De-identification of Protected Health Information Flashcards
7 cards from real CHPC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 De-identification of Protected Health Information flashcards as text
Which of the following is an example of a biometric identifier that must be removed under the Safe Harbor method?
Answer: Fingerprints and voice prints
Biometric identifiers, including finger and voice prints, are explicitly listed among the 18 Safe Harbor identifiers because they can uniquely identify a specific individual.
A hospital wants to share patient data for public health research while retaining ZIP codes and admission dates. What type of dataset does this represent under HIPAA?
Answer: Limited data set requiring a Data Use Agreement
Because ZIP codes and admission dates are retained—permissible in limited data sets but not in Safe Harbor de-identified data—this qualifies as a limited data set requiring a Data Use Agreement.
May a covered entity re-identify data that it previously de-identified under HIPAA?
Answer: Yes, if it retains a separate code or key that links back to the original PHI, kept securely and not disclosed
HIPAA permits covered entities to retain a re-identification code, provided the code cannot be derived from the PHI itself and the key is kept secure and not disclosed.
Under the HIPAA Safe Harbor method, full 5-digit ZIP codes must generally be removed. Under what specific condition may the first three digits of a ZIP code be retained?
Answer: When the geographic unit formed by the first three digits contains more than 20,000 people
Safe Harbor permits retaining the first three digits of a ZIP code only if the corresponding geographic unit contains more than 20,000 people; otherwise, the digits must be replaced with '000'.
Which entity is responsible for performing the Expert Determination analysis under HIPAA's de-identification standard?
Answer: A person with appropriate knowledge of generally accepted statistical and scientific principles
The Expert Determination method requires a qualified statistician or scientist to apply generally accepted principles—HHS and the IRB are not designated to perform this determination.
What is the primary privacy risk that HIPAA's de-identification standard is designed to mitigate?
Answer: Re-identification of individuals from health data disclosed or released externally
De-identification is specifically designed to prevent re-identification of individuals when health data is shared for research, public health, or other secondary purposes.
Which statement MOST accurately describes de-identified health information under HIPAA?
Answer: De-identified data is not subject to the HIPAA Privacy Rule and may be freely used and disclosed
Once properly de-identified under HIPAA standards, the information is no longer PHI and falls entirely outside the Privacy Rule's scope, including minimum necessary, authorization, and NPP requirements.