CHPC De-identification of Protected Health Information 2 — Questions and Answers
Question 1: Under HIPAA's Safe Harbor method, specific dates must be removed EXCEPT which component?
- Birth date
- Admission and discharge dates
- The year alone (for individuals under 90) (Correct answer)
- Date of death
Correct answer: The year alone (for individuals under 90)
Safe Harbor requires removing specific dates (birth, admission, discharge, death) but permits retaining the year alone, provided the individual is not 90 years of age or older.
Question 2: Under the Safe Harbor method, how must the age of an individual who is 90 years or older be reported in a de-identified dataset?
- Their exact age must be removed entirely from the record
- Their age must be grouped into an aggregate category such as '90 or older' (Correct answer)
- Their age must be replaced with the dataset's mean age
- Their age must be encrypted rather than removed
Correct answer: Their age must be grouped into an aggregate category such as '90 or older'
The Safe Harbor method requires that individuals aged 90 or older have their age collapsed into a single category (e.g., '90 or older') because extreme ages can uniquely identify an individual.
Question 3: Which of the following is NOT among the 18 identifiers that must be removed under HIPAA's Safe Harbor de-identification method?
- Telephone numbers
- Medical record numbers
- Diagnosis codes (ICD codes) (Correct answer)
- Device identifiers and serial numbers
Correct answer: Diagnosis codes (ICD codes)
ICD diagnosis codes are clinical codes that describe conditions, not personal identifiers; the 18 Safe Harbor identifiers target information that can be used to identify a specific individual.
Question 4: A researcher wants to use de-identified patient data for a clinical study. Which statement about HIPAA requirements is accurate?
- A patient's written authorization is still required for de-identified research data
- De-identified data may be used for research without HIPAA authorization requirements (Correct answer)
- De-identified data can only be used after the Privacy Officer approves each study
- An IRB waiver is required before accessing any de-identified health data
Correct answer: De-identified data may be used for research without HIPAA authorization requirements
Because de-identified data is no longer PHI, the HIPAA Privacy Rule's authorization requirements do not apply, and researchers may use or receive it without patient authorization.
Question 5: Which of the following identifiers is specifically included among the 18 Safe Harbor categories that must be removed?
- Vehicle identifiers and serial numbers (Correct answer)
- Job title and employer name
- Health plan premium amounts
- Patient satisfaction survey responses
Correct answer: Vehicle identifiers and serial numbers
Vehicle identifiers and serial numbers are explicitly listed among the 18 Safe Harbor identifiers, as they can be traced back to a registered owner.
Question 6: What distinguishes a limited data set from fully de-identified data under HIPAA?
- A limited data set retains more direct identifiers than de-identified data
- A limited data set may retain indirect identifiers such as dates and city-level geographic data (Correct answer)
- A limited data set requires stricter physical safeguards than fully identified PHI
- A limited data set can only be used for treatment, not research or operations
Correct answer: A limited data set may retain indirect identifiers such as dates and city-level geographic data
Unlike fully de-identified data, a limited data set may retain indirect identifiers like dates, ages, and geographic data at the city, state, or ZIP code level, while all direct identifiers must be removed.
Question 7: Under the Expert Determination method, what documentation must the expert maintain to support the de-identification determination?
- A signed authorization from every patient whose data is included
- Documentation of the methods and results supporting the very small risk determination (Correct answer)
- A Business Associate Agreement with the covered entity
- An audit log of all workforce members who accessed the dataset
Correct answer: Documentation of the methods and results supporting the very small risk determination
HIPAA requires that the expert document the methods applied and results obtained so the de-identification determination can be reviewed and substantiated if later questioned.
CHPC De-identification of Protected Health Information 2
Under HIPAA's Safe Harbor method, specific dates must be removed EXCEPT which component?