Many data teams have to keep certain information out of a downstream system: a research database, an analytics warehouse, a payer extract, a partner feed. Often the rule is "exclude patients with HIV" or "remove substance use treatment records". In HL7 v2 feeds that's harder than it sounds, because the information is rarely confined to one field.
This isn't legal advice. What counts as sensitive, and what you must do with it, depends on federal and state law, your contracts and your organization's policies. Work out the rules with your privacy officer; this article is about finding the data.
Why these categories get special treatment
- Substance use disorder treatment records from federally assisted programs fall under 42 CFR Part 2, which is stricter than HIPAA in several ways.
- HIV and other sexually transmitted infections: many states have specific confidentiality laws for HIV test results and status.
- Mental health: psychotherapy notes have extra protection under HIPAA, and states add their own rules.
- Genetic information, reproductive health, abuse and violence, and gender identity are covered by a mix of federal and state laws and by organizational policy.
Where it hides in an HL7 message
| Where | Examples |
|---|---|
Diagnosis codesDG1-3, PRB-3 | ICD-10-CM B20 (HIV disease), Z21 (asymptomatic HIV infection status), F10–F19 (substance-related disorders; F17 nicotine is usually excluded) |
Diagnosis textDG1-3.2, DG1-4 | "HIV disease", "Opioid use disorder", sometimes sent with no code at all |
Admit reasonPV2-3 | "Detox", "Suicidal ideation" |
Locations and servicesPV1-3, PV1-10 | Unit or clinic names such as a behavioral health unit or an addiction medicine clinic |
Lab resultsOBR, OBX | HIV antibody and viral load tests, toxicology screens |
MedicationsRXA, RXE, RXO, notes | Antiretrovirals (for example Biktarvy), buprenorphine and naloxone combinations (for example Suboxone) |
Free textNTE, OBX-5 (TX/FT), comments | "HIV positive", "h/o IVDU", "PrEP", "pt in recovery" |
| Custom segments Z-segments | Site-specific flags and notes, anything at all |
Why simple searches fail
- Codes look like other things. "B20" is also a plausible bed or room number. Code checks belong only in coded fields, where the coding system is ICD-10 or the field is a diagnosis field.
- Words appear inside other words. A naive search for "AIDS" matches "hearing aids" and "walking aids". Match whole words, and treat some terms as case-sensitive.
- Abbreviations and drug names. Clinicians write "IVDU", "PrEP" or a brand name instead of the condition.
- Some terms have innocent meanings. "Overdose", "methadone" or a hepatitis B medication can point to a sensitive condition or not. Those need human review, not automatic removal.
- One message isn't the patient. If the rule is to exclude a patient, a single flagged message has to be traced to every other message about the same person, by patient identifier, across the whole feed.
Flag first, decide second
A reliable process separates finding from acting:
- Scan everything: coded fields by code ranges, and all text fields by phrase, with a confidence level for terms that have other meanings.
- Roll findings up by patient, using
PID-3, so a decision applies to everyone's messages consistently. - Review the medium-confidence findings by hand.
- Then act according to your policy: drop the patient, drop the message, or redact the field, and keep a record of what was done and why.
Keeping detection separate means the rules can be checked and improved without silently losing data, and the people accountable for the policy can see exactly what was found.
How PipeHat helps
PipeHat's sensitive information check (Business plan) does the flagging step in your browser:
- eight categories, from HIV to gender identity;
- ICD-10-CM checks in coded fields only, and whole-word phrase matching;
- confidence levels;
- a list of patients to review, with CSV exports of findings and patients.
It flags only and never removes anything, so the decision stays with you. Because it runs locally, the messages never leave your computer while you check them. To share examples with a vendor afterwards, the de-identifier replaces patient details first.