/groups/data/search/index.rss?tag=hotlist/groups/data/search/?tag=hotWhat’s HotHotListHot!?tag=hot0/groups/data/sidebar/HotListNo items tagged with hot.hot/groups/data/search/index.rss?sort=modifiedDate&kind=all&sortDirection=reverse&excludePages=wiki/welcomelist/groups/data/search/?sort=modifiedDate&kind=all&sortDirection=reverse&excludePages=wiki/welcomeRecent ChangesRecentChangesListUpdates?sort=modifiedDate&kind=all&sortDirection=reverse&excludePages=wiki/welcome0/groups/data/sidebar/RecentChangesListmodifiedDateallRecent ChangesRecentChangesListUpdateswiki/welcomeNo recent changes.reverse5search
De-Identification Of Data
- Individually-identifiable Health Information - Health information that does not identify an
individual and to which there is no reasonable basis to believe that the information can be used
to identify an individual is not individually-identifiable health information.
- De-identification - VHA would consider health information not individually-identifiable
health information only if the steps outlined in subparagraphs 2a or 2b are met:
- A person with appropriate knowledge of and experience with generally accepted statistical
and scientific principles and methods for rendering information not individually-identifiable
applying such principles and methods:
- Determines that the risk that the information could be used, alone or in combination with
other reasonably available information, by an anticipated recipient to identify an individual who
is a subject of the information is very small; and
- Documents the methods and results of the analysis that justify such determination.
- VHA does not have actual knowledge that the information could be used alone or in
combination with other information to identify an individual who is a subject of the
information. The following identifiers of the individual or of relatives, employers, or household
members of the individual are removed:
- All geographic subdivisions smaller than a State, including street address, city, county,
precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code
if, according to the current publicly available data from the Bureau of the Census:
- The geographic unit formed by combining all zip codes with the same three initial digits
contains more than 20,000 people; and
- The initial three digits of a zip code for all such geographic units containing 20,000 or
fewer people is changed to 000.
- All elements of dates (except year) for dates directly related to an individual, including
birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of
dates (including year) indicative of such age, except that such ages and elements may be
aggregated into a single category of age 90 or older.
- Telephone numbers
- Fax numbers
- Electronic mail (email) addresses
- Social Security Numbers (ssn's)
- Medical record numbers.
- Health plan beneficiary numbers.
- Account numbers
- Certificate and/or license numbers
- Vehicle identifiers (VIN) and serial numbers, including license plate numbers
- Device identifiers and serial numbers
- Web Universal Resource Locators (URLs)
- Internet Protocol (IP) address numbers
- Biometric identifiers, including finger and voice prints
- Full-face photographic images and any comparable images
- Any other unique identifying number, characteristic, or code, except as permitted by
- VHA may assign a code, or other means of record identification, in order to allow information de-identified under subparagraph 2b, or to be re-identified by VHA, provided that:
- The code or other means of record identification is not derived from, or related to,
information about the individual and that the code is not otherwise capable of being translated
so as to identify the individual;
- The code, or other means of re-identification, is not used or disclosed by VHA for any
other purpose; and
- VHA does not disclose the mechanism (e.g., algorithm or other tool) for re-identification.
- The code or other means of record identification is not considered one of the identifiers
that must be excluded for de-identification. NOTE: When disclosing de-identified data to non-
VA entities this code needs to be removed.
NOTE: Scrambling of names and social security numbers is not considered de-identifying health information for the purposes of this Handbook.
The Veterans Health Administration (VHA) considers the de-identification standard of the HIPAA Privacy Rule for address acceptable or protecting Address under Title 38 United States Code (U.S.C.) 5701.