There are no restrictions on the use or disclosure of de-identified health information. However, de-identification of records requires careful and thorough consideration of which elements could be used on their own or with other information to identify an individual. De-identified health information neither identifies nor provides a reasonable basis to identify an individual.
There are two ways to de-identify information; either:
May I share de-identified health information?
- a formal determination by a qualified statistician; or
- the removal of specified identifiers of the individual and of the individual’s relatives, household members, and employers is required, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual.
Before disclosing de-identified information, see 45 C.F.R. § 164.514(b) (6-page PDF file; About PDFs) of the Privacy Rule for complete details on the de-identification of health information.
HIPAA Privacy
Who must comply with HIPAA privacy standards?
Do state privacy laws override HIPAA?
What is Protected Health Information (PHI)?
May I share de-identified health information?
