p. 1

rehabilitation institute of chicago administrative policy subject management of information title disclosures of de-identified health information number 1230.023.1 date 07/03/2012 page 1 of 2 the rehabilitation institute of chicago ric recognizes that data associated with protected health information phi may be helpful for a variety of purposes such as research responding to public health queries and certain health care operations health information that would otherwise be phi may be used or disclosed without obtaining a patient s authorization if it is first de-identified de-identified health information is health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual health information shall be considered de-identified only if one or the two de-identification procedures set forth in this policy is followed ric may use health information to create de-identified health information or disclose health information to a business associate to create de-identified health information so long as ric and the business associate execute a business associate agreement in accordance with administrative policy #100.031 business associate agreements ric may use phi to create de-identified health information for research purposes without obtaining a patient s authorization or a waiver from an institutional review board de-identification process ric staff may determine that health information is de-identified only if it complies with one of the following two de-identification procedures a statistical methods health information is considered de-identified if a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable 1 determines that the risk is very small that the information could be used alone or in combination with other reasonably available information by an anticipated recipient to identify 2 an individual who is a subject of the information and 3 documents the methods and results of the analysis to justify such determination b removal of identifiers health information is considered de-identified if all eighteen 18 of the following identifiers of the individual or relatives employers or household members of the patient are removed and ric does not have any actual knowledge that the information could be used alone or in combination with other information to identify a patient 1 names 2 geographic subdivisions smaller than a state e.g street address city county precinct zip code and their equivalent geocodes except for the initial three digits of a zip code if according to the currently available data from the bureau of the census the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people if such geographic units contain 20,000 people or less then the initial three digits of the zip codes must be changed to 000 and thus treat them as a single geographic area

[close]

p. 2

rehabilitation institute of chicago administrative policy subject management of information title disclosures of de-identified health information number 1230.023.1 date 07/03/2012 page 2 of 2 3 all elements of dates except year directly related to an individual including birth date admission date discharge date date of death and for all ages over 89 all elements of date including year indicative of such age except that such ages and elements may be aggregated into a single category of age 90 or older note however that for research or other studies relating to young children or infants ric s policy does not prohibit age of an individual from being expressed in months days or hours 4 telephone numbers 5 fax numbers 6 electronic mail addresses 7 social security numbers 8 medical record numbers 9 health plan beneficiary numbers 10 account numbers 11 certificate/license numbers 12 vehicle identifiers and serial numbers including license plate numbers 13 device identifiers and serial numbers 14 web universal resource locators urls 15 internet protocol ip address numbers 16 biometric identifiers including finger and voice prints 17 full face photographic images and any comparable images 18 any other unique identifying number characteristic or code except as otherwise permitted for re-identification purposes as described below re-identification process a a code or other means of record identification designed to enable coded or otherwise deidentified information to be re-identified may not be disclosed except as otherwise permitted under ric s policies for disclosure of phi refer to administrative policy #1230.002 release of medical records and other protected health information phi and administrative policy #1230.001 legal law enforcement and government requests for protected health information b de-identified health information that has been re-identified may not be disclosed or used except as otherwise permitted under ric s policies for disclosure and use of phi previous effective date 02/23/2009 senior vice president general counsel government affairs/corporate secretary

[close]