HIPAA Data De-Identification and Secure Coding Basics

HIPAA Data Set and De- Identification of data May 2021 Data represents Mar 15 Apr 15 efforts

Secure Coding Basics These are the principles used to secure software. Apply these principles for securing software to your distinct environment: 1. Principle of least trust 2. Keep It Secure and Simple 3. Automation is the key- Establish your level of trust, Security by design and Securing the pipeline 4. Threat Model Your Software 5. Get Your Cryptography Right https://www.whitesourcesoftware.com/resources/blog/secure-coding/

Introduction: Patient Health Information Patient Health Information (PHI) definition: Term given to health data created, received, stored, or transmitted by HIPAA- covered entities and their business associates in relation to the provision of healthcare, healthcare operations and payment for healthcare services. Health Insurance Portability and Accountability Act of 1996 (HIPAA) A federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient s consent or knowledge. The US Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule to implement the requirements of HIPAA. The HIPAA Security Rule protects a subset of information covered by the Privacy Rule.

HIPAA Privacy Rule Vs Security Rule HIPAA Privacy Rule and Security Rule The Privacy Rule standards address the use and disclosure of individuals health information (known as protected health information ) by entities subject to the Privacy Rule. These individuals and organizations are called covered entities. While the HIPAA Privacy Rule safeguards protected health information (PHI), the Security Rule protects a subset of information covered by the Privacy Rule. This subset is all individually identifiable health information a covered entity creates, receives, maintains, or transmits in electronic form. HIPAA Security Rule at Texas Children s Hosptial Ensure the confidentiality, integrity, and availability of all electronic protected health information Detect and safeguard against anticipated threats to the security of the information Protect against anticipated impermissible uses or disclosures Certify compliance by their workforce

PHI Identifiable Data Name Health plan beneficiary number Address (all geographic subdivisions smaller than state, including street address, city county, and zip code) Account number Certificate or license number Vehicle identifiers and serial numbers, including license plate numbers All elements (except years) of dates related to an individual (including birthdate, admission date, discharge date, date of death, and exact age if over 89) Device identifiers and serial numbers Web URL Internet Protocol (IP) Address Telephone numbers Finger or voice print Fax number Photographic image - Photographic images are not limited to images of the face. Email address Any other characteristic that could uniquely identify the individual Social Security Number Medical record number

De-Identified Protected Health Information What is De-Identified Protected Health Information Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information. How is data to be de-identified? Section 164.514(a) of the HIPAA Privacy Rule provides the standard for de- identification of protected health information. Under this standard, health information is not individually identifiable if it does not identify an individual and if the covered entity has no reasonable basis to believe it can be used to identify an individual.