De-identification of Protected Health Information Flashcards
7 cards from real CHPC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 De-identification of Protected Health Information flashcards as text
Under HIPAA, which two methods are officially recognized for de-identifying protected health information?
Answer: Safe Harbor and Expert Determination
HIPAA's Privacy Rule recognizes two de-identification methods: Safe Harbor (removing 18 specified identifiers) and Expert Determination (a qualified statistician certifies re-identification risk is very small).
Under the HIPAA Safe Harbor method, how many specific categories of identifiers must be removed to achieve de-identification?
Answer: 18
The Safe Harbor method requires removal of exactly 18 categories of identifiers, including names, geographic data smaller than a state, dates, phone numbers, Social Security numbers, and biometric identifiers.
Under the HIPAA Safe Harbor method, which geographic data element may be retained in de-identified data?
Answer: The state
Safe Harbor requires removal of all geographic subdivisions smaller than a state, but the state itself may be retained in de-identified information.
What is a 'limited data set' under HIPAA's Privacy Rule?
Answer: PHI with direct identifiers removed but some indirect identifiers such as dates retained
A limited data set has direct identifiers (names, addresses, phone numbers, SSNs) removed, but may retain indirect identifiers such as dates, ages, and geographic information at the city, state, or ZIP code level.
When a covered entity shares a limited data set, what agreement must be executed with the recipient?
Answer: Data Use Agreement
HIPAA requires a Data Use Agreement (DUA) between the covered entity and any recipient of a limited data set, specifying permitted uses and prohibiting re-identification attempts.
Under the Expert Determination method of de-identification, what must the qualified expert certify?
Answer: That the risk of identifying any individual is very small using generally accepted statistical principles
Under Expert Determination, a person with statistical or scientific knowledge must apply generally accepted principles and document that the probability of identifying an individual is very small.
Once information has been properly de-identified according to HIPAA standards, how does this affect the data's legal status?
Answer: It is no longer considered PHI and HIPAA's Privacy Rule does not apply to it
Properly de-identified information is no longer considered PHI, so the HIPAA Privacy Rule's protections, restrictions, and authorization requirements no longer apply to it.