<aside> 🖱️ De-identification involves the removal of personally identifying information in order to protect personal privacy.In te rms of health information, data is considered de-identified under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule when a number of specified data elements are removed.

</aside>

What is De-Identified Data?

• Data is de-identified when
  • All 18 HIPAA-specific direct and indirect identifiers have been removed (Safe Harbor method)
  • Data is determined by expert opinion to have a low probability of re-identification.

Example:

Interviewer:  When was the first time you heard about the [Organization]?

Interviewee:   Ten years ago. I was a student at [University] and one of my professors told us about [Organization] and their work.

To view a complete example click on the link below.

De-identification-Sample.doc29.0KB

What is PHI?

• Individually identifiable health information, including demographic information, that is created or received by a covered entity and that relates to the past, present, or future physical or mental health of an individual, provision of healthcare to an individual, or past, present, or future payment for the provision of healthcare to an individual.
• The presence of at least one of 18 HIPAA-designated direct and indirect identifiers in a data set makes the whole data set Protected Health Information.

1. Name

2. Social Security numbers

3. Telephone numbers

4. Addresses and all geographic information smaller than a state

5. All elements of dates (except year), including date of: birth, admission, discharge, and death; and all ages over 89

6. Fax numbers

7. E-mail addresses

8. Medical record numbers