By Sara Shanti and Fatema Zanzi
As mandated by the American Recovery and Reinvestment Act of 2009, on November 26, 2012, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) issued guidance on the de-identification of protected health information (PHI) in accordance with the HIPAA Privacy Rule (Privacy Rule). This tool, which is set forth in a navigable Q&A format, is the result of stakeholders with practical, technical, and policy experience contributing to a Washington, D.C. workshop in March 2010. The resulting guidance does not change the Privacy Rule, but rather clarifies the existing regulation as it pertains to de-identification of PHI. The guidance specifically addresses the two acceptable de-identification methodologies under the Privacy Rule: (1) Expert Determination and (2) Safe Harbor. De-identified information does not constitute PHI and, therefore, it is not governed by the Privacy Rule. Guidance on the implementation specifications of these two methodologies therefore serves to assist covered entities in creating information that may be freely used for analysis and research without violating the Privacy Rule.
Click the "Download PDF" button above to read more.