patient de identification report age

The allowed fields are Patient’s Sex, Patient’s Age, Patient’s Size, Patient’s Weight, Ethnic Group, Smoking Status, and Pregnancy Status. If a subject is over 90 years of age, then the age must be listed as 90+.

Full Answer

Can the age be reported in a de-identified data set?

However, it could be reported in a de-identified data set as “2009”. Many records contain dates of service or other events that imply age. Ages that are explicitly stated, or implied, as over 89 years old must be recoded as 90 or above.

Can de-identified data be linked back to the identity of the patient?

Although the risk is very small, it is not zero, and there is a possibility that de-identified data could be linked back to the identity of the patient to which it corresponds.

What is the standard for de-identification of protected health information?

Section 164.514 (a) of the HIPAA Privacy Rule provides the standard for de-identification of protected health information. Under this standard, health information is not individually identifiable if it does not identify an individual and if the covered entity has no reasonable basis to believe it can be used to identify an individual.

Why do we replace personal identifiers in clinical data with non-identifying terms?

Replacing personal identifiers in the clinical data with non-identifying terms minimizes the chance of re-identification of the patient during the use of the data for scientific purposes;*hence, it is one of the most essential tools for protecting patient privacy.

Is age a patient identifier?

Identifiability under HIPAA The following are considered limited identifiers under HIPAA: geographic area smaller than a state, elements of dates (date of birth, date of death, dates of clinical service), and age over age 89. The remaining identifiers in the bullet list are considered to be direct identifiers.

Is age considered protected health information?

Examples of PHI include: Name. Address (including subdivisions smaller than state such as street address, city, county, or zip code) Any dates (except years) that are directly related to an individual, including birthday, date of admission or discharge, date of death, or the exact age of individuals older than 89.

How do you de identify a report?

As discussed below, the Privacy Rule provides two de-identification methods: 1) a formal determination by a qualified expert; or 2) the removal of specified individual identifiers as well as absence of actual knowledge by the covered entity that the remaining information could be used alone or in combination with other ...

What is considered de-identified data?

In education, de-identified data generally refers to data from which all personally identifiable information has been removed—i.e., data about individual students, teachers, or administrators that has been rendered anonymous by stripping out any information that would allow people to determine an individual's identity.

Is birthdate considered PHI?

Demographic information is also considered PHI under HIPAA Rules, as are many common identifiers such as patient names, Social Security numbers, Driver's license numbers, insurance details, and birth dates, when they are linked with health information.

Is DOB considered HIPAA?

A: No, this is not a HIPAA violation, since you are not disclosing the patient's actual birth date. The patient's full birth date is considered protected health information (PHI).

What is patient de-identification?

De-identification is the process used to prevent someone's personal identity from being revealed. For example, data produced during human subject research might be de-identified to preserve the privacy of research participants.

What is the de-identification process?

De-identification is a process of detecting identifiers (e.g., personal names and social security numbers) that directly or indirectly point to a person (or entity) and deleting those identifiers from the data.

What is de-identified medical records?

De-identified information is information from which the identifiers about the person have been permanently removed, or where the identifiers have never been included. This means that the information is not personal information for the purposes of the PPIP Act.

What is de-identification in healthcare?

What is De-Identified Data in Healthcare? The process of de-identification removes all direct identifiers from patient data and allows organizations to share it without the potential of violating HIPAA. Direct identifiers can include a patient's name, address, medical record information, etc.

What is the difference between anonymized and de-identified?

Anonymous – The dataset does not contain any identifiable information and there is no way to link the information back to identifiable information. De-identified – The dataset does not contain any identifiable information, but there is a way to link the information back to identifiable information.

Which of the following are examples of patient's information that is taken out during the de-identified process?

These include:Names.Geographic subdivisions smaller than a state (e.g. street address, city and ZIP code)All dates that are related to an individual (e.g., date of birth, admission)Telephone numbers.Fax numbers.Email addresses.Social Security numbers.Medical record numbers.More items...•

What are considered protected health information?

Protected health information (PHI), also referred to as personal health information, is the demographic information, medical histories, test and laboratory results, mental health conditions, insurance information and other data that a healthcare professional collects to identify an individual and determine appropriate ...

Is asking for Dob a HIPAA violation?

While it is legal for a pharmacy or doctor's office to ask for your date of birth, these entities must take steps to protect that information so as to not violate the Health Insurance Portability and Accountability Act (HIPAA).

