Part II: HIPAA and disclosure risk issues

IRB Ethics and Human Research

Volumn 28, Issue 1, 2006, Pages 6-11

  De Wolf, Virginia A ^d   Sieber, Joan E ^a   Steel, Philip M ^b   Zarate, Alvan O ^c  

^a CALIFORNIA STATE UNIVERSITY   (United States)

^b U S CENSUS BUREAU   (United States)

^c NATIONAL CENTER FOR HEALTH STATISTICS   (United States)

^d NONE

Author keywords

[No Author keywords available]

Indexed keywords

BIOMEDICAL AND BEHAVIORAL RESEARCH; COOPERATION; HEALTH INSURANCE; INFORMATION DISSEMINATION; INFORMATION PROCESSING; INTERPERSONAL COMMUNICATION; LEGAL APPROACH; LEGAL ASPECT; MEDICAL RESEARCH; METHODOLOGY; PRIVACY; PROFESSIONAL STANDARD; PUBLIC RELATIONS; REVIEW; RISK; STANDARD; UNITED STATES;

BIOMEDICAL AND BEHAVIORAL RESEARCH; LEGAL APPROACH;

BIOMEDICAL RESEARCH; COOPERATIVE BEHAVIOR; DISCLOSURE; ETHICS COMMITTEES, RESEARCH; HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT; INFORMATION DISSEMINATION; INTERPROFESSIONAL RELATIONS; PRIVACY; RECORDS; RISK; UNITED STATES;

EID: 32144456033     PISSN: 01937758     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Review

References (16)

1. de Wolf VA, Sieber JE, Steel PM, and Zarate AO. Part I: What is the requirement for data sharing? IRB Ethics & Human Research 2005;27(6):12-16.
2. http://www.icpsr.umich.edu/access/deposit/index.html.
3. For example, the Bureau of Labor Statistics, Bureau of the Census, Bureau of Transportation Statistics, National Center for Education Statistics, and National Center for Health Statistics have Disclosure Review Boards.
4. Standards for Privacy of Individually Identifiable Health Information, 45 CFR Parts 160 and 164 (2004). http://www.hhs.gov/ ocr/combinedregtext.pdf. For definition of "covered entity" see 45 CFR 160.103.
5. It is ultimately the covered entity's decision whether to allow a researcher to use or disclose such information under a waiver of authorization. The waiver of authorization does not compel a covered entity to use or disclose protected health information.
6. The National Institutes of Health has issued a number of guidance documents to assist researchers with the HIPAA Privacy Rule. See http://privacyruleandresearch.nih.gov/.
7. See ref. 4, 45 CFR 164.514(b).
8. See ref. 4, 45 CFR 164.514(b)(1)(i) and (ii).
9. See ref. 4, 45 CFR 164.514(e).
10. http://www.murray.harvard.edu/mra/index.jsp.
11. For an example of the kinds of public list searches one can buy, see http://www.accurint.com/price2.html.
12. http://www.vitalsearch-ca.com/gen/ky/_vitals/kymarrim-go.htm.
13. There are websites that provide lists of publicly available data, e.g., http://www.searchsystems.net/mdex.php.
14. Steel PM. Disclosure risk assessment for microdata. Paper presented at the Joint Statistical Meetings, Toronto, Canada, August 2004.
15. "Each data record includes a ... unique ID, license number, name, mailing address, practice address, birth year, birthplace, medical school, graduation year, license issuance date, license expiration date, registration status code & date, county name, gender code, and ethnicity code. Physician databases also include the degree, primary and secondary specialty, method of licensure, state/country of reciprocity, practice type code, practice setting code, and practice time code fields. ... The complete database is produced at the beginning of every month." http://www.tmb.state.tx.us/consumers/ products/electronicdb. php.
16. For example, in 2004 and 2005 the Washington Statistical Society offered the course, "Privacy, Confidentiality, and the Protection of Health Data: A Statistical Perspective on the HIPAA Privacy Rule." http://www.science. gmu.edu/-wss/WSS_Privacy_Health.html.