HHS issues guidance on de-identification of patient data
The Department of Health and Human Service’s (HHS) Office for Civil Rights (OCR) has issued guidance regarding two methods for de-identification of protected health information to assist covered entities understand what de-identification is and how de-identified information is created.
An abundance of valuable health data is being collected as healthcare technologies proliferate, but accessing those data can be tricky because society, for good reason, places a premium on protecting an individual patient’s privacy. To facilitate the use of health data for comparative-effectiveness research, policy assessment, life sciences studies and other endeavors, the OCR has determined that there are two methods, called expert determination and safe harbor, appropriate for de-identifying data to maintain patients’ privacy.
“The privacy rule provides two de-identification methods: a formal determination by a qualified expert; or the removal of specified individual identifiers as well as absence of actual knowledge by the covered entity that the remaining information could be used alone or in combination with other information to identify the individual,” read OCR’s guidance.
Under the expert determination method, a qualified healthcare professional or researcher can apply statistical and scientific principles for rendering information so that it is not individually identifiable. Under the safe harbor method, 18 specific data elements, including zip codes, dates of birth and telephone numbers, are removed from records to render them unidentifiable.
A covered entity using either method would satisfy requirements of the HIPAA privacy rule, although risks to patient privacy would remain, according to the guidance. “Both methods, even when properly applied yield de-identified data that retains some risk of identification. Although the risk is not small, it is not zero, and there is a possibility that de-identified data could be linked back to the identity of the patient to which it corresponds.”
View the OCR guidance and other information on de-identification at HHS.gov.