What constitutes a de-identified patient data in US healthcare?

Question

HIPPA mentions 18 attributes listed here as PHI. Sharing of this data requires certain considerations as outlined by HIPPA. Most importantly data should be de-identified before sharing. As per this link, the process of de-identification removes/masks all direct identifiers from patient data and allows organizations to share it without the potential of violating HIPAA.

My question is if we mask the name & address, but still have those other 18 attributes as unmasked, does that make it de-identified? Or do we need to individually mask each of the 18 attributes? Thanks.

Answer 1

The US Health Insurance Portability and Accountability Act (HIPAA) regulates the use and disclosure of protected health information (PHI).

The legislation allows 6 general categories of use or disclosure:

1. To the Individual (ie patient)
2. Treatment, Payment, and Health Care Operations
3. Opportunity to Agree or Object
4. Incident to an otherwise permitted use and disclosure
5. Public Interest and Benefit Activities
6. Limited Data Set for the purposes of research, public health or health care operations

Check the HHS website for details. Outside of these uses, covered entities are allowed to disclose PHI that is de-identified. The legislation provides two ways a covered entity may de-identify data:

1. Expert Determination
2. Safe Harbor

45 CFR § 164.514 specifically says:

A covered entity may determine that health information is not individually identifiable health information only if:
(1) A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable ...
[or]
(2)
(i) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed:
...
(ii) The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information. [Emphasis added]

The vast majority of de-identification that occurs in the US occurs via the Safe Harbor method. This requires removal of 18 elements from the data:

1. Names
2. All geographic subdivisions smaller than a state (with some exceptions)
3. All elements of dates (except year, with some exceptions)
4. Telephone numbers
5. Vehicle identifier, serial numbers, and license plate numbers
6. Fax numbers
7. Device identifiers and serial numbers
8. Email addresses
9. Web Universal Resource Locators (URLs)
10. Social security numbers
11. Internet Protocol (IP) addresses
12. Medical record numbers
13. Biometric identifiers, including finger and voice prints
14. Health plan beneficiary numbers
15. Full-face photographs and any comparable images
16. Account numbers
17. Any other unique identifying number, characteristic, or code
18. Certificate/license numbers

Notably, if the data contains any of the 18 elements, then it is not de-identified by the Safe Harbor method.

If a covered entity improperly discloses PHI, they may be assessed fines up to $63,973 per instance (IE, per person).

Don't do it.