Processes de-identified data, in Alabama

Alabama Hospital Discharge Data Act, Ala. Code secs. 22-21-413 to 22-21-415 (Act 2021-129) · Read the law's page

• If you are the Alabama Hospital Association or the Alabama Department of Public Health, do not make available to the public any hospital discharge data or other information that reasonably could be expected to reveal the identity of any patient (section 22-21-413(c)).
• If you are the Alabama Department of Public Health, treat reported hospital discharge data as confidential and do not make it available to the public until you have processed and verified that it satisfies the requirements for public disclosure under the Act and applicable federal law (section 22-21-413(c)).
• If you are the Alabama Department of Public Health, adopt rules on the processed and verified discharge data made available to the public and on the release of limited data sets, and make the rules compliant with HIPAA (section 22-21-413(d)).
• If you are the Alabama Department of Public Health, do not include in a report or study you prepare and release from discharge data any information obtained from the data in a form which could be used to identify any patient (section 22-21-414).
• If you are the Alabama Department of Public Health, publish a study or information based on discharge data only if it does not include information in a form which could be used to identify any patient or violate HIPAA (section 22-21-415).

Ala. HB 351, 2026 Regular Session, Sec. 9, Sec. 2(10), Sec. 2(18) · Read the law's page

• To treat data as deidentified under the Act, take reasonable measures to ensure that it cannot be associated with an individual and publicly commit to process it in a deidentified fashion only and not to attempt to reidentify it (Section 2(10)).
• If you are a controller in possession of deidentified data, take measures to ensure that the data cannot reasonably be associated with an individual (Section 9(a)(1)).
• Do not reidentify deidentified data when maintaining and using it (Section 9(a)(2)).
• Contractually obligate every recipient of deidentified data to comply with all provisions of Section 9 (Section 9(a)(3)).
• If you disclose pseudonymous data or deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments it is subject to, and take appropriate steps to address any breach of them (Section 9(e)).