PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 100 Federal Street, Suite 3400 Boston, MA 02110
MEMORANDUM
June 28, 2024
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
This memorandum presents our analysis of whether the de-identified healthcare claims dataset to be licensed by Arbor Health Technologies Inc. ("AHT") from Pinnacle Claims Analytics LLC ("PCA") under the Data License Agreement (AHT-PCA-DLA-2024-001, Effective Date July 1, 2024) (the "Data License Agreement" or "DLA") qualifies as de-identified information falling outside the scope of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Privacy Rule, and assesses multi-state privacy law risks associated with AHT's intended use of the licensed data.
Transaction Overview. AHT proposes to license from PCA a longitudinal dataset comprising approximately 85 million de-identified patient records and approximately 3.4 billion individual claim lines spanning January 1, 2016 through December 31, 2023 (eight full calendar years). The licensed data encompasses professional claims (Part B), facility claims (Part A), pharmacy claims (Part D), and ancillary claims across commercial, Medicare Advantage, and Medicaid managed-care lines of business. The total license fee payable by AHT under the DLA is $9,000,000. The initial term of the license extends for five years through June 30, 2029, with quarterly data refreshes to be delivered by PCA for a period of 36 months following the Effective Date (i.e., through June 30, 2027).
Permitted Uses. Under the DLA, AHT is authorized to use the licensed data for internal analytics, machine-learning and artificial-intelligence model training, product development, and integration into AHT's proprietary SaaS platform offerings. The DLA expressly prohibits the re-sale or sub-licensing of raw data to third parties. AHT may incorporate insights, models, and derivative analytics products developed from the licensed data into its commercial offerings, provided that such products do not enable the re-identification of any individual.
Overall Conclusion. Based on PCA's representations and warranties and the available documentation reviewed in connection with this engagement, the licensed data qualifies as de-identified under both the HIPAA Safe Harbor method (45 C.F.R. § 164.514(b)(2)) and the Expert Determination method (45 C.F.R. § 164.514(b)(1)). De-identified health information is not Protected Health Information ("PHI") under HIPAA and accordingly falls outside the scope of the HIPAA Privacy Rule's restrictions on use and disclosure. Receipt and use of de-identified data, standing alone, does not trigger business associate status for AHT under HIPAA.
However, we note that residual regulatory and enforcement risks exist under several parallel legal frameworks, including Massachusetts General Laws Chapter 93H and the Massachusetts data security regulations at 201 CMR 17.00, the California Confidentiality of Medical Information Act (Cal. Civ. Code §§ 56–56.37) (the "CMIA"), and Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45). These risks are assessed in detail below and are, on balance, manageable given the contractual protections negotiated into the Data License Agreement, including PCA's comprehensive de-identification representations and warranties, AHT's non-re-identification covenant, NIST SP 800-171-aligned security safeguards, an indemnification framework with a $9,000,000 cap per party and uncapped liability for willful misconduct or re-identification breach, balanced audit rights, and mutual insurance requirements.
Prior Counsel Assessment. This memorandum incorporates and builds upon the preliminary privacy-risk assessment provided by David Whitfield of Whitfield & Ames, P.C. (75 Ashbury Asset Advisors, Suite 1400, Boston, MA 02109), AHT's regular outside privacy counsel, received May 29, 2024. Our analysis is consistent with and extends the conclusions of the Whitfield & Ames assessment, and the contractual protections negotiated into the DLA address each of the risks identified by that firm.
II. BACKGROUND
A. The Parties
Arbor Health Technologies Inc. AHT is a Delaware-incorporated, Massachusetts-headquartered healthcare-services and software-as-a-service company that develops and commercializes predictive-analytics tools for health systems, payers, and employer-sponsored health plans. AHT's current annualized recurring revenue is approximately $62 million. The company was acquired in 2021 by Cedarpoint Capital Partners Fund IV, L.P. ("Cedarpoint"), a healthcare-focused private equity fund, in a transaction valued at approximately $185 million. AHT's Chief Executive Officer is Dr. Priya Narayanan. The Chief Data Officer and internal deal lead for the PCA data license transaction is Marcus Ellison. Helen Tsao serves as AHT's General Counsel and is an addressee of this memorandum. AHT maintains its principal office at 400 Seaport Boulevard, Suite 1200, Boston, Massachusetts 02210.
AHT's core product suite includes population-health management analytics, risk-stratification models for value-based care contracts, and clinical-decision-support tools integrated into electronic health record platforms. The PCA data license is intended to substantially enhance AHT's predictive-modeling capabilities by providing a large-scale, multi-year, multi-payer claims dataset for model training and validation purposes. This strategic investment aligns with AHT's product roadmap, which prioritizes the development of next-generation total-cost-of-care prediction models and care-gap identification algorithms.
Pinnacle Claims Analytics LLC. PCA is a Delaware limited liability company headquartered in Nashville, Tennessee (3100 West End Avenue, Suite 800, Nashville, TN 37203). PCA's business model centers on the aggregation, de-identification, and licensing of healthcare claims data sourced under downstream data-contribution agreements with regional health plans and third-party administrators across the United States. PCA's dataset covers approximately 85 million unique de-identified patient records, representing a substantial cross-section of the commercially insured and publicly insured (Medicare Advantage and Medicaid managed care) populations. PCA is privately held by its founders and Ridgeview Health Ventures LLC, a healthcare-focused venture fund. PCA's annual revenue is estimated at approximately $47 million.
PCA's Chief Executive Officer is Jonathan Kessler. PCA's Chief Privacy Officer is Dr. Anita Mehta, who holds a doctorate in biostatistics and oversees PCA's de-identification processes and compliance programs. PCA is represented in this transaction by Hargrove, Delacroix & Stein LLP, with Elaine Prescott serving as lead partner.
