Processes de-identified data, in the United States

HIPAA Privacy Rule, 45 CFR 164.514(a)-(c) · Read the law's page

• Treat health information as not individually identifiable by expert determination only if a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods determines that the risk is very small that an anticipated recipient could use the information, alone or in combination with other reasonably available information, to identify an individual, and documents the methods and results of the analysis that justify the determination (45 CFR 164.514(b)(1)).
• Treat health information as not individually identifiable by the safe harbor only if you remove the identifiers 45 CFR 164.514(b)(2)(i) lists for the individual and for relatives, employers and household members, and you have no actual knowledge that the information could be used alone or in combination with other information to identify an individual (45 CFR 164.514(b)(2)).
• If you assign a code or other means of record identification so that you can re-identify de-identified information, derive it from no information about the individual, make sure it cannot otherwise be translated to identify the individual, use or disclose it for no other purpose, and never disclose the mechanism for re-identification (45 CFR 164.514(c)).