De-identification of Protected Health Information Flashcards
7 cards from real CHPC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 De-identification of Protected Health Information flashcards as text
Under HIPAA's Safe Harbor method, specific dates must be removed EXCEPT which component?
Answer: The year alone (for individuals under 90)
Safe Harbor requires removing specific dates (birth, admission, discharge, death) but permits retaining the year alone, provided the individual is not 90 years of age or older.
Under the Safe Harbor method, how must the age of an individual who is 90 years or older be reported in a de-identified dataset?
Answer: Their age must be grouped into an aggregate category such as '90 or older'
The Safe Harbor method requires that individuals aged 90 or older have their age collapsed into a single category (e.g., '90 or older') because extreme ages can uniquely identify an individual.
Which of the following is NOT among the 18 identifiers that must be removed under HIPAA's Safe Harbor de-identification method?
Answer: Diagnosis codes (ICD codes)
ICD diagnosis codes are clinical codes that describe conditions, not personal identifiers; the 18 Safe Harbor identifiers target information that can be used to identify a specific individual.
A researcher wants to use de-identified patient data for a clinical study. Which statement about HIPAA requirements is accurate?
Answer: De-identified data may be used for research without HIPAA authorization requirements
Because de-identified data is no longer PHI, the HIPAA Privacy Rule's authorization requirements do not apply, and researchers may use or receive it without patient authorization.
Which of the following identifiers is specifically included among the 18 Safe Harbor categories that must be removed?
Answer: Vehicle identifiers and serial numbers
Vehicle identifiers and serial numbers are explicitly listed among the 18 Safe Harbor identifiers, as they can be traced back to a registered owner.
What distinguishes a limited data set from fully de-identified data under HIPAA?
Answer: A limited data set may retain indirect identifiers such as dates and city-level geographic data
Unlike fully de-identified data, a limited data set may retain indirect identifiers like dates, ages, and geographic data at the city, state, or ZIP code level, while all direct identifiers must be removed.
Under the Expert Determination method, what documentation must the expert maintain to support the de-identification determination?
Answer: Documentation of the methods and results supporting the very small risk determination
HIPAA requires that the expert document the methods applied and results obtained so the de-identification determination can be reviewed and substantiated if later questioned.