Taking Identifiers Out: Limited Data Sets and Minimum Necessary

Part of Human Subjects Protection for Clinical Research Staff: Privacy and Confidentiality.

About 5 minutes. Free, in your language, no account needed.

Why this matters

Sometimes the cleanest way to protect privacy is to take the identity out of the data. HIPAA recognizes three related ideas: de-identified data, limited data sets, and the minimum necessary standard. They get confused all the time, and the confusion leads to data being shared that should not be.

This lesson covers a US law, the HIPAA Privacy Rule (45 CFR 164.502(b) and 164.514), as it applies to covered entities. ICH E6(R3) asks that identifying information be protected under the applicable privacy and data protection requirements wherever the trial runs. Whether it governs your site depends on the site, so ask your privacy officer. Other countries have other privacy laws, and local rules may add requirements.

De-identified data

Health information is not individually identifiable if one of two things is true (164.514(a), (b)):

  1. A qualified expert determines and documents that the risk of identification by an anticipated recipient is very small. Or
  2. The listed 18 categories of identifiers of the individual, and of relatives, employers or household members, are removed, and the covered entity has no actual knowledge that the information could identify someone.

The list includes names, geographic subdivisions smaller than a state (with a 3-digit ZIP exception where the area has more than 20,000 people), all date elements except year that relate directly to an individual, ages over 89, contact numbers and email addresses, record and account numbers, device identifiers, URLs and IP addresses, biometric identifiers, full-face images, and any other unique identifying number, characteristic or code.

In practice, a spreadsheet with no names but with visit dates, a full ZIP code and a record number is not de-identified under the list method.

A code that allows re-identification is permitted if it is not derived from information about the individual and is not used or disclosed for other purposes (164.514(c)). A study ID that is a random number held by the site passes that test. A code built from initials and birth date does not, because it is derived from information about the person.

Limited data sets

A limited data set is PHI that excludes 16 listed direct identifiers, such as names, street address, phone, email, SSN, record numbers, device identifiers, URLs, IP addresses, biometric identifiers and full-face images. It may keep dates and town or city, state and ZIP (164.514(e)(1), (2)).

Note the difference. A limited data set is still PHI. It can be used or disclosed only for research, public health or health care operations, and only under a data use agreement (164.514(e)(3)).

The data use agreement must establish the permitted uses, who may use or receive the data, and that the recipient will (164.514(e)(4)(ii)):

Minimum necessary

A covered entity limits the PHI it uses, discloses or requests to the minimum reasonably necessary for the purpose (164.502(b)(1)). It may not use, disclose or request an entire medical record unless the entire record is specifically justified as the amount reasonably necessary (164.514(d)(5)). When a researcher provides documentation or representations that comply with 164.512(i), the covered entity may reasonably rely on the requested disclosure as the minimum necessary (164.514(d)(3)(iii)(D)).

Minimum necessary does not apply to uses or disclosures made under a signed authorization (164.502(b)(2)(iii)). It matters most when PHI is used or disclosed for research without one, for example under an IRB or privacy board waiver.

For site staff, a practical rule follows. Request the fields the protocol needs, not the whole chart. Do not copy more than you need into a study file.

In practice

A research assistant is asked to send a dataset to an outside analyst. The analyst wants visit dates and town of residence to study seasonal patterns. The assistant does not call the data "de-identified" because the names are gone. She asks the privacy officer which route applies. The privacy officer points to a limited data set and a data use agreement, which the analyst signs before any data are sent. The assistant sends only the fields in the agreement.

What this looks like when it goes wrong

A coordinator removes names and emails from an export and labels the file "de-identified." Visit dates, the full ZIP code and record numbers stay in. The file goes to a vendor without any agreement. Under the list method those fields are identifiers, and the file is still PHI. A limited data set would also have to exclude record numbers and would need a data use agreement. The site now has a possible unpermitted disclosure to take to its privacy officer. Removing the obvious column is not de-identification.

Key takeaways