B. The Licensed Dataset
The licensed dataset is described in detail in Exhibit A to the Data License Agreement and is further specified by the data dictionary attached as Exhibit B. The principal characteristics of the dataset are as follows:
• Record count: The dataset contains no fewer than 85 million unique de-identified patient tokens, each representing a unique individual whose claims have been contributed to PCA's aggregated dataset by one or more data-contributing health plans or third-party administrators.
• Claim lines: The dataset encompasses approximately 3.4 billion individual claim lines, reflecting an average of approximately 40 claims per patient over the eight-year period of coverage. Claim lines include individual service encounters, procedures, diagnoses, drug dispensing events, and ancillary services.
• Categories of claims: The dataset spans four principal categories of healthcare claims: (i) professional claims (corresponding to CMS-1500/Part B claims); (ii) facility claims (corresponding to UB-04/Part A claims); (iii) pharmacy claims (corresponding to Part D claims and commercial pharmacy benefit claims); and (iv) ancillary claims, including laboratory, durable medical equipment, and home health services.
• Lines of business: The dataset covers three major lines of business: commercial (employer-sponsored and individual market), Medicare Advantage, and Medicaid managed care. The dataset does not include traditional fee-for-service Medicare or fee-for-service Medicaid claims, which are sourced separately by CMS and state agencies and are not contributed by PCA's health plan partners.
• Temporal coverage: The dataset spans January 1, 2016 through December 31, 2023, representing eight full calendar years of longitudinal claims data. This temporal depth is a key differentiator of PCA's offering and is central to AHT's intended use of the data for longitudinal risk-prediction modeling.
• Data dictionary: The data dictionary attached as Exhibit B to the DLA specifies 247 standardized data fields. These fields include, among others, de-identified patient tokens, service dates (year only), procedure codes (CPT, HCPCS, ICD-10-PCS), diagnosis codes (ICD-10-CM), revenue codes, place-of-service codes, National Drug Codes (NDC), allowed amounts, paid amounts, member responsibility amounts, provider specialty codes, plan type identifiers, and geographic indicators (state and three-digit zip code prefix only).
• Delivery format: The initial dataset and all quarterly refresh deliveries are to be transmitted in Apache Parquet file format via encrypted Secure File Transfer Protocol (SFTP) utilizing AES-256 encryption. The DLA specifies that all data in transit and at rest must be encrypted to no less than the AES-256 standard.
• De-identification methodology: PCA represents that the dataset has been de-identified in accordance with both the HIPAA Safe Harbor method (45 C.F.R. § 164.514(b)(2)) and the Expert Determination method (45 C.F.R. § 164.514(b)(1)). PCA's Expert Determination certification was obtained from Ridgeline Statistical Sciences LLC, an independent statistical consultancy located at 1750 Tysons Boulevard, Suite 600, McLean, Virginia 22102. A summary of the Ridgeline certification was provided to AHT during pre-execution due diligence.
C. Sources of the Data
PCA sources its healthcare claims data under downstream data-contribution agreements with regional health plans and third-party administrators. Under these agreements, the contributing entities provide PCA with claims data in identifiable form, and PCA is responsible for de-identifying the data prior to any downstream licensing or use. The data originates as Protected Health Information at the contributing-entity level; however, by the time it is delivered to licensees such as AHT, PCA represents that all PHI has been removed or transformed in compliance with HIPAA's de-identification standards.
PCA has represented to AHT in the DLA that it holds all rights necessary under its data-contribution agreements to grant the license contemplated by the DLA. PCA further represents that no claims data included in the licensed dataset originates from any contributing source that has revoked, terminated, or restricted PCA's right to sub-license or otherwise distribute the de-identified data. We did not independently review PCA's upstream data-contribution agreements, and our analysis relies on PCA's contractual representations in this regard. The audit-rights provision of the DLA (Section 8.3) provides AHT with a mechanism to verify these representations during the term of the agreement.
III. HIPAA DE-IDENTIFICATION ANALYSIS
A. Regulatory Framework
The HIPAA Privacy Rule, codified at 45 C.F.R. Part 164, Subpart E, establishes national standards governing the uses and disclosures of Protected Health Information by covered entities (health plans, healthcare clearinghouses, and healthcare providers that conduct standard electronic transactions) and their business associates. PHI is defined as individually identifiable health information that is transmitted by or maintained in electronic media or any other form or medium. 45 C.F.R. § 160.103.
A critical threshold concept under the Privacy Rule is the distinction between PHI and de-identified health information. The Privacy Rule expressly provides that health information that has been de-identified in accordance with the standards set forth in 45 C.F.R. § 164.514(a)–(c) is not individually identifiable health information, and therefore is not PHI. 45 C.F.R. § 164.502(d)(2). De-identified health information is not subject to the Privacy Rule's use and disclosure restrictions and may be used and disclosed freely, provided that no re-identification occurs. See 45 C.F.R. § 164.502(d)(1) ("A covered entity may use protected health information to create information that is not individually identifiable health information or disclose protected health information only to a business associate for such purpose, whether or not the de-identified information is to be used by the covered entity.").
Two permissible methods of de-identification are recognized under 45 C.F.R. § 164.514(a):
(1) Expert Determination (§ 164.514(b)(1)). A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable applies such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, to identify an individual who is a subject of the information, and documents the methods and results of the analysis that justify such determination.
(2) Safe Harbor (§ 164.514(b)(2)). The covered entity or business associate removes eighteen categories of identifiers of the individual or of relatives, employers, or household members of the individual, and the covered entity or business associate has no actual knowledge that the remaining information could be used alone or in combination with other information to identify an individual who is a subject of the information.
Once health information has been properly de-identified under either method, it may be used and disclosed by any person or entity without restriction under HIPAA, subject only to the requirement that the information not be re-identified except as permitted under 45 C.F.R. § 164.514(c). The Department of Health and Human Services ("HHS") has issued guidance reinforcing this framework, most notably in its November 2012 guidance document, "Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule" (the "HHS De-Identification Guidance").
