On Nov. 26, 2012, HHS released technical guidance and a related webpage regarding methods for de-identification of protected health information (PHI) in accordance with the HIPAA Privacy Rule.
Because health information can be useful even when it is not individually identifiable, the Privacy Rule allows a covered entity to freely use and disclose information that neither identifies nor provides a reasonable basis to identify an individual. HHS identified the following two available methods for satisfying the Privacy Rule’s de-identification standard:
- A formal determination by a qualified expert (Expert Determination Method)
- The removal of specified individual identifiers as well as absence of actual
knowledge by the covered entity that the remaining information could be used
alone or in combination with other information to identify the individual (Safe
Harbor Method)
Under the Expert Determination Method for de-identifying PHI, a
person with appropriate knowledge of and experience with generally accepted
statistical and scientific principles and methods for rendering information not
individually identifiable does the following:
- Applies these principles and methods and determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information
- Documents the methods and results of the analysis that justify
this determination
Under the Safe Harbor Method for de-identification, a covered entity is protected if it does not have actual knowledge that the information could be used alone, or in combination with other information, to identify the subject of the information and specific identifiers are removed, including:
- Names, telephone numbers and Social Security numbers
- All geographic subdivisions smaller than a state
- All dates, except years, that are directly related to an individual
- Any other unique identifying number, characteristic or code, except those that are otherwise permitted by the privacy rule
Material posted on this website is for informational purposes only and does not constitute a legal opinion or medical advice. Contact your legal representative or medical professional for information specific to your legal or medical needs.
