CHPC De-identification of Protected Health Information 3

Question 1

Which of the following is an example of a biometric identifier that must be removed under the Safe Harbor method?

Accepted Answer

Fingerprints and voice prints

Answer

Weight measurements and BMI

Answer

Blood type and Rh factor

Answer

Prescription medication history

Question 2

A hospital wants to share patient data for public health research while retaining ZIP codes and admission dates. What type of dataset does this represent under HIPAA?

Accepted Answer

Limited data set requiring a Data Use Agreement

Answer

Fully de-identified dataset under Safe Harbor

Answer

PHI requiring individual patient authorization

Answer

Encrypted PHI governed by a Business Associate Agreement

Question 3

May a covered entity re-identify data that it previously de-identified under HIPAA?

Accepted Answer

Yes, if it retains a separate code or key that links back to the original PHI, kept securely and not disclosed

Answer

No, because re-identification permanently destroys the original PHI link

Answer

Yes, but only with written authorization from each patient whose data was de-identified

Answer

No, because any re-identification attempt constitutes a HIPAA violation

Question 4

Under the HIPAA Safe Harbor method, full 5-digit ZIP codes must generally be removed. Under what specific condition may the first three digits of a ZIP code be retained?

Accepted Answer

When the geographic unit formed by the first three digits contains more than 20,000 people

Answer

When the ZIP code belongs to a rural county with fewer than 1,000 residents

Answer

When the covered entity has obtained a waiver from HHS

Answer

When the data is being used solely for internal quality improvement

Question 5

Which entity is responsible for performing the Expert Determination analysis under HIPAA's de-identification standard?

Accepted Answer

A person with appropriate knowledge of generally accepted statistical and scientific principles

Answer

The U.S. Department of Health and Human Services (HHS)

Answer

The covered entity's Privacy Officer or Chief Compliance Officer

Answer

An Institutional Review Board (IRB) with expertise in health data privacy

Question 6

What is the primary privacy risk that HIPAA's de-identification standard is designed to mitigate?

Accepted Answer

Re-identification of individuals from health data disclosed or released externally

Answer

Unauthorized access to encrypted health information systems

Answer

Loss of data integrity during electronic transmission

Answer

Unauthorized modification of medical records by workforce members

Question 7

Which statement MOST accurately describes de-identified health information under HIPAA?

Accepted Answer

De-identified data is not subject to the HIPAA Privacy Rule and may be freely used and disclosed

Answer

De-identified data is subject to the Security Rule's technical safeguard requirements

Answer

De-identified data retains some Privacy Rule protections, such as the minimum necessary standard

Answer

De-identified data must be described in the organization's Notice of Privacy Practices