4 ms·
That if is not even an if. They ask for: Gender, Age group, Zipcode and City HIPAA already considers that too much under their safe habour rules, and k-anonym
by La1n 6y ago
That if is not even an if.
They ask for: Gender, Age group, Zipcode and City
HIPAA already considers that too much under their safe habour rules, and k-anonymity (expert determination) can hardly be applied if you need to provide full zipcode and have a data-set that will grow/shrink over time.
https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html#safeharborguidance https://www.hhs.gov/hipaa/for-professionals/privacy/special-...
edit: oh, and it seems they also ask for a "encrypted patient identifier", definitely doesn't seem kosher
- kortex 6y ago33 bits of entropy to narrow down to a single individual. ~28 in USA UID, Gender, Age group, Zipcode and City, plus of course your medication habits, is probably enough to deanonymize with a reasonable amount of confidence. Say age group is one of 8, age+gender is 5 bits of entropy. City zip is ~8. So that's 15 bits left on a good day. Throw in any off-the-shelf targeted marketing data (usally worth 10-25 bits iirc) and you might as well use SSN as the patient ID.