HIPAA De-identification and Data Anonymization

Question 1

Under HIPAA, what is the primary significance of de-identifying health information?

Accepted Answer

De-identified information is no longer PHI and is not subject to HIPAA's privacy protections

Answer

De-identified information can be sold to any party for any purpose without restriction

Answer

De-identified information requires less encryption but still needs a BAA for sharing

Answer

De-identification protects organizations from all HIPAA penalties

Question 2

HIPAA's Safe Harbor de-identification method requires removal of how many specific identifiers?

Accepted Answer

18 identifiers

Answer

12 identifiers

Answer

15 identifiers

Answer

24 identifiers

Question 3

Under HIPAA's Expert Determination method of de-identification, who must make the determination?

Accepted Answer

A person with appropriate knowledge and experience applying statistical and scientific principles to health data

Answer

A licensed physician

Answer

The covered entity's Privacy Officer

Answer

A government-certified HIPAA auditor

Question 4

Which of the following items must be removed under HIPAA's Safe Harbor de-identification method?

Accepted Answer

ZIP codes with populations less than 20,000

Answer

The patient's general diagnosis code (ICD-10)

Answer

The state where the patient received treatment

Answer

The year of the patient's birth

Question 5

Under HIPAA Safe Harbor de-identification, how must ages over 89 be handled?

Accepted Answer

They may be aggregated into a single category of '90 or older'

Answer

They must be replaced with the number 89

Answer

All patient ages must be removed, not just ages over 89

Answer

Ages over 89 may be retained if the patient has consented

Question 6

What does the term 're-identification' mean in the context of HIPAA de-identification?

Accepted Answer

The process of linking de-identified information back to the specific individual it pertains to

Answer

Creating a new patient record for a de-identified dataset

Answer

Updating patient records with new information

Answer

Converting paper records to electronic format

Question 7

Under HIPAA, can a covered entity re-identify de-identified information that it originally de-identified?

Accepted Answer

Yes, covered entities may re-identify data they originally de-identified if they have a code key, subject to privacy rule restrictions

Answer

No, once information is de-identified it can never be re-identified under HIPAA

Answer

Only patients may request re-identification of their de-identified records

Answer

Re-identification is only permitted by research institutions with IRB approval

Question 8

A research team wants to use patient data that retains some identifiers but has most removed. Under HIPAA, what is this arrangement called?

Accepted Answer

A limited data set

Answer

A partial de-identification waiver

Answer

A qualified research dataset

Answer

A clinical data waiver

Question 9

Under HIPAA, what document must be executed before a covered entity can share a Limited Data Set?

Accepted Answer

A Data Use Agreement (DUA)

Answer

A Business Associate Agreement (BAA)

Answer

A Research Authorization Form

Answer

A HIPAA Waiver of Authorization

Question 10

Which of the following is NOT one of the 18 Safe Harbor identifiers that must be removed under HIPAA de-identification?

Accepted Answer

ICD-10 diagnosis codes

Answer

Email addresses

Answer

Biometric identifiers including fingerprints

Answer

Device identifiers and serial numbers