Video 4 · Becoming a HIPAA Qualified Expert

4. The OCR Guidance: Who Is an Expert?

36 min

After this video you can

  • Navigate the 2012 guidance structure
  • Summarize OCR's who-is-an-expert answer
  • Explain after-the-fact qualification review
  • Apply the business associate gate
  • Name what the guidance leaves uncovered

Module 2: The OCR 2012 Guidance · Runtime 36:02 · YouTube title: Who Is a HIPAA Expert? The OCR Guidance on Qualifications

In 2012 the Office for Civil Rights answered the question directly. This video walks the structure of the November 26, 2012 guidance, quotes OCR's answer on who qualifies as an expert, and explains why qualifications are reviewed after the fact.

In this video

  • The guidance's three parts and its question-by-question structure, learned as a lookup skill
  • Figure 2, the determination loop: assess, mitigate, re-measure, repeat
  • Expert determination outside health care: census, education, and economic statistics
  • OCR's verbatim answer: no specific professional degree or certification program exists
  • Internal versus external experts, and why the market prefers independence
  • The business associate gate: the agreement must authorize de-identification before any work begins
  • No mandated process, and the sentences you must quote exactly ("very small, but not zero")
  • What the guidance does not cover: AI redaction, images, waveforms

Authorities quoted on screen

HHS Office for Civil Rights, Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule (November 26, 2012).

Key takeaways

  • OCR requires no degree, certification, or registry membership to be an expert.
  • Qualifications and methods are reviewed after the fact, during an investigation.
  • The business associate agreement must authorize de-identification before any work begins.

Coming next: Video 5, Very Small Risk: The Three Principles

The regulator never gives you a number, only three principles. This video teaches replicability, data source availability, and distinguishability as the analytic engine of every determination, then covers the guidance's transformation classes, expiry, data use agreements, and the six-year retention duty.

Saved in your browser only — no account, no server.