A covered entity uses a coded system where each patient's name is replaced with a random number, and the code mapping is stored in a separate secure file. How does HIPAA classify this data?
-
A
De-identified, because no names appear in the dataset
-
B
PHI, because a code that can be translated back to an identity means the data is not truly de-identified
-
C
A limited data set requiring only a data use agreement
-
D
Encrypted PHI that may be shared freely as long as the key is protected