B. Safe Harbor Method Analysis (45 C.F.R. § 164.514(b)(2))
1. Eighteen Identifier Categories. The Safe Harbor method requires the removal of eighteen categories of identifiers from the health information. We have reviewed PCA's Data Dictionary (Exhibit B to the DLA, specifying 247 data fields) and PCA's representations regarding its de-identification methodology against each of the eighteen categories. Our analysis of each category is set forth below:
(i) Names. All patient names, including first name, last name, middle name, and any name suffixes, must be removed. PCA represents that no patient names are included in the licensed dataset. The data dictionary does not include any name fields. Patient records are identified solely by synthetic de-identified patient tokens.
(ii) Geographic subdivisions smaller than a state. All geographic data more granular than the state level must be removed, except that the first three digits of a zip code may be retained if the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people, as determined by the most recent decennial Census. For three-digit zip code prefixes with initial populations of 20,000 or fewer, the three-digit zip code prefix must be changed to "000." PCA represents that the licensed dataset includes only state-level indicators and three-digit zip code prefixes, with suppression (replacement with "000") applied to all three-digit zip codes having initial populations under 20,000 per Census Bureau data. The data dictionary confirms that no fields contain street addresses, city names, county names, full five-digit zip codes, or any geographic indicator more granular than the three-digit zip code prefix.
(iii) All elements of dates (except year) directly related to an individual. All dates directly related to an individual—including birth date, admission date, discharge date, date of death, and all ages over 89—must be removed or generalized to year only. Ages over 89 must be aggregated into a single category of "age 90 or older." PCA represents that the licensed dataset retains year only for all date-related fields; all month, day, and specific date values have been removed or generalized. The data dictionary confirms that service date fields are recorded as year only (e.g., "SVC_YEAR"), and patient age is provided in age bands that aggregate all ages over 89 into a single category.
(iv) Telephone numbers. All telephone numbers must be removed. PCA represents that no telephone numbers are included in the dataset. The data dictionary does not include any telephone number fields.
(v) Fax numbers. All fax numbers must be removed. PCA represents that no fax numbers are included in the dataset. The data dictionary does not include any fax number fields.
(vi) Email addresses. All email addresses must be removed. PCA represents that no email addresses are included in the dataset. The data dictionary does not include any email address fields.
(vii) Social Security numbers. All Social Security numbers must be removed. PCA represents that no Social Security numbers are included in the dataset. The data dictionary does not include any SSN fields.
(viii) Medical record numbers. All medical record numbers must be removed. PCA represents that no medical record numbers are included in the dataset. Individual claim records are identified by synthetic claim-line identifiers that are not derived from any source-system medical record number.
(ix) Health plan beneficiary numbers. All health plan beneficiary numbers must be removed. PCA represents that no health plan beneficiary numbers, member IDs, or subscriber IDs from contributing health plans are included in the dataset. Patient records are linked solely through synthetic de-identified patient tokens.
(x) Account numbers. All account numbers must be removed. PCA represents that no financial or billing account numbers are included in the dataset.
(xi) Certificate/license numbers. All certificate and license numbers must be removed. PCA represents that no patient-level certificate or license numbers are included in the dataset. We note that the data dictionary does include provider specialty codes and provider-type indicators, but these are categorical descriptors of provider specialties (e.g., "Internal Medicine," "Cardiology") and do not constitute individual provider license numbers or identifiers that could be linked to an individual patient.
(xii) Vehicle identifiers and serial numbers, including license plate numbers. All vehicle identifiers must be removed. PCA represents that no vehicle identifiers are included in the dataset. This category is not applicable to healthcare claims data in the ordinary course.
(xiii) Device identifiers and serial numbers. All device identifiers and serial numbers must be removed. PCA represents that no device identifiers or serial numbers (such as FDA Unique Device Identifiers) are included in the dataset. While the data dictionary includes fields for procedure codes that may reference device-related procedures, no serial numbers or unique device identifiers are retained.
(xiv) Web Universal Resource Locators (URLs). All URLs must be removed. PCA represents that no URLs are included in the dataset.
(xv) Internet Protocol (IP) address numbers. All IP addresses must be removed. PCA represents that no IP addresses are included in the dataset.
(xvi) Biometric identifiers, including fingerprints and voiceprints. All biometric identifiers must be removed. PCA represents that no biometric identifiers are included in the dataset. This category is not applicable to healthcare claims data in the ordinary course.
(xvii) Full-face photographic images and any comparable images. All full-face photographs and comparable images must be removed. PCA represents that no images are included in the dataset.
(xviii) Any other unique identifying number, characteristic, or code. This residual category requires the removal of any other unique identifier that could be used to identify an individual. PCA represents that the synthetic de-identified patient tokens used to link records across claims are not derived from and cannot be reverse-engineered to reveal any direct identifier. PCA states that the tokens are generated through a one-way cryptographic hash function, and that the crosswalk between the hash and the original identifiable patient data is maintained solely by PCA in a secure, segregated environment and is never shared with licensees. This approach is consistent with the Safe Harbor method, which permits the assignment of a code or other means of record identification for purposes of re-identification by the covered entity, provided that the code is not derived from or related to the information about the individual and is not otherwise capable of being translated so as to identify the individual. 45 C.F.R. § 164.514(c).
Based on our review, the 247 fields in PCA's data dictionary do not appear to map to any of the eighteen Safe Harbor identifier categories. The fields consist primarily of de-identified patient tokens, temporal indicators (year only), geographic indicators (state and three-digit zip code prefix), clinical codes (ICD-10-CM, ICD-10-PCS, CPT, HCPCS, NDC, revenue codes), financial fields (allowed amounts, paid amounts, member cost-sharing), plan-type indicators, and provider specialty codes.
