A Practical Guide to De-Identifying PHI: How Small Practices Can Use Data Safely and Legally (45 CFR § 164.514)

Executive Summary

For small healthcare practices, de-identifying Protected Health Information (PHI) offers a powerful pathway to leverage valuable data for research, public health, and healthcare operations without violating patient privacy or HIPAA regulations. 45 CFR § 164.514 outlines the specific standards and implementation specifications for de-identifying health information, freeing it from the constraints of the HIPAA Privacy Rule. This guide details the two recognized de-identification methods Safe Harbor and Expert Determination, providing small practices with actionable steps to safely and legally use health data, unlock its potential, and ensure continuous compliance while protecting patient confidentiality.

Introduction

In today's data-driven healthcare landscape, the ability to analyze health information is crucial for improving patient care, conducting research, and enhancing practice operations. However, the stringent requirements of the HIPAA Privacy Rule often present a challenge, particularly for small practices with limited resources. This is where de-identification becomes a critical tool. Health information that has been properly de-identified is no longer considered individually identifiable and, therefore, is not protected by the HIPAA Privacy Rule. This means it can be used and disclosed for any purpose without HIPAA restrictions, offering immense flexibility. 45 CFR § 164.514 provides the roadmap for achieving this de-identification, outlining clear standards to help your practice unlock the value of your data while upholding the highest standards of patient privacy.

The Fundamental Principle: De-Identified Data is Not PHI

Under 45 CFR § 164.514(a), health information is considered de-identified (not individually identifiable health information) if it does not identify an individual and there is no reasonable basis to believe that the information can be used to identify an individual. Once properly de-identified, this data is no longer subject to the HIPAA Privacy Rule.

Two Methods for De-Identifying PHI

HIPAA provides two primary methods for de-identifying health information, as detailed in § 164.514(b):

1. The Safe Harbor Method (§ 164.514(b)(2))

This is often the more straightforward method for small practices, as it involves the removal of specific identifiers. To satisfy the Safe Harbor method, a covered entity must:

• Remove all 18 specified identifiers of the individual or of their relatives, employers, or household members.
• Have no actual knowledge that the information remaining could be used, alone or in combination with other information, to identify an individual who is a subject of the information.

The 18 Identifiers to Remove

• Names
• All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their equivalent geocodes. An exception applies to the initial three digits of a ZIP code if the geographic unit formed by combining all ZIP codes with the same initial three digits contains more than 20,000 people. If it contains 20,000 or fewer, the initial three digits must be changed to '000'.
• All elements of dates (except year) directly related to an individual, including birthdate, admission date, discharge date, date of death. All ages over 89 must be aggregated into a single category of "age 90 or older" (including all elements of dates indicative of such age).
• Telephone numbers
• Fax numbers
• Email addresses
• Social Security numbers
• Medical record numbers
• Health plan beneficiary numbers
• Account numbers
• Certificate/license numbers
• Vehicle identifiers and serial numbers, including license plate numbers
• Device identifiers and serial numbers
• Web Universal Resource Locators (URLs)
• Internet Protocol (IP) addresses
• Biometric identifiers, including finger and voiceprints
• Full-face photographic images and any comparable images
• Any other unique identifying number, characteristic, or code (with an exception for re-identification codes, discussed below).

Practical Considerations for Safe Harbor

• Text Analysis: Be thorough in free-text fields (e.g., progress notes, discharge summaries) as identifiers can be embedded in narratives.
• Aggregation: When dealing with small numbers of geographic units or ages over 89, aggregate data to prevent re-identification through unique combinations.
• Documentation: Maintain records of your de-identification process.

2. The Expert Determination Method (§ 164.514(b)(1))

This method requires a formal determination by a qualified expert. A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable must:

• Apply such principles and methods to determine that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information.
• Document the methods and results of the analysis that justify such determination.

Practical Considerations for Expert Determination

• Expertise: The expert does not require a specific degree or certification but must have relevant experience and knowledge.
• Risk Assessment: The expert assesses the risk of re-identification, considering factors like population size, data uniqueness, potential recipients, and available external datasets.
• Techniques: Experts might employ techniques like suppression (concealing small numbers) and blurring (converting exact values into ranges).
• Documentation: Comprehensive documentation of the analysis, methods, results, and justification for the "very small risk" determination is critical.

Re-Identification of De-Identified Information (§ 164.514(c))

While de-identified information is no longer PHI, practices may sometimes need to re-identify data for internal purposes (e.g., linking de-identified data back to patient records for quality improvement or further treatment). HIPAA permits this under certain conditions:

• A covered entity may assign a code or other means of record identification to allow de-identified information to be re-identified by the covered entity.
• The code or means of identification must not be derived from or related to information about the individual, and must not otherwise be capable of being translated to identify the individual.
• The covered entity must not use or disclose the code for any other purpose, and must not disclose the mechanism for re-identification (e.g., algorithm or other tool).

Common Pitfalls

• Assuming data is de-identified without full removal of all 18 Safe Harbor identifiers
• Overlooking identifiers embedded in free-text notes or image metadata
• Failing to document the de-identification process
• Using re-identification codes that could be reverse-engineered
• Not updating processes when new data types or technologies are introduced

Expert Tips

• Conduct a full data inventory before attempting de-identification
• Use de-identification software tools, but manually audit samples
• Train staff to understand identifiers that may appear in text or images
• When using Expert Determination, contract with experienced statisticians
• Maintain a separate, secure log if re-identification codes are implemented

Simplified Compliance Checklist

Regulatory References and Official Guidance

• HIPAA Regulations
• HHS HIPAA Portal
• Guide to Privacy and Security of Electronic Health Info
• Security Risk Tool
• Security Rule Guidance
• NIST Encryption Standards

Concluding Recommendations and Next Steps

For small practices, de-identifying PHI according to 45 CFR § 164.514 is a strategic move that not only ensures HIPAA compliance but also unlocks significant potential for data-driven insights. Whether you choose the prescriptive Safe Harbor method or the more flexible Expert Determination, a thorough and documented approach is key. By understanding and diligently applying these guidelines, your practice can confidently contribute to broader healthcare initiatives, participate in research, and refine internal operations, all while rigorously safeguarding the privacy that your patients expect and deserve. Consider leveraging specialized software or consulting with HIPAA compliance experts to streamline your de-identification processes and ensure ongoing adherence.