De-identified data is not PHI and therefore, is not subject to the rules applicable to PHI. However, de-identified data is still subject to this procedure and rules related to IRB review. Before using de-identified data in human subjects research, researchers are required to submit to the IRB an application for research exemption from committee review or an IRB application for committee review and approval.
Data is de-identified if, in accordance with the de-identification standard, 45 C.F.R. §164.514(a)(b), a person with appropriate knowledge and skill uses accepted scientific principles and methods to determine the risk is very small that information could be used to identify the individual and documents the method used to justify such a conclusion; or if all of the following identifiers for the individual and the individual's relatives, employers or household members are removed:
- All geographic subdivisions smaller than a state (street address, city, county, precinct) Note: zip code or equivalents must be removed, but can retain first 3 digits if the geographic unit to which the zip code applies if the zip code area contains more than 20,000 people.
- For dates directly related to the individual, all elements of dates, except year (date of birth, admission date, discharge date, date of death).
- All ages over 89 or dates indicating such an age, except that you may have an aggregate category of individuals 90 and older.
- Telephone number
- Fax number
- Email address
- Social security number
- Medical record number
- Health plan number
- Account numbers
- Certificate or license numbers
- Vehicle identification/serial numbers, including license plate numbers
- Device identification/serial numbers
- Universal resource locators
- Internet protocol addresses
- Biometric identifiers
- Full face photographs and comparable images
- Any other unique identifying number, characteristic or code.
RE-IDENTIFICATION OF DE-IDENTIFIED DATA
A code or other means of re-identifying de-identified data may be assigned, provided that the code is not derived from or related to information about the individual or is not otherwise capable of being used to identify the individual. The code or other means of re-identifying de-identified data will not be disclosed to the researcher.
If information that was once de-identified is re-identified, it is once again PHI and will not be used or disclosed in violation of any policy, procedure or state or federal law applicable to PHI.