A healthcare organization wants to share de-identified patient data with a research university. Under HIPAA, de-identification requires:
-
A
Patient authorization in all cases
-
B
Removal of the 18 specific identifiers listed in the Safe Harbor method or expert statistical determination
-
C
IRB approval only
-
D
A signed business associate agreement with the university