CHPC De-identification of Protected Health Information 3

Question 1

Which of the following is an example of a biometric identifier that must be removed under the Safe Harbor method?

Accepted Answer

Fingerprints and voice prints

Answer

Biometric identifiers, including finger and voice prints, are explicitly listed among the 18 Safe Harbor identifiers because they can uniquely identify a specific individual.

Question 2

A hospital wants to share patient data for public health research while retaining ZIP codes and admission dates. What type of dataset does this represent under HIPAA?

Accepted Answer

Limited data set requiring a Data Use Agreement

Answer

Because ZIP codes and admission dates are retained—permissible in limited data sets but not in Safe Harbor de-identified data—this qualifies as a limited data set requiring a Data Use Agreement.

Question 3

May a covered entity re-identify data that it previously de-identified under HIPAA?

Accepted Answer

Yes, if it retains a separate code or key that links back to the original PHI, kept securely and not disclosed

Answer

HIPAA permits covered entities to retain a re-identification code, provided the code cannot be derived from the PHI itself and the key is kept secure and not disclosed.

Question 4

Under the HIPAA Safe Harbor method, full 5-digit ZIP codes must generally be removed. Under what specific condition may the first three digits of a ZIP code be retained?

Accepted Answer

When the geographic unit formed by the first three digits contains more than 20,000 people

Answer

Safe Harbor permits retaining the first three digits of a ZIP code only if the corresponding geographic unit contains more than 20,000 people; otherwise, the digits must be replaced with '000'.

Question 5

Which entity is responsible for performing the Expert Determination analysis under HIPAA's de-identification standard?

Accepted Answer

A person with appropriate knowledge of generally accepted statistical and scientific principles

Answer

The Expert Determination method requires a qualified statistician or scientist to apply generally accepted principles—HHS and the IRB are not designated to perform this determination.

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC De-identification of Protected Health Information 3