But the growing availability of data on people and improvements in re-identification methodology have nonetheless convinced several privacy advocates that it's time to change the HIPAA de-identification rule. Some have recently submitted public comments on the impending changes to HIPAA. What are they saying?

I wonder what social good would be accomplished by sending out breach-notification letters for de-identified or limited data sets that were mishandled. I can just see it:

"Dear Grandma Cline, this is the hospital you just visited. I hope you had a pleasant stay. We regret to inform you that there has been an incident. One of our hospital staff recently lost a USB drive we believe may have contained a set of statistics that included only the date of discharge from the hospital and ZIP code. We use these data for research purposes according to the Authorization for Research form you signed when you were in. We aren't certain whether your date of discharge and ZIP code were included in these statistics, but we were obliged to re-identify everyone who may have been on the USB drive to notify them. If your data was on this USB drive, we estimate there is less than a 1% chance your data could be re-identified by anyone other than researchers at Carnegie Mellon University who may have found the USB drive, which is a small device that is inserted into a computer that you can save data on. We apologize for this oversight."

Hopefully, HHS will heed the lesson of the past six years of data-breach notification and not contribute to the overnotification and needless worry and concern of the American public.

I recently caught up with Judith Beach, chief privacy officer of Durham, N.C.-based Quintiles. When she was of the chief privacy officer at Synergy -- a former subsidiary of Quintiles -- the company commissioned the first-ever statistical de-identification of a HIPAA-covered data set. Since then, Beach has become a national expert on de-identification. What's her take on the situation?