Ohio Administrative Code › Title 3364 - University of Toledo › Chapter 3364-90 - Guidelines for Protected Health Information › Section 3364-90-05 - De-identifiable and re-identifiable health information, limited data set and data use agreements

Current through all regulations passed and filed through July 1, 2024
(A)
								Policy
			 statement
The health insurance portability and
				accountability act of 1996 "HIPAA" permits disclosure of protected health
				information "PHI" that does not identify an individual and with respect to
				which there is no reasonable basis to believe that the information can be used
				to identify an individual when removing identifiers from the data. A code may
				be assigned or other means of record identification to allow information
				de-identified to be re-identified. Limited data sets may be disclosed in
				accordance with a data use agreement for the purposes of approved research,
				education, public health or health care operations.
(B)
								Purpose of
			 policy
To assure that PHI is properly
				de-identified when used without patient authorization or re-identified as
				required in HIPAA, C.F.R. 164.514.
(C)
								Procedure
(1)
									
			 De-identification of protected health information.
(a)
										Health
			 information that does not identify an individual and with respect to which
			 there is not reasonable basis to believe that the information can be used to
			 identify an individual, is not considered individual identifiable health
			 information.
(b)
										De-identified records are not PHI and therefore are not
			 protected by the privacy regulations. To the extent deidentified information
			 can be used or disclosed in lieu of PHI, none of the complex requirements or
			 the HIPAA laws apply.
(c)
										Information can be de-identified by two methods:
(i)
											Statistical
			 approach
Requires that a person with appropriate
				knowledge and experience of generally accepted statistical methods for
				rendering information not individually identifiable apply those methods or
				principles and determine that the risk is very small that the information could
				be used, alone or in combination with other reasonably available information by
				an anticipated recipient to identify an individual who is the subject of the
				information. The expert must document the methods used and the results of the
				analysis.
(ii)
											Safe harbor approach
(a)
												Requires that the
			 following data elements identifying the individual (or relative, employers, or
			 household members of the individual) be removed, provided the covered entity
			 does not have actual knowledge that the remaining information could be used
			 alone or in combination with other information to identify the
			 individual:
(i)
													
			 Name
(ii)
													All geographic subdivisions smaller than a state,
			 including street address, city, county, precinct, zip code, and equivalent
			 codes. The first three digits of the zip code may be retained if certain
			 conditions are met (i.e., the zip code area is not too sparsely
			 populated).
(iii)
													All elements of dates (except year) for dates directly
			 related to an individual, including birth date, admission date, discharge date,
			 date of death; and all ages over eighty-nine and all elements of dates
			 (including year) indicative of such age, except that such ages and elements may
			 be aggregated into a single category of age ninety or older:
(A)
														Telephone number
			 (including cell numbers).
(B)
														Fax numbers.
(C)
														Electronic mail
			 addresses.
(D)
														Social security numbers.
(E)
														Medical record
			 numbers.
(F)
														Account numbers.
(G)
														Health plan
			 beneficiary numbers.
(H)
														Certificate/license numbers.
(i)
														Vehicle
			 identifiers and serial numbers, including license plate
			 numbers.
(J)
														Device identifiers and serial numbers.
(K)
														Web universal
			 resource locators "URLs."
(L)
														Internet protocol "IP" address numbers.
(M)
														Biometric
			 identifiers, including finger and voice prints.
(N)
														Full face
			 photographic images and any comparable images, and
(O)
														Any unique
			 identifying number, characteristic or code.