2. No Actual Knowledge Requirement. In addition to the removal of the eighteen categories of identifiers, the Safe Harbor method requires that the covered entity or business associate have "no actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information." 45 C.F.R. § 164.514(b)(2)(ii). This is a subjective standard that focuses on the actual knowledge of the entity disclosing the data, rather than an objective assessment of re-identification risk.
PCA has represented in the DLA that it has no actual knowledge that the information contained in the licensed dataset could be used, alone or in combination with other information, to identify any individual who is a subject of the data. This representation is made by PCA as the entity that performed the de-identification and is disclosing the data to AHT.
From AHT's perspective, as the downstream licensee and recipient of de-identified data, AHT similarly has no actual knowledge that the data could be used to identify any individual. AHT's covenant not to attempt re-identification, set forth in Section 5.2 of the DLA, further supports the no-actual-knowledge standard by ensuring that AHT does not take affirmative steps that could generate such knowledge.
3. Assessment. Based on PCA's representations and warranties set forth in the DLA and our review of the data dictionary (Exhibit B), the licensed dataset appears to satisfy the requirements of the HIPAA Safe Harbor method under 45 C.F.R. § 164.514(b)(2). All eighteen categories of identifiers have been removed or appropriately generalized, geographic data has been limited to the state and three-digit zip code prefix level (with suppression of low-population prefixes), date data has been limited to year only, and synthetic patient tokens have been assigned in a manner consistent with the Safe Harbor's requirements for re-identification codes.
We note, however, an important caveat: we have not independently verified PCA's de-identification processes. Our analysis relies on PCA's contractual representations and warranties as set forth in the DLA, as well as our review of the data dictionary. We did not conduct an independent technical audit of PCA's data processing pipeline, inspect the raw data prior to de-identification, or independently verify the suppression of low-population three-digit zip codes. To the extent PCA's representations are inaccurate, our conclusions regarding Safe Harbor compliance would need to be revisited. The audit-rights provision of the DLA (Section 8.3) provides AHT with a contractual mechanism to verify PCA's compliance during the term of the agreement.
C. Expert Determination Method Analysis (45 C.F.R. § 164.514(b)(1))
1. Requirements. The Expert Determination method provides an alternative pathway to de-identification that does not require the mechanical removal of the eighteen Safe Harbor identifier categories. Instead, this method requires that a qualified expert—specifically, "a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable"—apply such principles and methods and make two determinations:
(a) The risk is "very small" that the information could be used, alone or in combination with other reasonably available information, to identify an individual who is a subject of the information; and
(b) The expert documents the methods and results of the analysis that justify such determination.
The HHS De-Identification Guidance clarifies that the "very small" risk standard does not require the elimination of all risk, but rather a determination that the risk of re-identification is acceptably low in light of the specific characteristics of the dataset and the anticipated recipient. The Guidance further notes that experts typically employ techniques such as k-anonymity, l-diversity, and statistical disclosure limitation methods to assess and mitigate re-identification risk.
2. PCA's Expert Determination Certification. PCA engaged Ridgeline Statistical Sciences LLC ("Ridgeline") to perform the Expert Determination analysis for the licensed dataset. Ridgeline is an independent statistical consultancy based in McLean, Virginia (1750 Tysons Boulevard, Suite 600, McLean, VA 22102). Ridgeline specializes in privacy-preserving data analytics, statistical disclosure control, and HIPAA de-identification consulting for healthcare data aggregators and health information exchanges.
During the due diligence phase of the transaction, PCA provided AHT with a summary of Ridgeline's Expert Determination certification. The summary certification states that Ridgeline, applying generally accepted statistical and scientific principles and methods, has determined that the risk is "very small" that the licensed dataset could be used, alone or in combination with other reasonably available information, to identify any individual who is a subject of the data. The certification is signed by Dr. Elena Vasquez, Principal Statistician at Ridgeline, and is dated March 15, 2024.
Based on our review of the summary certification, Ridgeline's methodology included the following analytical components:
• Population-uniqueness modeling: Assessment of the probability that any individual in the dataset has a unique combination of quasi-identifiers (e.g., age band, gender, state, three-digit zip code prefix, and diagnosis or procedure code combinations) that could distinguish them from all other individuals in the relevant population.
• K-anonymity assessments: Evaluation of whether each record in the dataset is indistinguishable from at least k-1 other records with respect to specified combinations of quasi-identifiers, for various values of k. The summary indicates that Ridgeline applied a minimum k threshold, though the specific value of k was not disclosed in the summary.
• Probabilistic linkage tests: Testing of whether records in the licensed dataset could be probabilistically linked to individuals in publicly available datasets, including voter registration records, property records, and other public-record databases. The summary indicates that Ridgeline conducted linkage tests against multiple publicly available datasets and concluded that the linkage probability was below the threshold for "very small" risk.
3. Assessment of Expert Determination. The Ridgeline certification appears facially adequate under 45 C.F.R. § 164.514(b)(1). The certification is issued by a qualified expert, references the application of generally accepted statistical and scientific methods, reaches a conclusion that the risk of re-identification is "very small," and appears to document the general methods employed. The HHS De-Identification Guidance does not prescribe a specific methodology or statistical threshold that must be met, leaving considerable discretion to the expert.
We note, however, an important limitation: PCA provided only a summary of Ridgeline's certification during due diligence. AHT did not receive the full underlying statistical analysis, the detailed methodology report, the specific k-anonymity threshold employed, the population-uniqueness modeling parameters, or the complete results of the probabilistic linkage tests. PCA's counsel at Hargrove, Delacroix & Stein LLP indicated during negotiations that the full Ridgeline report is proprietary and competitively sensitive, but that it would be made available for review under the audit-rights provision of the DLA (Section 8.3).
