HHS Office of Civil Rights Guidance on De-identifying PHI

The Department of Health and Human Services’ Office of Civil Rights (OCR) has released guidance about methods to achieve de-identification of Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. The guidance is intended to assist covered entities to understand what de-identification is, the general process by which de-identified information is created, and the options available for performing de-identification.

Two methods can be used to de-identify aggregated patient data:

  1. Expert Determination Method
    • Apply accepted statistical or scientific principles and determine that the risk the information could be identified is very small.
  2. Safe Harbor Method.
    • Remove 18 types of identifiers related to the individual, relatives, employers, or household members.

Access the guidance and background information at: http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/De-identification/guidance.html


Anne Diamond
Senior Director