4

HIPPA mentions 18 attributes listed here as PHI. Sharing of this data requires certain considerations as outlined by HIPPA. Most importantly data should be de-identified before sharing. As per this link, the process of de-identification removes/masks all direct identifiers from patient data and allows organizations to share it without the potential of violating HIPAA.

My question is if we mask the name & address, but still have those other 18 attributes as unmasked, does that make it de-identified? Or do we need to individually mask each of the 18 attributes? Thanks.

3
  • I used to work for a team whose job it was to identify people online who went to great lengths to conceal their identities. We often started with no more than a general geographic location and a screen name. And yet with the proper training and tools, we identified almost every one of them. I guarantee that if the only things you redact are the name and address, almost every patient can be identified from the information found in a typical patient file.
    – Carey Gregory
    Dec 14, 2022 at 0:22
  • @CareyGregory Who and why? Dec 14, 2022 at 2:10
  • Who and why doesn't matter. My point was simply that removing only the obvious things like name and address isn't sufficient. People can still be identified via the other 16 items on that list.
    – Carey Gregory
    Dec 14, 2022 at 5:13

1 Answer 1

3

The US Health Insurance Portability and Accountability Act (HIPAA) regulates the use and disclosure of protected health information (PHI).

The legislation allows 6 general categories of use or disclosure:

  1. To the Individual (ie patient)
  2. Treatment, Payment, and Health Care Operations
  3. Opportunity to Agree or Object
  4. Incident to an otherwise permitted use and disclosure
  5. Public Interest and Benefit Activities
  6. Limited Data Set for the purposes of research, public health or health care operations

Check the HHS website for details. Outside of these uses, covered entities are allowed to disclose PHI that is de-identified. The legislation provides two ways a covered entity may de-identify data:

  1. Expert Determination
  2. Safe Harbor

45 CFR § 164.514 specifically says:

A covered entity may determine that health information is not individually identifiable health information only if:
(1) A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable ...
[or]
(2)
(i) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed:
...
(ii) The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information. [Emphasis added]

The vast majority of de-identification that occurs in the US occurs via the Safe Harbor method. This requires removal of 18 elements from the data:

  1. Names
  2. All geographic subdivisions smaller than a state (with some exceptions)
  3. All elements of dates (except year, with some exceptions)
  4. Telephone numbers
  5. Vehicle identifier, serial numbers, and license plate numbers
  6. Fax numbers
  7. Device identifiers and serial numbers
  8. Email addresses
  9. Web Universal Resource Locators (URLs)
  10. Social security numbers
  11. Internet Protocol (IP) addresses
  12. Medical record numbers
  13. Biometric identifiers, including finger and voice prints
  14. Health plan beneficiary numbers
  15. Full-face photographs and any comparable images
  16. Account numbers
  17. Any other unique identifying number, characteristic, or code
  18. Certificate/license numbers

Notably, if the data contains any of the 18 elements, then it is not de-identified by the Safe Harbor method.

If a covered entity improperly discloses PHI, they may be assessed fines up to $63,973 per instance (IE, per person).

Don't do it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.