Beyond safe harbor: automatic discovery of health information de-identification policy alternatives

Regulations in various countries permit the reuse of health information without patient authorization provided the data is "de-identified". In the United States, for instance, the Privacy Rule of the Health Insurance Portability and Accountability Act defines two distinct approaches to achieve de-identification; the first is Safe Harbor, which requires the removal of a list of identifiers and the second is Expert Determination, which requires that an expert certify the re-identification risk inherent in the data is sufficiently low. In reality, most healthcare organizations eschew the expert route because there are no standardized approaches and Safe Harbor is much simpler to interpret. This, however, precludes a wide range of worthwhile endeavors that are dependent on features suppressed by Safe Harbor, such as gerontological studies requiring detailed ages over 89. In response, we propose a novel approach to automatically discover alternative de-identification policies tha...

• Type: Journal
• Year: 2010
• Where: IHI
• Authors: Kathleen Benitez, Grigorios Loukides, Bradley Malin
• Keywords: Health Insurance Portability And Accountability Act, Healthcare, IHI 2010, Re-identification Risk, Safe Harbor