Covered California Data Disclosure Support

Data Analysis and Protect Insights to Improve Your Business Process with Software Development. A female software engineer on software project development to analyzing and ensuring reliability in a tech business office.

Problem

Covered California needs a rigorous disclosure review process to ensure public data releases protect consumer privacy.

As California’s health insurance marketplace, Covered California collects sensitive data from consumers and research participants. While not a HIPAA-covered entity, the agency voluntarily adheres to HIPAA privacy standards when releasing data to the public. To strengthen its commitment to data privacy, Covered California engaged NORC to develop a comprehensive, agency-wide procedure for disclosure review, including de-identification review and re-identification risk assessment. The goal is to ensure that all public-facing data products meet the highest standards of privacy protection while maintaining data utility for research and policy.

Solution

NORC developed a robust disclosure review process and trained staff to implement it.

NORC partnered with Covered California to design an agency-wide, step-by-step process for assessing disclosure risk and applying de-identification techniques. The process establishes clear standards for evaluating re-identification and attribution risk, provides guidance on appropriate statistical disclosure limitation methods, and includes tools to support consistent implementation across data products.

To build sustainability, NORC conducted live virtual trainings for Covered California staff, to equip them with the knowledge and materials needed to independently conduct de-identification reviews.

This work builds on NORC’s longstanding relationship with Covered California and leverages its national leadership in disclosure avoidance, including projects for federal agencies and organizations that voluntarily follow HIPAA-aligned privacy practices.

Result

Covered California now has the tools to implement a sustainable, agency-wide process to prevent disclosure in public data releases.

The project developed a disclosure review process tailored to Covered California’s data and organizational needs, along with a training curriculum and an implementation toolkit (including disclosure limitation plans, guidelines, etc.). These tools empower Covered California staff to conduct disclosure reviews that meet HIPAA standards and other relevant regulations. The process is efficient, replicable, and adaptable to a wide range of data products.

By strengthening its internal capacity and formalizing its privacy practices, Covered California can share valuable data with the public while safeguarding individual privacy and supporting evidence-based policy.