Scope of this standard

This standard describes the acceptable process of de-identification, by which identifiers are removed from the health information, mitigating privacy risks to individuals and thereby supports the secondary use of data for comparative effectiveness studies, policy assessment, life sciences research, and other endeavors. 

This standard applies to all Texas State University HCCs.

Expand FAQ List

  • The Privacy Rule provides two de-identification methods:

    Qualified Expert Determination

    A person with appropriate knowledge of and experience with accepted statistical and scientific principles and methods for rendering patient identifiable information into no longer being individually identifiable:

    1. determines that the risk is small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information; and  
    2. documents the methods and results of the analysis to justify such determination. 

     

  • All eighteen (18) of the HIPAA identifiers of the individual or relatives, employers or household members of the individual are removed, and no actual knowledge of residual information can identify the individual. The 18 identifiers are as follows:

    1. Names of individuals or of relatives, employers, or household member of the individual
    2. All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their equivalent geocodes, except for the initial three digits of the ZIP code if, according to the current publicly available data from the Bureau of the Census:
      1. The geographic unit formed by combining all ZIP codes with the same three initial digits contains more than 20,000 people; and
      2. The initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer people is changed to 000
    3. All elements of dates (except year) for dates that are directly related to an individual, including birth date, admission date, discharge date, death date, and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older
    4. Telephone numbers
    5. Vehicle identifiers and serial numbers, including license plate numbers
    6. Fax numbers
    7. Device identifiers and serial numbers
    8. Email addresses
    9. Web Universal Resource Locators (URLs)
    10. Social security numbers
    11. Internet Protocol (IP) addresses
    12. Medical record numbers
    13. Biometric identifiers, including finger and voice prints
    14. Health plan beneficiary numbers
    15. Full-face photographs and any comparable images
    16. Account numbers
    17. Certificate/license numbers
    18. Any other unique identifying number, characteristic, or code, except as permitted by (2.) above