Which of the following is protected health information?

Examples of PHI Addresses — In particular, anything more specific than state, including street address, city, county, precinct, and in most cases zip code, and their equivalent geocodes. Dates — Including birth, discharge, admittance, and death dates. Biometric identifiers — including finger and voice prints.

What is not considered PHI under HIPAA?

What is not considered as PHI? Please note that not all personally identifiable information is considered PHI. For example, employment records of a covered entity that are not linked to medical records. Similarly, health data that is not shared with a covered entity or is personally identifiable doesn't count as PHI.

What is HIPAA protected health information?

The HIPAA Privacy Rule protects most “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or medium, whether electronic, on paper, or oral. The Privacy Rule calls this information protected health information (PHI) 2. Protected health information is information, including demographic information, which relates to: 1 the individual’s past, present, or future physical or mental health or condition, 2 the provision of health care to the individual, or 3 the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe can be used to identify the individual. Protected health information includes many common identifiers (e.g., name, address, birth date, Social Security Number) when they can be associated with the health information listed above.

What is HIPAA Privacy Rule?

The HIPAA Privacy Rule protects most “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or medium, whether electronic, on paper, or oral. The Privacy Rule calls this information protected health information (PHI) 2.

What is the process of de-identification?

The process of de-identification, by which identifiers are removed from the health information, mitigates privacy risks to individuals and thereby supports the secondary use of data for comparative effectiveness studies, policy assessment, life sciences research, and other endeavors.

What is a business associate in HIPAA?

3 A business associate is a person or entity (other than a member of the covered entity’s workforce) that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of protected health information. A covered entity may use a business associate to de-identify PHI on its behalf only to the extent such activity is authorized by their business associate agreement.

When did the OCR final rule change to 000?

OCR published a final rule on August 14, 2002, that modified certain standards in the Privacy Rule. The preamble to this final rule identified the initial three digits of ZIP codes, or ZIP code tabulation areas (ZCTAs), that must change to 000 for release. 67 FR 53182, 53233-53234 (Aug. 14, 2002)).

Why is de-identification not protected?

De-identified health information created following these methods is no longer protected by the Privacy Rule because it does not fall within the definition of PHI. Of course, de-identification leads to information loss which may limit the usefulness of the resulting health information in certain circumstances.

Why is documentation important for PHI?

The importance of documentation for which values in health data correspond to PHI, as well as the systems that manage PHI, for the de-identification process cannot be overstated. Esoteric notation, such as acronyms whose meaning are known to only a select few employees of a covered entity, and incomplete description may lead those overseeing a de-identification procedure to unnecessarily redact information or to fail to redact when necessary. When sufficient documentation is provided, it is straightforward to redact the appropriate fields. See section 3.10 for a more complete discussion.

What are the first 3 digits of a ZIP code?

Covered entities may include the first three digits of the ZIP code if, according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all ZIP codes with the same three initial digits contains more than 20,000 people; or (2) the initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer people is changed to 000 . This means that the initial three digits of ZIP codes may be included in de-identified information except when the ZIP codes contain the initial three digits listed in the Table below. In those cases, the first three digits must be listed as 000.

What is risk mitigation method?

These methods remove or eliminate certain features about the data prior to dissemination. Suppression of an entire feature may be performed if a substantial quantity of records is considered as too risky (e.g., removal of the ZIP Code feature). Suppression may also be performed on individual records, deleting records entirely if they are deemed too risky to share. This can occur when a record is clearly very distinguishing (e.g., the only individual within a county that makes over $500,000 per year). Alternatively, suppression of specific values within a record may be performed, such as when a particular value is deemed too risky (e.g., ―President of the local university‖, or ages or ZIP codes that may be unique). Table 3 illustrates this last type of suppression by showing how specific values of features in Table 2 might be suppressed (i.e., black shaded cells).

What is implementation specification?

The implementation specifications further provide direction with respect to re-identification, specifically the assignment of a unique code to the set of de-identified health information to permit re-identification by the covered entity.

What is the HIPAA Privacy Rule?

Under this standard, health information is not individually identifiable if it does not identify an individual and if the covered entity has no reasonable basis to believe it can be used to identify an individual.

What is a business associate in HIPAA?

HIPAA defines a covered entity as 1) a health care provider that conducts certain standard administrative and financial transactions in electronic form; 2) a health care clearinghouse; or 3) a health plan.3 A business associate is a person or entity (other than a member of the covered entity‘s workforce) that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of protected health information. A covered entity may use a business associate to de-identify PHI on its behalf only to the extent such activity is authorized by their business associate agreement.

