HIPAA De-identification and Data Anonymization 3 — Questions and Answers
Question 1: A researcher publishes a study using de-identified HIPAA data. Later, a third party uses publicly available voter registration records to re-identify individuals in the dataset. Who bears HIPAA liability?
- The researcher bears liability because they published the data
- The covered entity that originally de-identified the data bears liability if de-identification was improper (Correct answer)
- The third party who performed re-identification bears all liability under HIPAA
- No one bears liability since the data was de-identified before publication
Correct answer: The covered entity that originally de-identified the data bears liability if de-identification was improper
If the covered entity's de-identification did not meet HIPAA standards (e.g., Expert Determination or Safe Harbor), they may bear liability; proper de-identification shifts risk but not automatically.
Question 2: What does 'pseudonymization' mean in the context of HIPAA compliance?
- Complete removal of all 18 Safe Harbor identifiers from a dataset
- Replacing direct identifiers with artificial codes while retaining the ability to re-identify through a separate key (Correct answer)
- Encrypting PHI so it cannot be accessed without a decryption key
- Creating synthetic data that statistically mirrors the original dataset
Correct answer: Replacing direct identifiers with artificial codes while retaining the ability to re-identify through a separate key
Pseudonymization replaces identifiers with codes, but because re-identification is possible with the code key, pseudonymized data is still considered PHI under HIPAA.
Question 3: Which entity is authorized to receive data under a HIPAA data use agreement for a limited data set?
- Any member of the general public who signs a nondisclosure agreement
- Only HIPAA covered entities and their business associates
- Researchers, public health authorities, or health care operations entities who agree to specific use restrictions (Correct answer)
- Federal government agencies only, since limited data sets contain residual PHI
Correct answer: Researchers, public health authorities, or health care operations entities who agree to specific use restrictions
Limited data sets may be disclosed for research, public health, or health care operations purposes to recipients who sign a data use agreement specifying permitted uses and safeguards.
Question 4: Under the Safe Harbor method, which type of account number must be removed to achieve de-identification?
- Hospital billing department internal codes
- ICD procedure codes
- Health plan beneficiary numbers and account numbers (Correct answer)
- CPT codes used for reimbursement
Correct answer: Health plan beneficiary numbers and account numbers
Health plan beneficiary numbers and account numbers are among the 18 Safe Harbor identifiers that must be removed because they can directly link records to specific individuals.
Question 5: A data analytics firm receives de-identified patient data and later acquires a consumer database that allows them to re-identify the patients. What is this called?
- A HIPAA waiver situation requiring OCR review
- A data linkage attack or re-identification attack (Correct answer)
- Permissible data enrichment under HIPAA's research exception
- A statistical sampling error in the de-identification process
Correct answer: A data linkage attack or re-identification attack
Combining de-identified health data with external datasets to re-identify individuals is called a re-identification or data linkage attack, and is a primary concern in modern de-identification.
Question 6: When applying Safe Harbor de-identification, what must happen to telephone and fax numbers?
- They must be replaced with the covered entity's main switchboard number
- They must be removed entirely (Correct answer)
- They may remain if the area code is removed
- They must be encrypted but can remain in the dataset
Correct answer: They must be removed entirely
All telephone numbers and fax numbers are among the 18 Safe Harbor identifiers and must be completely removed from de-identified datasets.
Question 7: Which approach best describes k-anonymity as used in health data de-identification?
- Removing k randomly selected identifiers from each record in the dataset
- Ensuring each record in a dataset is indistinguishable from at least k-1 other records based on quasi-identifiers (Correct answer)
- Encrypting data using a key length of at least k bits
- Adding k units of random statistical noise to each numeric value in the dataset
Correct answer: Ensuring each record in a dataset is indistinguishable from at least k-1 other records based on quasi-identifiers
K-anonymity ensures that any individual's record matches at least k-1 other records on quasi-identifiers (like age and ZIP code), making it harder to single out a specific person.
HIPAA De-identification and Data Anonymization 3
A researcher publishes a study using de-identified HIPAA data.
Later, a third party uses publicly available voter registration records to re-identify individuals in the dataset.
Who bears HIPAA liability?