How to Anonymize PHI
Healthcare groups and their business associates that want to collaborate on protected health information must do so in line with the HIPAA Privacy Rule, which restrict the possible uses and disclosures of PHI, but de-identification of protected health information means HIPAA Privacy Rule restrictions are no longer relevant.
HIPAA Privacy Rule restrictions only is relevant for individually identifiable protected health information. If you de-identify PHI so that the identity of peoples cannot be determined, and re-identification of individuals is not possible, PHI can be freely sent between stakeholders.
The de-identification of protected health information enables HIPAA covered groups to share health data for large-scale medical research studies, policy assessments, comparative effectiveness reports, and other studies and assessments without breaching the privacy of patients or requiring authorizations to be obtained from each patient prior to data being disclosed.
De-identification of Protected Health Information for HIPAA
HIPAA-compliant de-identification of protected health information can be achieved using two methods: Safe Harbor and Expert Determination. Neither method of de-identification of protected health information will eradicate all risk of re-identification of patients, but both methods will lessen risk to a very low and acceptable level. Use either of the two methods here and PHI will no longer be thought of as ‘protected health information’ and will therefore not be subject to HIPAA Privacy Rule restrictions.
1. Safe Harbor – Deleting Specific Identifiers
The initial HIPAA compliant way to de-identify protected health information is to delete specific identifiers from the data set. The identifiable data that must be deleted are:
- Names & identities
- Geographic subdivisions that are lower that state level
- All dates indicators (except year) related to an individual (including admission and discharge dates, birthdate, date of death, all ages over 89 years old, and elements of dates (including year) that are indicative of age)
- Telephone, cellphone, and fax details
- Emails
- Internet Protocol addresses
- Social Security information
- Medical record details
- Health plan beneficiary data
- Device identifiers and serial numbers
- Certificate/license particulars
- Account details
- Car identifiers and serial numbers including license plates
- Website addresses
- Complete face photos and comparable images
- Biometric identifiers such as finger and voice prints
- Any specific identifying numbers, characteristics or codes
In the case of zip codes, covered groups are allowed to use the first three digits provided the geographic unit formed by joining those first three digits contains more than 20,000 people. When that geographical unit contains less than 20,000 individuals it should be altered to 000. According to the Bureau of the Census, that means 17 zip codes must have the first three digits changed to zero:
036, 692, 878, 059, 790, 879, 063, 821, 884, 102, 823, 890, 203, 830, 893, 556, 831
Covered groups must not that the above list of zip codes may change after future censuses. The list is formulated using 5-digit zip codes from the 2000 census.
For further details on de-identification of protected health information using the safe harbor method see 45 CFR § 164.514(b)(2).
2. Expert Determination Method
The expert determination method carries a small chance that an individual could be identified, although the chance is so low that it meets HIPAA Privacy Rule requirements.
This method of de-identification of protected health information requires a HIPAA covered body or business associate to obtain a consultation from a qualified statistical expert that the risk of re-identifying an individual from the data set is minimal. In such cases, the methods used to make that determination and justification of the expert’s opinion must be recorded and retained by the covered group or business associate and made available to regulators in the event of an audit or investigation.
The specialist must be a person with appropriate knowledge and experience of using generally accepted statistical and scientific principles and methods for deleting or altering information to ensure that it is no longer individually identifiable.
When those methods and principles are used, the specialist must determine that the risk of re-identification of an individual is very small. In such cases, the risk of re-identification must be very small when the information is used on its own, and must remain very small should the data be joined with other reasonably available information by an anticipated recipient to identify a person who is a subject of the information.
HIPAA does not classify the level of risk of re-identification specifically other than to say it should be ‘very small’. The expert should justify ‘very small’ in relation to the context of the data set, the specific environment, and the ability of an anticipated recipient to be able to re-identify people.
Specialists may come from a number of different fields and do not require any specific qualifications. What is crucial is that experts have experience of de-identifying data. It is that experience that regulators will review in the event of an audit, not specific qualifications or certifications.