Distinguish HIPAA Safe Harbor de-identification from Expert Determination.
The move: do not confuse masked data with de-identified data. Removing names is only one part of de-identification. HIPAA recognizes two paths. Safe Harbor removes specific identifiers and requires no actual knowledge that the remaining data can identify a person. Expert Determination relies on a qualified expert to assess that re-identification risk is very small using accepted methods. This matters because useful analytics fields often carry identity risk. Exact dates, small geography, rare diagnoses, unusual ages, and small cell counts can point back to a person. A dashboard for internal quality improvement may still contain PHI even if the chart…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in