What is de-identified information and how may it be used?
As indicated above, the protection of the HIPAA privacy regulations extends to health information that is individually identifiable with respect to the subject of the information. When information is stripped of its individual identifiers it ceases to be protected information under the privacy regulations. The regulations permit the de-identification to occur in either of two ways. First, there is a regulatory “safe harbor” method that specifically instructs that eighteen specified identifiers be removed. The eighteen specified identifiers include: • Names • Social Security numbers • Telephone numbers • All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code, if, according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combing all zip codes with the same three initial digits contains more than 20,
