CHPC De-identification of Protected Health Information

Question 1

Under HIPAA, which two methods are officially recognized for de-identifying protected health information?

Accepted Answer

Safe Harbor and Expert Determination

Answer

Anonymization and Pseudonymization

Answer

Encryption and Tokenization

Answer

Data Masking and Aggregation

Question 2

Under the HIPAA Safe Harbor method, how many specific categories of identifiers must be removed to achieve de-identification?

Accepted Answer

18

Answer

12

Answer

15

Answer

21

Question 3

Under the HIPAA Safe Harbor method, which geographic data element may be retained in de-identified data?

Accepted Answer

The state

Answer

Street address

Answer

County name

Answer

Full 5-digit ZIP code

Question 4

What is a 'limited data set' under HIPAA's Privacy Rule?

Accepted Answer

PHI with direct identifiers removed but some indirect identifiers such as dates retained

Answer

PHI with all 18 Safe Harbor identifiers removed

Answer

Fully anonymized health information with no remaining identifiers

Answer

Encrypted PHI accessible only to authorized workforce members

Question 5

When a covered entity shares a limited data set, what agreement must be executed with the recipient?

Accepted Answer

Data Use Agreement

Answer

Business Associate Agreement

Answer

Memorandum of Understanding

Answer

Confidentiality and Non-Disclosure Agreement

Question 6

Under the Expert Determination method of de-identification, what must the qualified expert certify?

Accepted Answer

That the risk of identifying any individual is very small using generally accepted statistical principles

Answer

That all 18 Safe Harbor identifiers have been removed

Answer

That the data has been encrypted using FIPS 140-2 compliant algorithms

Answer

That the dataset contains fewer than 100 records

Question 7

Once information has been properly de-identified according to HIPAA standards, how does this affect the data's legal status?

Accepted Answer

It is no longer considered PHI and HIPAA's Privacy Rule does not apply to it

Answer

It remains PHI but with reduced privacy protections

Answer

It can only be used for treatment purposes without further restrictions

Answer

It requires patient authorization before it may be used or disclosed