Recommendation: We recommend that AHT exercise its audit rights during the first annual audit cycle to request a copy of the full Ridgeline Statistical Sciences LLC Expert Determination report through Crestfield Advisory Group LLP (the default compliance auditor designated under Section 8.3 of the DLA). Independent review of the full report would allow AHT to confirm the rigor and scope of the statistical analysis, verify that the k-anonymity thresholds and linkage-test parameters are consistent with current best practices, and provide additional assurance regarding the de-identified status of the data.
D. Re-Identification Risk and Residual Concerns
1. Mosaic Effect and Longitudinal Data Risks. While the licensed dataset appears to qualify as de-identified under both HIPAA methods, it is important to acknowledge the residual re-identification risks inherent in large-scale longitudinal datasets. The academic literature on data privacy has extensively documented the phenomenon known as the "mosaic effect," whereby the combination of multiple individually innocuous data points can, in the aggregate, permit the re-identification of specific individuals. See, e.g., Latanya Sweeney, Simple Demographics Often Identify People Uniquely, Data Privacy Working Paper No. 3 (Carnegie Mellon Univ. 2000); Paul Ohm, Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization, 57 UCLA L. Rev. 1701 (2010).
The licensed dataset presents several characteristics that elevate the theoretical re-identification risk relative to smaller or cross-sectional datasets:
• Longitudinal depth. The dataset spans eight full calendar years (2016–2023), providing a comprehensive chronological record of each de-identified patient's healthcare utilization over time. Longitudinal data enables the creation of unique "claim trajectories" that may, in rare cases, be sufficiently distinctive to serve as quasi-identifiers.
• Scale and granularity. The dataset contains approximately 85 million patient records and approximately 3.4 billion individual claim lines, with 247 data fields per record. The richness and granularity of the data—encompassing professional, facility, pharmacy, and ancillary claims across three lines of business—increases the number of potential quasi-identifier combinations.
• Clinical specificity. The dataset includes diagnosis codes (ICD-10-CM), procedure codes (CPT, HCPCS, ICD-10-PCS), and National Drug Codes, which may in some cases relate to rare diseases, uncommon procedures, or specialty medications with small patient populations. An individual with a unique combination of rare diagnoses and treatments in a low-population geographic area could theoretically be at elevated risk of re-identification.
These risks are, however, substantially mitigated by the contractual protections negotiated into the DLA. AHT's non-re-identification covenant (Section 5.2) contractually prohibits AHT from attempting to link the de-identified data to any identifiable individual, and this covenant extends to all AHT employees, contractors, and agents with access to the data. The DLA's security requirements (Exhibit C), which mandate NIST SP 800-171-aligned administrative, technical, and physical safeguards, reduce the risk of unauthorized access by external actors who might attempt re-identification. Finally, the DLA's restrictions on downstream transfer prohibit AHT from sharing raw data with third parties, limiting the data's exposure to potential adversarial linkage attacks.
2. Quarterly Refresh Data. The DLA provides for quarterly data refreshes to be delivered by PCA for a period of 36 months following the Effective Date (through June 30, 2027). Each quarterly refresh will introduce new claims data for the most recent calendar quarter, potentially including claims from new patients not previously represented in the dataset.
PCA's de-identification representations and warranties under the DLA extend expressly to all refresh data delivered during the term. Section 4.1(c) of the DLA requires that each quarterly refresh comply with the same HIPAA Safe Harbor and Expert Determination standards applicable to the initial dataset. PCA is obligated to deliver, concurrently with each quarterly refresh, a written certification from its Chief Privacy Officer confirming that the refresh data meets the applicable de-identification standards.
Recommendation: We recommend that AHT implement internal protocols—under the supervision of Marcus Ellison, Chief Data Officer—to confirm that each quarterly refresh delivery includes PCA's de-identification compliance certification and that AHT's data engineering team performs a technical spot-check of the refresh data to verify the absence of any HIPAA identifiers. This recommendation is further detailed in Section X.B below.
IV. AHT'S STATUS UNDER HIPAA
A. Covered Entity / Business Associate Analysis
AHT is not a "covered entity" under HIPAA. HIPAA's Privacy Rule applies to three categories of covered entities: (1) health plans, (2) healthcare clearinghouses, and (3) healthcare providers that conduct standard electronic transactions (such as electronic claims submission). 45 C.F.R. § 160.103. AHT does not fall within any of these categories. AHT is a healthcare-services and software company that provides analytics tools and SaaS platforms to healthcare industry participants; it does not itself operate a health plan, function as a clearinghouse, or furnish healthcare services to patients.
AHT may, in certain contexts, function as a "business associate" under HIPAA. A business associate is a person or entity that, on behalf of a covered entity, performs functions or activities involving the use or disclosure of PHI, or provides certain enumerated services to a covered entity involving the use or disclosure of PHI. 45 C.F.R. § 160.103. AHT's SaaS platform customers include health systems, payers, and employer-sponsored plans, some of which are HIPAA covered entities. To the extent AHT receives, maintains, transmits, or creates PHI on behalf of these customers in the course of providing its SaaS services, AHT may be functioning as a business associate and may have separate business associate agreements ("BAAs") with those customers.
However, AHT's receipt of the PCA licensed data does not, standing alone, trigger business associate status. The licensed data is de-identified and is not PHI. An entity that receives de-identified information does not, by virtue of that receipt alone, become a business associate of the entity that originally collected the data as PHI. The PCA data license is a direct commercial licensing arrangement between AHT and PCA; AHT is not performing a function or service on behalf of any covered entity in connection with its receipt and use of the de-identified data. Accordingly, AHT does not need a BAA with PCA or with PCA's upstream data-contributing health plans in order to receive and use the licensed data, so long as the data is and remains properly de-identified.
The PCA data license does not implicate AHT's existing BAA relationships with its SaaS platform customers. AHT's use of the PCA data for internal analytics, model training, and product development is separate from, and does not involve the commingling of, any PHI that AHT may receive from its customers under existing BAAs. AHT should maintain appropriate data segregation and access controls to ensure that the PCA de-identified data and any PHI received under BAAs are stored and processed in separate logical or physical environments.
