Effective policy creation, program planning, and other critical decision-making processes aimed at community development and improving population health require quality data. An important source is data de-identified under guidelines in The Health Insurance Portability and Accountability Act (HIPAA). HIPAA allows two approaches to de-identifying protected health information (PHI): Expert Determination and Safe Harbor.Of these two, the Institute for Families in Society (IFS) at the University of South Carolina uses Expert Determination. Under the HIPAA Privacy Rule, de-identified data are not considered to be PHI and can be shared and used for any purpose.
The Expert Determination method uses statistical and scientific principles to assess the risk that PHI could be used alone or in combination with other available data to identify specific individuals. At the core of this approach is an assessment by qualified professionals that the “risk is very small” that reported information, alone or in combination with other available data sources, could identify any individual who is the subject of the information. Expert Determination must be justified by means of documentation describing risk mitigation and risk assessment methods and results. IFS uses a variety of statistical and geographic methods to mitigate the risk that any individual might be identified and the specific de-identification methods used can vary.
Get the report here that explains more about the two approaches to de-identification and how IFS utilizes Expert Determination.