Question 1

What is the difference between Safe Harbor and Expert Determination under HIPAA?

Accepted Answer

HIPAA allows two de-identification methods. Safe Harbor requires removing 18 specified identifiers and having no actual knowledge that the remaining data could identify someone. Expert determination relies on a qualified expert who applies statistical or scientific methods, concludes the risk of re-identification is very small for the intended use, and documents the analysis. Expert determination often preserves more useful data than Safe Harbor.

Question 2

Does Tidegate perform HIPAA Expert Determinations?

Accepted Answer

No. Expert determination is made by a qualified expert, often an independent one, and never by Tidegate. Tidegate prepares datasets and documentation for review and introduces customers to independent, qualified experts.

Question 3

How does Tidegate handle 42 CFR Part 2 records?

Accepted Answer

On the roadmap: likely Part 2 content flagged and held for your review. Whether Part 2 applies depends on whether a record came from a Part 2 program, and what any patient consent permits, so that decision stays with your team.

Question 4

Does Tidegate train models on our data?

Accepted Answer

No. Every model runs inside your environment, and nothing is sent to outside AI services. Tidegate improves only from review corrections you choose to share, never from the records themselves.

Question 5

How is re-identification risk measured?

Accepted Answer

A re-identification risk summary ships with every release, measured on the protected output, not the source. The result is prepared for your qualified expert, who makes the determination.

Question 6

How does the engine handle ages over 89 and ZIP codes under Safe Harbor?

Accepted Answer

It applies the Safe Harbor rules directly: ages over 89 are grouped into a single 90-or-older category, and ZIP codes keep only their first three digits, or are fully removed where the three-digit area has 20,000 or fewer residents.

Question 7

Can the engine keep the time between events?

Accepted Answer

Yes, in Expert Determination mode. The engine shifts every date for a person by the same offset, so the order and spacing of events are kept, and re-identification risk is measured on the result for your expert to review. In Safe Harbor mode, dates are reduced to the year, as Safe Harbor requires.

Question 8

Does using the Tidegate engine make our data HIPAA de-identified on its own?

Accepted Answer

No technology can make that determination on its own. The Tidegate engine identifies and treats sensitive data and produces output ready for review. Safe Harbor also requires that the data holder has no actual knowledge the remaining data could identify someone, and expert determination requires a qualified expert's documented analysis. Tidegate introduces customers to independent, qualified experts.

Question 9

Which identifiers does the Tidegate engine detect?

Accepted Answer

Names, with patients and clinicians told apart, contact details, geography and facilities, dates and ages, Social Security numbers, medical record, member, Medicare and Medicaid IDs, claim, case, account and license numbers, provider identifiers such as NPI and DEA numbers, payment card and bank data, and codes already written in your data, such as ICD-10, CPT, HCPCS, NDC, LOINC and SNOMED CT. On the roadmap: relatives told apart from the patient, and suggesting codes for facts found in free text.

Question 10

Does the engine handle Medicare and Medicaid data?

Accepted Answer

Yes. It recognizes Medicare Beneficiary Identifiers, legacy Health Insurance Claim Numbers, Medicaid and CHIP member IDs, T-MSIS eligibility codes and claim administrative codes, which are common in public payer data. MBIs are checked against their published format.

Question 11

Can the Tidegate engine find PHI in unstructured clinical notes?

Accepted Answer

Yes. The engine discovers and classifies PHI and PII across structured records, free-text clinical notes and documents embedded within records, including documents with a text layer. It maps what it finds to a purpose-built health data ontology.

Question 12

Which formats does it read?

Accepted Answer

FHIR R4, HL7 v2, C-CDA, X12 837 and 835, NCPDP and OMOP, plus clinical and case notes and documents with a text layer. Outputs: OMOP, CSV and Parquet. From v1.1: FHIR with Provenance. The engine does not call text services outside your environment.

Question 13

Can the Tidegate engine redact documents?

Accepted Answer

Yes, for text and documents with a text layer, returned as redacted copies alongside protected data. From v1.1: scanned documents. On the roadmap: images. Every redaction is logged with what was found, where and why, so reviewers can check it before release.

Question 14

Does Tidegate replace our token or linkage vendor?