B. Implications if De-Identification is Compromised
Although we have concluded that the licensed data is de-identified based on PCA's representations, it is prudent to consider the regulatory implications if the de-identification were later determined to be defective—that is, if the licensed data were found to contain PHI.
If the licensed data were determined to contain PHI, several adverse consequences could follow:
• AHT's receipt and use of the data without a BAA with the original data sources (i.e., the regional health plans and TPAs that contributed identifiable claims data to PCA) could constitute a violation of the HIPAA Privacy Rule. Under the Privacy Rule, a covered entity may disclose PHI to a business associate only pursuant to a written BAA that satisfies the requirements of 45 C.F.R. § 164.504(e). If the data is PHI rather than de-identified information, the disclosure by the contributing covered entities to PCA, and PCA's subsequent disclosure to AHT, would need to be covered by an appropriate chain of BAAs or other HIPAA-compliant authorization mechanisms.
• AHT could be deemed an unauthorized recipient of PHI, potentially exposing AHT to enforcement action by the HHS Office for Civil Rights ("OCR"). While OCR has historically focused enforcement actions on covered entities and their direct business associates, the HITECH Act (42 U.S.C. § 17934) extended direct HIPAA liability to business associates, and the regulatory environment continues to evolve.
• State law breach notification obligations could be triggered if the defectively de-identified data were accessed by an unauthorized party, as discussed in Section V.B below.
The DLA provides AHT with contractual protections in the event of defective de-identification. PCA's indemnification obligation under Section 9.1 of the DLA requires PCA to indemnify and hold harmless AHT from and against all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or related to a breach of PCA's de-identification representations and warranties. This indemnification is subject to a cap of $9,000,000 per party, equal to the total license fee. Notably, Section 9.3 of the DLA provides that liability is uncapped for willful misconduct or any breach resulting in the re-identification of an individual, providing AHT with additional protection in the most severe scenarios. The combination of the general indemnification cap and the uncapped carve-out for re-identification-related breaches reflects a commercially reasonable allocation of risk between the parties.
V. MASSACHUSETTS DATA PRIVACY LAW ANALYSIS (M.G.L. c. 93H)
A. Overview of Massachusetts Standards
Massachusetts General Laws Chapter 93H governs the protection of "personal information" of Massachusetts residents. The statute defines "personal information" as a Massachusetts resident's first name (or first initial) and last name in combination with any one or more of the following data elements: (i) a Social Security number; (ii) a driver's license number or state-issued identification card number; or (iii) a financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number, or password that would permit access to a resident's financial account. M.G.L. c. 93H, § 1.
The Massachusetts data security regulations at 201 CMR 17.00 complement Chapter 93H by requiring all persons who own or license "personal information" of Massachusetts residents to develop, implement, maintain, and monitor a comprehensive, written information security program (commonly referred to as a "WISP") that contains administrative, technical, and physical safeguards appropriate to the size, scope, and type of business, the amount of resources available, the amount of stored data, and the need for security and confidentiality of both consumer and employee information. 201 CMR 17.03.
It is important to note that the Massachusetts definition of "personal information" is narrower than HIPAA's definition of PHI. Massachusetts law does not treat medical information alone as "personal information" unless it is combined with a name and one of the enumerated data elements (SSN, driver's license/ID number, or financial account number). Accordingly, the mere presence of medical claims data—even if identifiable—would not trigger Chapter 93H obligations unless the data also contained a name-plus-identifier combination.
B. Breach Notification Obligations
Massachusetts General Laws Chapter 93H, Section 3 imposes breach notification obligations on any person or entity that owns or licenses data that includes "personal information" of a Massachusetts resident. In the event of a "breach of security" (defined as the unauthorized acquisition or use of unencrypted data or the encrypted electronic data and the confidential process or key that is capable of compromising the security, confidentiality, or integrity of personal information), the entity must provide notice to: (i) the Massachusetts Attorney General; (ii) the Director of the Office of Consumer Affairs and Business Regulation; and (iii) each affected Massachusetts resident. M.G.L. c. 93H, § 3.
Because the licensed dataset should not contain "personal information" as defined under Chapter 93H—given that all eighteen HIPAA Safe Harbor identifiers, including names, Social Security numbers, and financial account numbers, have been removed—the breach notification obligations under Chapter 93H should not be triggered by unauthorized access to the licensed data alone. The de-identified patient tokens, clinical codes, geographic indicators (state and three-digit zip code prefix), and other data elements in the licensed dataset do not, individually or in combination, constitute "personal information" under Massachusetts law.
However, if PCA's de-identification were defective and the data were found to contain the name of a Massachusetts resident in combination with a Social Security number, driver's license number, or financial account number, AHT—as a licensee of such data—would be subject to the full panoply of Chapter 93H breach notification obligations. Given AHT's Massachusetts headquarters and the likelihood that the dataset includes claims originating from Massachusetts-based health plans and enrollees, this scenario would present significant regulatory exposure.
C. Intersection with AHT's Massachusetts Operations
AHT is headquartered in Massachusetts at 400 Seaport Boulevard, Suite 1200, Boston, MA 02210, and likely handles personal information of Massachusetts residents in the ordinary course of its SaaS business operations, separate and apart from the PCA data license. AHT should already have in place a written information security program compliant with 201 CMR 17.00 to protect any personal information of Massachusetts residents that it receives through its SaaS platform operations.
The PCA dataset's coverage of commercial, Medicare Advantage, and Medicaid managed-care lines of business across multiple states necessarily includes claims originating from Massachusetts-based health plans and enrollees. While the de-identification of this data should prevent it from constituting "personal information" under Massachusetts law, the data nonetheless relates to the healthcare utilization of individuals who include Massachusetts residents.
