Audio obfuscation for HIPPA compliance

Question

I have audio files of medical conversations that require HIPPA level protection. I would like to send these files to a third party for transcription. However, the service I would like to use does not provide HIPPA level protection. I would like to use their services, so I'm trying to find ways to get around this. Theoretically, if I obfuscate the audio files by changing the pitch of the voices to the point that they are unrecognizable in tone but still articulate enough to transcribe, would this violate any HIPPA requirements?

If not obvious, I have no law experience, so pardon any egregious misunderstandings of HIPPA law.

Answer 1

The key legal concept is "Individually identifiable health information" as defined in 45 CFR 160.103, which is defined as

information that is a subset of health information, including demographic information collected from an individual, and:

(1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and

(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and

(i) That identifies the individual; or

(ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.

The recorded conversation presumably relates to health, and is "about" including perhaps actually involves the patient. The italicized text is relevant to your concern. Even if the recorded conversation doesn't include a declaration of the patient's name, the content could identify a person (from circumstances). Simple acoustic distortion of a recording does not necessarily render a voice recording "unrecognizable", in part because voice changers are reversible, in part because speech rhythm which is not changed is highly individually-identifiable, and in part because word choice and syntactic structure is also an individual identifier (these are biometric identifiers). In the case of an actual voice recording of a person, it is extremely reasonable to conclude that the patient can be identified.

45 CFR 164.514 spells out possibilities for de-identifying health information. You can't just make up a procedure, the "entity" (hospital, for example) has to have an expert apply "appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable". Basically, if you have to ask, you don't qualify. Or, they have to carefully scrub everything from a long list which includes "biometric identifiers, including finger and voice prints".

Unfortunately, the only way to know for sure if a voice-obfuscation filter still leaves the record with a biometric identifier is to do it and see if you get penalized (not a wise course of action).