Duty LXD-1123
Processes de-identified data, in Maryland
Maryland Genetic Information Privacy Act and Online Data Privacy Act, deidentified datasince 4 lines
Md. Code Ann., Com. Law ยงยง 14-4401(c) and (g)(3) (Title 14, Subtitle 44) · Read the law's page
- To keep data outside the Genetic Information Privacy Act's definition of genetic data, make sure it cannot reasonably be used to infer information about a consumer or linked to an identifiable consumer (Com. Law 14-4401(c)(1) and (g)(3)).
- Subject the data to administrative and technical measures to ensure that it cannot be associated with a particular consumer (Com. Law 14-4401(c)(2)(i)).
- Publicly commit to maintain and use the data in a deidentifiable form and not to attempt to reidentify it (Com. Law 14-4401(c)(2)(ii)).
- Bind each recipient of the data by legally enforceable contractual obligations that prohibit the recipient from attempting to reidentify it (Com. Law 14-4401(c)(2)(iii)).
Maryland Medical Care Data Base data release: de-identified and limited data set files and safeguards against re-identificationin force3 lines
COMAR 10.25.05 · Read the law's page
- If you are the Maryland Health Care Commission and provide a de-identified standard analytic file under an approved application, provide a data extract that contains only data elements that are not considered PHI because the extract excludes direct and indirect individual identifiers as defined in the HIPAA Privacy Rule (COMAR 10.25.05.03C(1)).
- If you are the Maryland Health Care Commission and provide a limited data set under an approved application, provide a data extract that contains a limited set of indirect individual identifiers as defined in the HIPAA Privacy Rule and excludes direct individual identifiers (COMAR 10.25.05.03C(2)).
- If you are a governmental entity requesting data from the Maryland Medical Care Data Base, include in your written data request the safeguards against re-identification of an individual in a product that you will create or publish publicly (COMAR 10.25.05.05B(4)).
Health information exchanges: privacy and security of protected health information, de-identified data and re-identificationin force4 lines
COMAR 10.25.18 · Read the law's page
- If you operate a health information exchange, disclose de-identified data or a limited data set to a care management organization for population health management only when an internal review committee designated by the organization has entered into a data use agreement with you and attested that the request is for population health management and limited to the minimum necessary (COMAR 10.25.18.10B(1)).
- Disclose de-identified data to a qualified research organization only when a privacy board has confirmed that the requesting entity is a qualified research organization and that the requested data is for research, limited to the minimum necessary, serves a legitimate purpose consistent with the interest of the subject individuals, and meets the de-identification standard in 45 CFR 164.514(a) to (c) (COMAR 10.25.18.10C(1)).
- If you are a qualified research organization receiving data from a health information exchange for research, contractually agree not to link de-identified data received from the exchange with other data sources to re-identify it and not otherwise to attempt to re-identify it (COMAR 10.25.18.10C(7)(a)).
- Treat as de-identified data only health information that neither identifies nor provides a reasonable basis to identify an individual and that meets 45 CFR 164.514(a) and (b) (COMAR 10.25.18.02B(21)).