Synthetic data is a technique. A determination is a standard.
Synthetic and masked data are useful for building and testing software. When data will be shared, licensed, or used to train models, the question that matters is whether it can be re-identified, and someone qualified has to sign that answer.
Where synthetic data fits, and where it stops
Synthetic data, masking, and redaction are transformation techniques. They are a sensible choice for development and test environments, demos, and schema work, where nobody needs the data to reflect real patients or real behavior.
HIPAA recognizes two ways to de-identify protected health information: Safe Harbor and Expert Determination (ยง164.514(b)). Synthetic generation is not a third path. Data generated from PHI is not de-identified simply because it was generated: models can reproduce rare records and unusual combinations of attributes, which are exactly what makes a person re-identifiable. Whether a synthetic dataset is safe to release is a question for the same statistical assessment as any other dataset.
Fidelity is the point
Analytics, research, data licensing, and model training depend on the signal in real-world data: longitudinal histories, rare cohorts, and relationships between fields. Generated data tends to smooth those away. Expert Determination keeps the real data and removes only the risk that the assessment actually finds.
Choosing the right approach
Software testing and development
Synthetic or masked data is usually enough. The data has to look realistic, not be statistically faithful, and it stays inside your own engineering environment.
Analytics, research, and licensing
Use real data with an Expert Determination scoped to the dataset, the intended use, and the recipient. Signal is preserved and the documentation travels with the data.
AI model training
Models learn from real-world signal. Train on assessed, remediated real data with a determination that covers the training use, so the dataset clears procurement and review.
Questions to ask about any de-identification claim
"HIPAA-compliant" on a product page is not evidence. Before you rely on a dataset, synthetic or otherwise, ask for answers to these.
Who signs, and what are their qualifications?
An Expert Determination is an opinion from a qualified statistical expert. You should know who that expert is and why they are qualified, not just that a partner was involved.
Was the expert involved from scoping, or handed the output?
When the expert sets the scope and specifies the remediation, the engineering is aimed at the risk that exists. When they review a finished export, the data has already been changed by guesswork.
Is the opinion scoped to this dataset, use, and recipient?
Re-identification risk depends on who receives the data and what else they hold. A generic certification of a tool or a pipeline does not answer that.
Are the method and the risk threshold documented?
A defensible determination states how risk was measured, what threshold was applied, and what was changed to meet it. That provenance is what holds up under examination.
What happens when the data or the recipients change?
New fields, new data feeds, and new recipients change the risk. Ask how the determination is re-assessed and kept current.
Frequently asked questions
Is synthetic data automatically de-identified under HIPAA?
No. HIPAA recognizes Safe Harbor and Expert Determination. Data generated from PHI can still carry re-identification risk, so whether it can be released depends on an assessment of the resulting dataset, not on how it was produced.
Can a synthetic dataset receive an Expert Determination?
Expert Determination evaluates the re-identification risk of a specific dataset in a specific context, however that dataset was produced. The question is whether the data still carries the signal your use case needs once the risk is addressed.
Why not use Safe Harbor instead?
Safe Harbor removes a fixed list of 18 identifiers, including most dates and fine-grained geography. That often strips the signal analytics and model training need. Expert Determination targets remediation to the actual risk, so more utility is preserved.
How long does an Expert Determination take with Integral?
Integral's turnaround from engagement start to a signed assessment is 4 days. Timeline depends on dataset complexity.
