CHPC De-identification of Protected Health Information 2

Question 1

Under HIPAA's Safe Harbor method, specific dates must be removed EXCEPT which component?

Accepted Answer

The year alone (for individuals under 90)

Answer

Birth date

Answer

Admission and discharge dates

Answer

Date of death

Question 2

Under the Safe Harbor method, how must the age of an individual who is 90 years or older be reported in a de-identified dataset?

Accepted Answer

Their age must be grouped into an aggregate category such as '90 or older'

Answer

Their exact age must be removed entirely from the record

Answer

Their age must be replaced with the dataset's mean age

Answer

Their age must be encrypted rather than removed

Question 3

Which of the following is NOT among the 18 identifiers that must be removed under HIPAA's Safe Harbor de-identification method?

Accepted Answer

Diagnosis codes (ICD codes)

Answer

Telephone numbers

Answer

Medical record numbers

Answer

Device identifiers and serial numbers

Question 4

A researcher wants to use de-identified patient data for a clinical study. Which statement about HIPAA requirements is accurate?

Accepted Answer

De-identified data may be used for research without HIPAA authorization requirements

Answer

A patient's written authorization is still required for de-identified research data

Answer

De-identified data can only be used after the Privacy Officer approves each study

Answer

An IRB waiver is required before accessing any de-identified health data

Question 5

Which of the following identifiers is specifically included among the 18 Safe Harbor categories that must be removed?

Accepted Answer

Vehicle identifiers and serial numbers

Answer

Job title and employer name

Answer

Health plan premium amounts

Answer

Patient satisfaction survey responses

Question 6

What distinguishes a limited data set from fully de-identified data under HIPAA?

Accepted Answer

A limited data set may retain indirect identifiers such as dates and city-level geographic data

Answer

A limited data set retains more direct identifiers than de-identified data

Answer

A limited data set requires stricter physical safeguards than fully identified PHI

Answer

A limited data set can only be used for treatment, not research or operations

Question 7

Under the Expert Determination method, what documentation must the expert maintain to support the de-identification determination?

Accepted Answer

Documentation of the methods and results supporting the very small risk determination

Answer

A signed authorization from every patient whose data is included

Answer

A Business Associate Agreement with the covered entity

Answer

An audit log of all workforce members who accessed the dataset