C.F.R. § 160.103. AHT does not fall within any of these categor

V. MASSACHUSETTS DATA PRIVACY LAW ANALYSIS (M.G.L. c. 93H) A. Overview of Massachusetts Standards Massachusetts General Laws Chapter 93H governs the protection of "personal information" of Massachusetts residents. The statute defines "personal information" as a Massachusetts resident's first name (or first initial) and last name in combination with any one or more of the following data elements: (i) a Social Security

VI. CALIFORNIA CONFIDENTIALITY OF MEDICAL INFORMATION ACT (CMIA) ANALYSIS A. Applicability. The California Confidentiality of Medical Information Act, codified at California Civil Code Sections 56 through 56.37, restricts the disclosure and use of "medical information." The CMIA defines "medical information" as "any individually identifiable information, in electronic or physical form, in possession of or derived fro

VII. FTC ACT § 5 ANALYSIS A. Unfair or Deceptive Acts or Practices

Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45, broadly prohibits "unfair or deceptive acts or practices in or affecting commerce." The FTC has increasingly used this authority as the basis for enforcement actions in the data privacy and security space, even in the absence of a comprehensive federal data privacy statute. The FTC's jurisdiction is broad and extends to most commercial entities, including

VIII. EVALUATION OF CONTRACTUAL PROTECTIONS IN THE DATA LICENSE AGREEMENT This Section provides a detailed evaluation of the key contractual provisions in the DLA that mitigate the regulatory and privacy risks identified in this memorandum. A. PCA's Key Representations and Warranties

Section 4.1 of the DLA sets forth PCA's representations and warranties to AHT, including the following provisions of particular relevance to HIPAA and privacy compliance: (i) De-Identification Compliance. PCA represents and warrants that all data included in the licensed dataset—including the initial delivery and all quarterly refresh deliveries—has been de-identified in compliance with both the HIPAA Safe Harbor met

Section 5.2 of the DLA contains AHT's covenant not to attempt to re-identify any individual from the licensed data. The covenant is drafted broadly and provides as follows: AHT covenants that it shall not, directly or indirectly, use the licensed data, alone or in combination with any other data or information, to identify or attempt to identify any individual who is a subject of the licensed data, and shall not perm