Skip to Main Content

HHS Provides Guidance on Methods for De-identifying PHI

Monday, January 14, 2013

On Nov. 26, 2012, HHS released technical guidance and a related webpage regarding methods for de-identification of protected health information (PHI) in accordance with the HIPAA Privacy Rule.
Because health information can be useful even when it is not individually identifiable, the Privacy Rule allows a covered entity to freely use and disclose information that neither identifies nor provides a reasonable basis to identify an individual. HHS identified the following two available methods for satisfying the Privacy Rule’s de-identification standard:

  • A formal determination by a qualified expert (Expert Determination Method)
  • The removal of specified individual identifiers as well as absence of actual
    knowledge by the covered entity that the remaining information could be used
    alone or in combination with other information to identify the individual (Safe
    Harbor Method)

Under the Expert Determination Method for de-identifying PHI, a
person with appropriate knowledge of and experience with generally accepted
statistical and scientific principles and methods for rendering information not
individually identifiable does the following:

  • Applies these principles and methods and determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an  anticipated recipient to identify an individual who is a subject of the  information
  • Documents the methods and results of the analysis that justify
    this determination

Under the Safe Harbor Method for de-identification, a covered entity is protected if it does not have actual knowledge that the information could be used alone, or in combination with other information, to identify the subject of the information and specific identifiers are removed, including:

  • Names, telephone numbers and Social Security numbers
  • All geographic subdivisions smaller than a state
  • All dates, except years, that are directly related to an individual
  • Any other unique identifying number, characteristic or code, except those that are otherwise permitted by the privacy rule

Material posted on this website is for informational purposes only and does not constitute a legal opinion or medical advice. Contact your legal representative or medical professional for information specific to your legal or medical needs.

Get Started

Let Your Aspirations Set the Agenda

Grow with who you know. Reach out to us today and start the conversation, so you’re better protected and prepared for what comes next.

Talk to an Advisor

man looking left