Which statement about de-identified data under HIPAA is true?

Which statement about de-identified data under HIPAA is true?

• A. De-Identified Data Cannot Be Shared Under HIPAA
• B. De-Identified Data May Be Used for Research Without Patient Authorization If Identifiers Are Removed
• C. De-Identified Data Requires Express Patient Consent Before Sharing
• D. De-Identified Data Must Always Be Encrypted

Answer: (B)

When data are properly de-identified under HIPAA, they are no longer considered PHI and can be used or disclosed for research without patient authorization. De-identification can be achieved either by removing a specified set of identifiers (the safe harbor method) or by having a qualified expert determine that re-identification risk is very small. Because of this, the statement that de-identified data may be used for research without patient authorization if identifiers are removed is the best answer. Encryption is a strong security practice, but it is not a requirement for de-identification itself under HIPAA. The other options are inaccurate because de-identified data may be shared, patient authorization is not routinely needed once identifications are removed, and encryption is not the mandated condition for de-identification.

When data are properly de-identified under HIPAA, they are no longer considered PHI and can be used or disclosed for research without patient authorization. De-identification can be achieved either by removing a specified set of identifiers (the safe harbor method) or by having a qualified expert determine that re-identification risk is very small. Because of this, the statement that de-identified data may be used for research without patient authorization if identifiers are removed is the best answer. Encryption is a strong security practice, but it is not a requirement for de-identification itself under HIPAA. The other options are inaccurate because de-identified data may be shared, patient authorization is not routinely needed once identifications are removed, and encryption is not the mandated condition for de-identification.