Recommendation: Even though the de-identified data should not constitute "personal information" under M.G.L. c. 93H, we recommend that AHT ensure the NIST SP 800-171-aligned safeguards required under Exhibit C of the DLA are incorporated into AHT's existing Massachusetts WISP. This integration will provide a unified security framework covering both the PCA licensed data and any personal information that AHT handles in the ordinary course of its business, and will demonstrate AHT's commitment to comprehensive data protection in the event of any regulatory inquiry by the Massachusetts Attorney General's office.
VI. CALIFORNIA CONFIDENTIALITY OF MEDICAL INFORMATION ACT (CMIA) ANALYSIS
A. Applicability. The California Confidentiality of Medical Information Act, codified at California Civil Code Sections 56 through 56.37, restricts the disclosure and use of "medical information." The CMIA defines "medical information" as "any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient's medical history, mental or physical condition, or treatment." Cal. Civ. Code § 56.05(j).
The CMIA applies to several categories of entities, including: (i) "providers of health care" (licensed healthcare professionals and facilities); (ii) "health care service plans" (entities that arrange for the provision of healthcare services); and (iii) "contractors," defined as any person or entity that is a recipient of medical information from a provider of health care, health care service plan, or pharmaceutical company for purposes of administering, maintaining, or operating the entity's patient information system or health care service plan. Cal. Civ. Code § 56.05(d).
PCA's dataset may include claims originating from California-sourced health plans and enrollees, given its broad coverage of commercial and Medicaid managed-care lines of business across multiple states. The PCA data dictionary does not indicate the specific states from which contributing health plans originate, but PCA's nationwide aggregation model makes it highly likely that California-sourced claims are represented in the dataset.
B. De-Identified Data Under CMIA
Unlike HIPAA, the CMIA does not contain a de-identification safe harbor directly analogous to the Safe Harbor or Expert Determination methods set forth at 45 C.F.R. § 164.514(b). The CMIA's regulatory framework predates HIPAA's de-identification provisions and has not been updated to incorporate a parallel de-identification methodology.
However, the CMIA's definition of "medical information" is expressly limited to information that is "individually identifiable." Cal. Civ. Code § 56.05(j). Data that has been de-identified to the point where it cannot be linked to or used to identify an individual patient should, as a logical matter, fall outside the scope of "medical information" under the CMIA, because it is no longer "individually identifiable." This interpretation is supported by the plain language of the statute and by the general principle that privacy statutes are designed to protect identifiable individuals, not to restrict the use of aggregate or anonymized data.
We note, however, that the California Attorney General's office has not issued formal guidance specifically addressing the interaction of HIPAA de-identification standards with the CMIA's "individually identifiable" standard. There is no published California appellate decision directly addressing whether data de-identified under HIPAA's Safe Harbor or Expert Determination methods necessarily falls outside the CMIA's definition of "medical information." This absence of definitive authority introduces some ambiguity regarding the CMIA's applicability to the licensed dataset.
C. Risk Assessment and Recommendations
We assess the CMIA risk as low to moderate. If PCA's de-identification is robust and effective—as represented and warranted in the DLA—the licensed data should not constitute "individually identifiable" information and should therefore fall outside the CMIA's definition of "medical information." The HIPAA Safe Harbor method's requirement that all eighteen categories of identifiers be removed, combined with the Expert Determination method's "very small" risk standard, provides a high degree of confidence that the data is not individually identifiable.
The preliminary privacy-risk assessment by David Whitfield of Whitfield & Ames, P.C. specifically flagged this issue and recommended that the DLA include a representation from PCA that, to the extent any claims in the licensed dataset originate from California sources, PCA has complied with all applicable CMIA requirements, including any restrictions on the collection, de-identification, or downstream licensing of California-sourced medical information.
The executed DLA includes, in Section 4.1(f), PCA's general representation that it has complied with all applicable federal and state laws governing the collection, de-identification, and licensing of the data. While this representation is not CMIA-specific, it should be broad enough to encompass CMIA compliance to the extent the CMIA applies to PCA's handling of California-sourced claims data. PCA's indemnification obligation under Section 9.1 would provide AHT with a contractual remedy if PCA's compliance representation proves to be inaccurate.
Recommendation: AHT should not use the licensed data in any manner that could be interpreted as re-identification of California patients or that could bring AHT within the CMIA's definition of a "contractor" receiving individually identifiable medical information. The non-re-identification covenant in Section 5.2 of the DLA provides a contractual backstop in this regard. AHT should also ensure that its internal data-use policies expressly prohibit any attempt to link the PCA data to identifiable California patients.
VII. FTC ACT § 5 ANALYSIS
A. Unfair or Deceptive Acts or Practices
Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45, broadly prohibits "unfair or deceptive acts or practices in or affecting commerce." The FTC has increasingly used this authority as the basis for enforcement actions in the data privacy and security space, even in the absence of a comprehensive federal data privacy statute. The FTC's jurisdiction is broad and extends to most commercial entities, including healthcare technology companies such as AHT. See, e.g., FTC v. Strathmore Corporation Worldwide Corp., 799 F.3d 236 (3d Cir. 2015) (affirming FTC's authority to bring data security enforcement actions under § 5).
Of particular relevance to this transaction, the FTC has taken the position that companies making representations about data anonymization or de-identification may be liable under Section 5 if those representations are misleading, if the de-identification is inadequate, or if the company fails to maintain safeguards sufficient to protect the data from re-identification. The FTC's enforcement theory in this context rests on the premise that consumers and business partners rely on representations of anonymization, and that inadequate anonymization constitutes a deceptive practice.
B. FTC Guidance on De-Identification
The FTC has issued several staff reports and policy statements addressing the use of de-identified data. Most notably, the FTC's March 2012 staff report, Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers, set forth a three-part framework for the responsible use of de-identified data. Under this framework, companies using de-identified data should:
(i) Take reasonable steps to de-identify the data. The FTC has indicated that HIPAA-compliant de-identification methods represent a reasonable standard for healthcare data, though the FTC has not formally adopted HIPAA's methods as a safe harbor for FTC enforcement purposes.
