title: Never too old for anonymity: a statistical standard for demographic data sharing via the HIPAA Privacy Rule.
abstract: OBJECTIVE
  Healthcare organizations must de-identify patient records before sharing data. Many organizations rely on the Safe Harbor Standard of the HIPAA Privacy Rule, which enumerates 18 identifiers that must be suppressed (eg, ages over 89). An alternative model in the Privacy Rule, known as the Statistical Standard, can facilitate the sharing of more detailed data, but is rarely applied because of a lack of published methodologies. The authors propose an intuitive approach to de-identifying patient demographics in accordance with the Statistical Standard.
  
  
  METHODS
  The authors conduct an analysis of the demographics of patient cohorts in five medical centers developed for the NIH-sponsored Electronic Medical Records and Genomics network, with respect to the US census. They report the re-identification risk of patient demographics disclosed according to the Safe Harbor policy and the relative risk rate for sharing such information via alternative policies.
  
  
  METHODS
  The re-identification risk of Safe Harbor demographics ranged from 0.01% to 0.19%. The findings show alternative de-identification models can be created with risks no greater than Safe Harbor. The authors illustrate that the disclosure of patient ages over the age of 89 is possible when other features are reduced in granularity.
  
  
  CONCLUSIONS
  The de-identification approach described in this paper was evaluated with demographic data only and should be evaluated with other potential identifiers.
  
  
  CONCLUSIONS
  Alternative de-identification policies to the Safe Harbor model can be derived for patient demographics to enable the disclosure of values that were previously suppressed. The method is generalizable to any environment in which population statistics are available.
authors.affiliation: Department of Biomedical Informatics, School of Medicine, Vanderbilt University, Nashville, Tennessee 37203, USA. b.malin@vanderbilt.edu
authors.forename: Bradley
authors.initials: B
authors.lastname: Malin
authors.forename: Kathleen
authors.initials: K
authors.lastname: Benitez
authors.forename: Daniel
authors.initials: D
authors.lastname: Masys
mesh_terms: D000369:Aged, 80 and over; D035843:Biomedical Research; D003219:Confidentiality / Q000331:legislation & jurisprudence*; D016208:Databases, Factual; D003710:Demography; D057286:Electronic Health Records / Q000331:legislation & jurisprudence / Q000706:statistics & numerical data*; D005260:Female; D023281:Genomics; D020408:Health Insurance Portability and Accountability Act; D006801:Humans; D033181:Information Dissemination / Q000331:legislation & jurisprudence*; D008297:Male; D012306:Risk; D014481:United States