How to determine if a patient's demographics are replicable?

First, the expert will determine if the demographics are independently replicable.Features such as birth date and gender are strongly independently replicable—the individual will always have the same birth date -- whereas ZIP code of residence is less so because an individual may relocate. Second, the expert will determine which data sources that contain the individual‘s identification also contain the demographics in question. In this case, the expert may determine that public records, such as birth, death, and marriage registries, are the most likely data sources to be leveraged for identification. Third, the expert will determine if the specific information to be disclosed is distinguishable. At this point, the expert may determine that certain combinations of values (e.g., Asian males born in January of 1915 and living in a particular 5-digit ZIP code) are unique, whereas others (e.g., white females born in March of 1972 and living in a different 5-digit ZIP code) are never unique. Finally, the expert will determine if the data sources that could be used in the identification process are readily accessible, which may differ by region. For instance, voter registration registries are free in the state of North Carolina, but cost over $15,000 in the state of Wisconsin. Thus, data shared in the former state may be deemed more risky than data shared in the latter.12

What is HIPAA protected health information?

The HIPAA Privacy Rule protects most ―individually identifiable health information‖ held or transmitted by a covered entity or its business associate, in any form or medium, whether electronic, on paper, or oral. The Privacy Rule calls this information protected health information (PHI).2 Protected health information is information, including demographic information, which relates to:

What is expert determination?

The expert determination method carries a small risk that an individual could be identified, although the risk is so low that it meets HIPAA Privacy Rule requirements. This method of de-identification of protected health information requires a HIPAA covered entity or business associate to obtain an opinion from a qualified statistical expert ...

How many people can use the first 3 digits in zip code?

In the case of zip codes, covered entities are permitted to use the first three digits provided the geographic unit formed by combining those first three digits contains more than 20,000 individuals. When that geographical unit contains fewer than 20,000 individuals it should be changed to 000.

What does "very small" mean in a research?

The expert should define ‘very small’ in relation to the context of the data set, the specific environment, and the ability of an anticipated recipient to be able to reidentify individuals. Experts may come from a number of different fields and do not require any specific qualifications.

What are the elements of dates that are indicative of age?

All elements of dates (except year) related to an individual (including admission and discharge dates, birthdate, date of death, all ages over 89 years old, and elements of dates (including year) that are indicative of age) Telephone, cellphone, and fax numbers. Email addresses. IP addresses. Social Security numbers. Medical record numbers.

What is an expert in statistics?

The expert must be a person with appropriate knowledge and experience of using generally accepted statistical and scientific principles and methods for removing or altering information to ensure that it is no longer individually identifiable.

Is PHI protected by HIPAA?

Use either of the two methods below and PHI will no longer be considered ‘protected health information’ and will therefore not be subject to HIPAA Privacy ...

Can you de-identify PHI?

HIPAA Privacy Rule restrictions only covers individually identifiable protected health information. If you de-ident ify PHI so that the identity of individuals cannot be determined, and re-identification of individuals is not possible, PHI can be freely shared. The de-identification of protected health information enables HIPAA covered entities ...

What are indirect identifiers?

Indirect identifiers are data elements that may make it possible to identify an individual deductively. Examples of indirect identifiers include:

What are the risks of de-identified data?

These risks include allowing inferences about individuals in the data without re-identification, and impacts on groups represented in the data. The HIPAA Privacy Rule states that once data has been de-identified, covered entities can use or disclose it without any limitation.

What happens when de-identified data is re-identified?

When de-identified data can be re-identified the privacy protection provided by de-identification is lost. The decision of how or if to de-identify data should thus be made in conjunction with decisions of how the de-identified data will be used, shared or released, since the risk of re-identification can be difficult to estimate.

What is data de-identification?

De-identification is a tool that organizations can use to remove personal information from data that they collect, use, archive, and share with other organizations.

What is a characteristic barcode?

See the discussion of re-identification. Identifying Characteristic: A characteristic may be anything that distinguishes an individual and allows for identification.

Is UMMS a covered entity?

It is important to note that UMMS is NOT a covered entity and can therefore not disclose de-identified data. Some common direct identifiers of the individual or of relatives, employers, or household members of the individual that a data set cannot include if wanting to be categorized as de-identified are: