De-identification and Data Anonymization Flashcards
7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 De-identification and Data Anonymization flashcards as text
Under HIPAA's Expert Determination method, what standard must a statistician meet to certify de-identification?
Answer: The risk of identifying an individual is very small and the methods used are documented
Under Expert Determination, a qualified statistician must certify that the risk of identification is 'very small' and document the methods and results of analysis.
Which of the following geographic data elements is permitted to remain in a Safe Harbor de-identified dataset?
Answer: Three-digit ZIP code prefixes for all regions
Three-digit ZIP code prefixes may be retained under Safe Harbor unless the geographic area they cover contains 20,000 or fewer people, in which case '000' must replace the three-digit code.
A hospital wants to share patient data with a research partner. After removing all 18 Safe Harbor identifiers, they discover the dataset still contains information that could re-identify patients. What should the covered entity do?
Answer: Apply additional de-identification measures or use Expert Determination to certify safety
If a covered entity has 'actual knowledge' that remaining information could re-identify individuals, the data is not considered de-identified and further steps must be taken.
Which of the following is NOT one of the 18 categories of identifiers that must be removed under HIPAA's Safe Harbor method?
Answer: ICD diagnosis codes
ICD diagnosis codes (clinical codes describing a patient's condition) are not among the 18 Safe Harbor identifiers and may remain in de-identified data.
What is a 'limited data set' under HIPAA, and how does it differ from fully de-identified data?
Answer: A limited data set removes only direct identifiers but may retain dates and geographic data, requiring a data use agreement
A limited data set removes direct identifiers (names, addresses, phone numbers, etc.) but may retain dates and geographic subdivisions smaller than a state, and sharing requires a data use agreement.
Under the Safe Harbor method, what must a covered entity do with dates of birth for patients aged 90 or older?
Answer: Aggregate all ages 90 and above into a single category such as '90 or older'
Safe Harbor requires that ages and dates for individuals over 89 must be aggregated into a category of age 90 or older to prevent identification of very elderly individuals.
Which scenario describes re-identification risk in a de-identified dataset?
Answer: A dataset with rare disease diagnoses in a small geographic area could allow linking back to specific patients
When rare diagnoses are combined with small geographic areas, the combination can be unique enough to identify specific individuals even without explicit identifiers.