CHPC De-identification of Protected Health Information

Question 1

Under HIPAA, which two methods are officially recognized for de-identifying protected health information?

Accepted Answer

Safe Harbor and Expert Determination

Answer

HIPAA's Privacy Rule recognizes two de-identification methods: Safe Harbor (removing 18 specified identifiers) and Expert Determination (a qualified statistician certifies re-identification risk is very small).

Question 2

Under the HIPAA Safe Harbor method, how many specific categories of identifiers must be removed to achieve de-identification?

Accepted Answer

18

Answer

The Safe Harbor method requires removal of exactly 18 categories of identifiers, including names, geographic data smaller than a state, dates, phone numbers, Social Security numbers, and biometric identifiers.

Question 3

Under the HIPAA Safe Harbor method, which geographic data element may be retained in de-identified data?

Accepted Answer

The state

Answer

Safe Harbor requires removal of all geographic subdivisions smaller than a state, but the state itself may be retained in de-identified information.

Question 4

What is a 'limited data set' under HIPAA's Privacy Rule?

Accepted Answer

PHI with direct identifiers removed but some indirect identifiers such as dates retained

Answer

A limited data set has direct identifiers (names, addresses, phone numbers, SSNs) removed, but may retain indirect identifiers such as dates, ages, and geographic information at the city, state, or ZIP code level.

Question 5

When a covered entity shares a limited data set, what agreement must be executed with the recipient?

Accepted Answer

Data Use Agreement

Answer

HIPAA requires a Data Use Agreement (DUA) between the covered entity and any recipient of a limited data set, specifying permitted uses and prohibiting re-identification attempts.

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC De-identification of Protected Health Information