(ii) Publicly commit not to re-identify the data. The FTC expects that entities using de-identified data will make affirmative commitments—whether in privacy policies, terms of service, or contractual agreements—not to attempt re-identification.
(iii) Contractually prohibit downstream recipients from re-identifying the data. Where de-identified data is shared with or licensed to third parties, the FTC expects contractual restrictions prohibiting the recipient from attempting re-identification.
AHT's Data License Agreement satisfies all three elements of the FTC's framework. First, PCA has de-identified the data using both HIPAA-compliant methods (Safe Harbor and Expert Determination), which represent reasonable and widely accepted de-identification standards. Second, AHT has covenanted in Section 5.2 of the DLA not to attempt re-identification, constituting an affirmative contractual commitment. Third, AHT is prohibited under Section 5.4 of the DLA from sub-licensing or transferring raw data to third parties, and any permitted derivative products must be designed to prevent re-identification.
C. Risk Assessment
We assess the FTC risk as low. AHT's intended uses of the licensed data—internal analytics, model training, product development, and SaaS platform integration—are consistent with legitimate commercial purposes and do not involve consumer-facing representations about individual-level data. AHT is not making public claims about the anonymity or de-identification of the data to consumers; rather, AHT is a downstream commercial licensee using the data for internal business purposes and as an input into its commercial analytics products. The FTC's enforcement interest in this context would most likely be directed at PCA (as the entity performing the de-identification and making representations about the data's anonymized status) rather than at AHT (as the downstream licensee).
Nevertheless, prudent data governance practices dictate that AHT maintain appropriate documentation of its compliance with the non-re-identification covenant and the NIST SP 800-171 safeguards required under Exhibit C. Such documentation would serve as evidence of reasonable data practices and good faith in the event of any FTC inquiry, complaint, or investigation.
Recommendation: AHT should maintain contemporaneous records of its compliance with the DLA's data-use restrictions, non-re-identification covenant, and security requirements. These records should include access logs, training records for personnel with access to the licensed data, incident-response documentation (if any), and quarterly confirmation of PCA's de-identification certifications for refresh data deliveries.
VIII. EVALUATION OF CONTRACTUAL PROTECTIONS IN THE DATA LICENSE AGREEMENT
This Section provides a detailed evaluation of the key contractual provisions in the DLA that mitigate the regulatory and privacy risks identified in this memorandum.
A. PCA's Key Representations and Warranties
Section 4.1 of the DLA sets forth PCA's representations and warranties to AHT, including the following provisions of particular relevance to HIPAA and privacy compliance:
(i) De-Identification Compliance. PCA represents and warrants that all data included in the licensed dataset—including the initial delivery and all quarterly refresh deliveries—has been de-identified in compliance with both the HIPAA Safe Harbor method (45 C.F.R. § 164.514(b)(2)) and the Expert Determination method (45 C.F.R. § 164.514(b)(1)).
(ii) Rights to License. PCA represents and warrants that it has all necessary rights under its downstream data-contribution agreements with regional health plans and third-party administrators to grant the license contemplated by the DLA, and that the execution and performance of the DLA will not violate or conflict with any such agreement.
(iii) No Revocation or Restriction. PCA represents and warrants that no claims data included in the licensed dataset originates from any contributing source that has revoked, terminated, or restricted PCA's right to sub-license or otherwise distribute the de-identified data.
(iv) No PHI. PCA represents and warrants that the licensed dataset does not contain any Protected Health Information as defined under 45 C.F.R. § 160.103.
Assessment: These representations are appropriately comprehensive and provide a strong contractual foundation for AHT's reliance on the de-identified status of the data. The representations cover both the initial dataset and all refresh deliveries, address PCA's rights under its upstream agreements, and specifically affirm the absence of PHI. The survival period for these representations extends for three years following termination or expiration of the DLA, providing AHT with a meaningful contractual remedy window.
B. AHT's Non-Re-Identification Covenant
Section 5.2 of the DLA contains AHT's covenant not to attempt to re-identify any individual from the licensed data. The covenant is drafted broadly and provides as follows:
AHT covenants that it shall not, directly or indirectly, use the licensed data, alone or in combination with any other data or information, to identify or attempt to identify any individual who is a subject of the licensed data, and shall not permit any of its employees, contractors, agents, or other representatives to do so.
This covenant is consistent with HIPAA regulatory expectations, FTC guidance on de-identified data, and industry best practices for the responsible use of de-identified healthcare information. The covenant's extension to AHT's employees, contractors, and agents ensures that all individuals with access to the data are bound by the non-re-identification obligation, either directly (in the case of employees) or through flow-down contractual provisions (in the case of contractors and agents).
C. Safeguards Requirements
Exhibit C to the DLA specifies the administrative, technical, and physical safeguards that AHT must implement in connection with its receipt, storage, processing, and use of the licensed data. The safeguards are aligned with NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, which establishes a rigorous framework for the protection of sensitive but unclassified information. The key safeguards requirements include:
• AES-256 encryption at rest and in transit. All licensed data must be encrypted using the AES-256 standard (or equivalent) both when stored on AHT's systems and when transmitted over any network.
• Role-based access controls. Access to the licensed data must be restricted to authorized personnel on a need-to-know basis, with access permissions defined by role and reviewed at least quarterly.
• Multi-factor authentication. All personnel accessing the licensed data must authenticate using multi-factor authentication (MFA).
• Logging and audit trails. AHT must maintain comprehensive audit logs of all access to the licensed data, including user identity, timestamp, data accessed, and actions performed. Logs must be retained for a minimum of three years.
• Incident-response procedures with 72-hour notification to PCA. In the event of any security incident involving the licensed data, AHT must notify PCA within