HIPAA De-identification and Data Anonymization 2

Question 1

Under HIPAA's Expert Determination method, what standard must a statistician meet to certify de-identification?

Accepted Answer

The risk of identifying an individual is very small and the methods used are documented

Answer

Under Expert Determination, a qualified statistician must certify that the risk of identification is 'very small' and document the methods and results of analysis.

Question 2

Which of the following geographic data elements is permitted to remain in a Safe Harbor de-identified dataset?

Accepted Answer

Three-digit ZIP code prefixes for all regions

Answer

Three-digit ZIP code prefixes may be retained under Safe Harbor unless the geographic area they cover contains 20,000 or fewer people, in which case '000' must replace the three-digit code.

Question 3

A hospital wants to share patient data with a research partner. After removing all 18 Safe Harbor identifiers, they discover the dataset still contains information that could re-identify patients. What should the covered entity do?

Accepted Answer

Apply additional de-identification measures or use Expert Determination to certify safety

Answer

If a covered entity has 'actual knowledge' that remaining information could re-identify individuals, the data is not considered de-identified and further steps must be taken.

Question 4

Which of the following is NOT one of the 18 categories of identifiers that must be removed under HIPAA's Safe Harbor method?

Accepted Answer

ICD diagnosis codes

Answer

ICD diagnosis codes (clinical codes describing a patient's condition) are not among the 18 Safe Harbor identifiers and may remain in de-identified data.

Question 5

What is a 'limited data set' under HIPAA, and how does it differ from fully de-identified data?

Accepted Answer

A limited data set removes only direct identifiers but may retain dates and geographic data, requiring a data use agreement

Answer

A limited data set removes direct identifiers (names, addresses, phone numbers, etc.) but may retain dates and geographic subdivisions smaller than a state, and sharing requires a data use agreement.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA De-identification and Data Anonymization 2