HIPAA De-identification and Data Anonymization 4

Question 1

A covered entity removes all 18 Safe Harbor identifiers but retains free-text clinical notes. Is the resulting data de-identified under HIPAA?

Accepted Answer

No, because free-text notes may contain incidental identifiers and the entity must verify no such information remains

Answer

Safe Harbor also requires that the covered entity have no actual knowledge that the remaining information could identify an individual, which unredacted free-text notes often violate.

Question 2

What is 'differential privacy' and how does it relate to HIPAA de-identification?

Accepted Answer

A mathematical technique that adds calibrated noise to query results to protect individual privacy while enabling statistical analysis

Answer

Differential privacy adds mathematically calibrated noise to data outputs so that the presence or absence of any single individual cannot be detected, providing strong privacy guarantees beyond traditional de-identification.

Question 3

Under HIPAA, which of the following correctly describes when de-identified data is no longer subject to the Privacy Rule?

Accepted Answer

When either Safe Harbor or Expert Determination de-identification is properly applied and no actual knowledge of re-identification exists

Answer

HIPAA's Privacy Rule ceases to apply once information is de-identified using Safe Harbor or Expert Determination and the covered entity has no actual knowledge that the information could re-identify individuals.

Question 4

A hospital's de-identification policy strips birth years from all records. Under Safe Harbor, is this required for patients under age 90?

Accepted Answer

No, only the full date of birth must be removed; the year of birth may be retained for patients under 90

Answer

Safe Harbor requires removal of the full date of birth (month, day, and year) but permits retention of the year of birth for patients aged 89 or younger.

Question 5

Which characteristic makes a data element a 'quasi-identifier' in health data de-identification?

Accepted Answer

It is an attribute that, alone or combined with others, can narrow down records to a specific individual

Answer

Quasi-identifiers are attributes such as age, gender, and ZIP code that are not direct identifiers but can be combined with external data to re-identify individuals.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA De-identification and Data Anonymization 4