De-Identification under HIPAA: 5 Frequently Asked Questions about De-identified Healthcare Data

The Health Insurance Portability and Accountability Act (HIPAA) safeguards patient data. Hospitals, clinics, insurance providers, and other healthcare facilities must adhere to these stringent rules.
What is De-identified Data under HIPAA?
De-identified data HIPAA refers explicitly to health information that has been processed. This processing removes or obscures direct identifiers.
What are the two HIPAA-approved methods for De-identification?
Safe Harbor Method
The Safe Harbor De-identification Method offers a straightforward and prescriptive checklist approach. Organizations must remove 18 specific types of identifiers from the health information. If done correctly, this removal ensures compliance with the Safe Harbor provisions.
Expert Determination Method
HIPAA Expert Determination relies on the judgment and expertise of qualified individuals. These experts possess specialized knowledge and experience in statistical and scientific principles related to de-identification. They are trained to assess and mitigate re-identification risks.
Is De-identified Health Information Still Subject to the HIPAA Privacy Rule?
De-identified health information is subject to the Privacy Rule, but only in a minimal and specific capacity. Once data has undergone proper and complete de-identification, according to either the Safe Harbor or Expert Determination method, many of the Privacy Rule’s requirements cease to apply.
What is the Difference Between De-Identification and Anonymization?
Anonymization is considered a permanent and irreversible process. Once data is genuinely anonymized, it is impossible to reverse the process. There is no way to re-identify the individuals to whom the data originally pertained. This provides the highest level of privacy protection.
De-identification, on the other hand, might be reversible under specific, controlled circumstances. A code, key, or other mechanism might exist. This code could allow the data to be re-identified by the covered entity