HIPAA

 View Only

Please share your opinion. When are dates PHI without other identifiers?

  • 1.  Please share your opinion. When are dates PHI without other identifiers?

    Posted 08-14-2022 12:01 AM
    Hello Community Members, I'd like to ask the group for an opinion.

    Our task is to deidentify a data set which contains a variety of dates.  In addition to the date of birth, date of death, admission and discharge dates, there are also dates of appointments and other communications (phone, text, email etc.), lab tests, assessment dates etc.

    The deidentification process will replace all non-date PHI identifiers with fake data.  Dates of birth will be replaced with the year.  The population is located in a large city of 1.4 million people.

    In your opinion, without the other identifiers present, are the admission and discharge dates, dates of death as well as all other dates related to the individual still PHI and need to be deidentified?  It seems there are contradicting sources of information for what should and shouldn't be viewed as PHI in the absence of a statistical risk assessment.



    ------------------------------
    Anna Balayn
    ------------------------------
    Default Blank


  • 2.  RE: Please share your opinion. When are dates PHI without other identifiers?

    Posted 08-14-2022 08:35 AM
    I would be curious to hear what you get in response because there is no specific criteria on who qualifies as an "expert" and even if there was...we all have seen the variety of opinions that experts can have.  My suggestion...whoever is doing your "expert" de-identification process...since you mentioned you are still keeping dates in the dataset...make sure that this person can clearly share with you in terms that you can understand why their method supports the idea that the risk of the of identification of an individual is very small.

    That's what you are being held to...so that's where I would focus.

    ------------------------------
    -------------Frank "Snake Bite Leader" Ruelas--------------
    Study Group Sign up Form
    https://forms.gle/WqzNp5WfaNGeyACh7
    ► We don't fail unless we quit! ◄
    ------------------------------

    Default Blank


  • 3.  RE: Please share your opinion. When are dates PHI without other identifiers?

    Posted 08-14-2022 12:02 PM

    Anna, I'm not sure which sources you checked, but I always try to find answers within HHS/Office for Civil Rights.  Regarding dates being PHI, check out this link:

    https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html#protected 

     

    If you're using the Safe Harbor method to de-identify, the section I copied/pasted below states which dates need to be removed. However, I suggest reviewing the entire section...as Frank said, if you're relying on the Expert Determination method you should know the process so you can ask questions and understand your 'Expert's" decisions.

     

    Safe Harbor method includes....

    (2)(i) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed:

    (C) All elements of dates (except year) for dates that are directly related to an individual, including birth date, admission date, discharge date, death date, and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older

     

    Cinda

    ******************************************* This message and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.



    Default Blank


  • 4.  RE: Please share your opinion. When are dates PHI without other identifiers?

    Posted 08-15-2022 07:24 AM
    Thank you Frank and Cinda,

    Our timing is such that we will likely utilize both methods starting with the Safe Harbour (and working around the limitations for a while) and later moving to the expert determination.

    From both of your responses, I gather that the admission and discharge dates are phi regardless of the other information present and therefore need to be removed (in our case replaced with fake data).  What are your thoughts regarding interpretation of the rule as it relates to all the other dates not explicitly mentioned? In our case, none of them are publicly available, they are documented in the  system during the course of providing services.

    ------------------------------
    Anna Balayn
    ------------------------------

    Default Blank


  • 5.  RE: Please share your opinion. When are dates PHI without other identifiers?

    Posted 08-15-2022 10:26 AM

     

    It states, "all elements of dates (except year) for dates that are directly related to an individual."  It goes on to state "including..." and lists some examples, but in my opinion that list is not all inclusive.

    Cinda

    ******************************************* This message and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.



    Default Blank


  • 6.  RE: Please share your opinion. When are dates PHI without other identifiers?

    Posted 08-15-2022 10:09 PM
    Thank you Cinda for taking time to respond and for adding this clarification

    ------------------------------
    Anna Balayn
    ------------------------------

    Default Blank


  • 7.  RE: Please share your opinion. When are dates PHI without other identifiers?

    Posted 08-15-2022 07:54 AM
    My personal opinion is that as compliance professionals sometimes we need to think bigger and think about what we "can" do versus what we "should" do. I think this is a question for your organization to consider and decide where they land. Healthcare data is big business. What responsibility do we have in terms of data minimization when data sets can easily be combined and additional information gleaned through artificial intelligence processes?

    ------------------------------
    Brenda Manning JD, CHC, CHPC
    Privacy Counsel
    Maximus, Inc.

    The views expressed herein are my own and do not represent those of my employer. They are not meant to constitute legal advice or create an attorney-client relationship.
    ------------------------------

    Default Blank


  • 8.  RE: Please share your opinion. When are dates PHI without other identifiers?

    Posted 08-15-2022 10:46 AM
    I agree with Cinda and Brenda.  I would proceed cautiously.  When I am asked about information being de-identified by colleagues, I say if you can get it down to something like "69 year old male with CHF from a rural community...", then I am good with that.  Most of my colleagues understand that reference.
    A thorough evaluation of what is actually needed to complete the project being done will be good and release only the allowable minimal info.

    ------------------------------
    Ann Dunham
    MBA, SPHR, CHC, CHRC
    Compliance Officer
    Hannibal Regional Healthcare System
    Hannibal, MO
    ------------------------------

    Default Blank


  • 9.  RE: Please share your opinion. When are dates PHI without other identifiers?

    Posted 08-15-2022 11:24 PM
    Thank you Ann for taking time to respond.  This is a really helpful practical reference from the "boots on the ground" perspective.  Agree on the benefit of evaluating what is actually required for the project.

    I am glad I found this network and really appreciate all of the responses.

    ------------------------------
    Anna Balayn
    ------------------------------

    Default Blank


  • 10.  RE: Please share your opinion. When are dates PHI without other identifiers?

    Posted 08-15-2022 10:55 PM
    Thank you Brenda for brining this larger and really important overarching principle into this discussion. The methodology we will ultimately establish would have to minimize the risk and maximize protection of our customers' data.  However getting there looks like quite a journey.

    ------------------------------
    Anna Balayn
    ------------------------------

    Default Blank


  • 11.  RE: Please share your opinion. When are dates PHI without other identifiers?

    Posted 08-16-2022 04:34 AM
    Indeed...there can be some benefit by looking at questions both from a focused and a comprehensive manner.

    HOWEVER...keep in mind, at least this is my experience that I see when people post questions, is that when one starts with a basic question...which can be relatively straightforward...adding more and more...perspectives (either valuable or otherwise)...or compounding the question with extemporaneous additions can make a relatively simple question much more complex then it need be.  As we saw in our study session last Saturday...this is where people can develop a tendency to regularly overthink situations.

    Just a thought in passing and by no means am I saying anyone is doing anything right or wrong...just sharing.

    ------------------------------
    -------------Frank "Snake Bite Leader" Ruelas--------------
    Study Group Sign up Form
    https://forms.gle/WqzNp5WfaNGeyACh7
    ► We don't fail unless we quit! ◄
    ------------------------------

    Default Blank