Accepted Answer

No. Tidegate works with the tokens you already have and runs alongside your matcher, measuring the links it produces. In Expert Determination mode it issues holder-issued, purpose-scoped pseudonyms, so you are not tied to one vendor. In Safe Harbor mode, linkage codes are random and not derived from identifiers.

Question 15

How is synthetic data used?

Accepted Answer

Synthetic data for development and testing is released only after memorization tests, with a synthetic data report, so your engineers can build before the real data is cleared. It is not a feasibility measure. Patient counts come from the real data, measured in your environment.

Question 16

Does our data leave our environment?

Accepted Answer

No. The engine runs in a cloud account you control, under your access controls and encryption keys. Identifiers and record-level data stay there, and no telemetry leaves. Only output you approve, such as a de-identified dataset, leaves your environment.

Question 17

Can it run air-gapped?

Accepted Answer

Not yet. Air-gapped packaging with signed offline updates comes in v1.1; today the engine runs in a cloud account you control.

Question 18

Who deploys the Tidegate engine?

Accepted Answer

Tidegate Forward Deployed Engineers deploy it in a cloud account you control, under a BAA whenever they access PHI. They connect your sources, configure discovery, protection and labels, validate on your records and hand over runbooks to your team.

Question 19

What is Tidegate's SOC 2 and HITRUST status?

Accepted Answer

SOC 2 Type I and HITRUST e1 in progress. Because the engine runs in a cloud account you control, it operates under your controls. The security packet, available under NDA, covers architecture, data flow, HIPAA Security Rule safeguards and how engine controls map to SOC 2.

Question 20

Does Tidegate sign a Business Associate Agreement?

Accepted Answer

Yes. Whenever Tidegate engineers access PHI, during an evaluation or a deployment, a Business Associate Agreement is in place first.

Question 21

Who engages the expert for expert determination?

Accepted Answer

You do. We introduce you to independent, qualified providers and prepare the dataset and documentation for their review. The expert reviews on terms you set, including where the review takes place, and the determination is theirs to make.

Question 22

What documents are available for vendor review?

Accepted Answer

The security packet (under NDA), our Business Associate Agreement, our accessibility conformance report when ready, and the documents your procurement team requests during contracting. Email compliance@tidegatehealth.com.

Question 23

How do public agencies start?

Accepted Answer

With a briefing for your agency and your systems integrator on fictional case files. We share the security packet and answer RFI or capability questions. An evaluation on your own records follows once your agreements are in place.

Question 24

Who is Tidegate built for?

Accepted Answer

Health systems and health plans, life sciences and real-world evidence teams, health data networks, and public payers, including state Medicaid agencies, Medicaid managed care plans and their systems integrators.

Question 25

Does Tidegate decide eligibility or coverage?

Accepted Answer

No. Tidegate delivers evidence findings with citations and match explanations to your case system for a caseworker to review. Every match is explained and logged. Your agency sets which matches a caseworker reviews, and no match can reduce or end anyone's coverage without a caseworker's decision. Match quality within your data is reported in every release.

Question 26

How do labels work with AI tools and data requests?

Accepted Answer

Each field carries machine-readable labels for its regime and permitted use, so your query layer and pipelines can enforce them. On the roadmap: checking each data request against its labels as it runs.

Question 27

How does the referential integrity report support regulatory review?

Accepted Answer

It reports match quality within your data for each study, and lists coverage gaps where a participant has no record in a source. Every finding cites its note, page and words, and the release manifest pins engine and rule versions. From v1.1: quality broken out by patient group. The output is designed to support FDA real-world evidence guidance and provides audit-trail evidence for 21 CFR Part 11 programs. System validation and electronic signatures remain with your quality team.

Question 28

What does an evaluation involve?

Accepted Answer

You choose a sample, scoped in writing, and it stays in a cloud account you control. The engine discovers and protects identifiers and labels each field. Your team then reviews release-pack documents 01 to 06 on your own records, with missed identifiers reported first.

Question 29

How can we partner with Tidegate?

Accepted Answer

Partners can refer customers to us. On the roadmap: embedding the engine in their own product (OEM). We agree up front which accounts we serve together.

Questions buyers ask us

{{ g.title }}

Questions buyers ask us

{{ g.title }}

{{ q.q }}{{ q.sign }}