Join us to hear more about establishing privacy protection under the Health Insurance Portability and Accountability Act (HIPAA) when some potentially “identifying fields” remain in health records.

This webinar discusses conditions under which health records are considered not “individually identifiable health information” and thus not subject to the requirements that relate to Protected Health Information. HIPAA’s Privacy Rule allows health records to be de-identified by stripping specific identifying fields (names, addresses, account numbers, medical procedure dates, etc.). However, often businesses need to retain more information than allowed under this “Safe Harbor” method. The Privacy Rule permits alternative ways to de-identify health records, provided a statistician or similarly qualified individual determines that the risk is very small that the information can be used to identify patients.

The webinar covers how statisticians evaluate identification risks and how this assists clients with minimizing those risks. Topics include:

• The types of issues statisticians consider to determine whether health information can identify individuals: the roles of anticipated recipients of the data, the purposes for which they will use the data, related external data sources that may be available, the comprehensiveness of data fields, etc.
• Strategies for minimizing identification risks: “rank-swapping” of extreme values, automated “scrubbing” of images, and encryption-like “hashing” methods to mask patient identities to the company while preserving identifiability for business partners.