Skill Tracer
Skills › Scientific Agent Skills › clinical-decision-support › privacy_and_disclosure.md

privacy_and_disclosure.md

144 lines · skills/clinical-decision-support/references/privacy_and_disclosure.md at 5f2bc03

Open on GitHub

Most marks come from matching words in the file, so treat them as pointers.

1# Privacy, De-identification, and Disclosure
2

Privacy, De-identification, and Disclosure

Raw lines 1 to 2
3## Boundary
4
5The skill never reads PHI, raw records, free-text notes, images, sequences, or row-level data. The checklist records a human process; it does not de-identify data.
6
7Do not paste sensitive information into a template to see whether it passes.
8

Boundary

The skill never reads PHI, raw records, free-text notes, images, sequences, or row-level data. The checklist records a human process; it does not de-identify data.

Do not paste sensitive information into a template to see whether it passes.

Raw lines 3 to 8
9## HHS Methods
11The HIPAA Privacy Rule at 45 CFR 164.514 provides two methods for de-identification:
131. **Expert Determination** — a qualified expert applies generally accepted statistical and scientific principles, determines that re-identification risk is very small, and documents methods and results.
142. **Safe Harbor** — specified identifiers of the individual and relatives, employers, or household members are removed, and the covered entity has no actual knowledge that the remaining information could identify an individual alone or in combination.
16Primary sources:
18- [HHS de-identification guidance](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html)
19- [45 CFR 164.514](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514)
21The checklist cannot determine whether an organization is a covered entity/business associate, whether information is PHI, or whether a method was correctly applied.

HHS Methods

The HIPAA Privacy Rule at 45 CFR 164.514 provides two methods for de-identification:

  1. Expert Determination — a qualified expert applies generally accepted statistical and scientific principles, determines that re-identification risk is very small, and documents methods and results.
  2. Safe Harbor — specified identifiers of the individual and relatives, employers, or household members are removed, and the covered entity has no actual knowledge that the remaining information could identify an individual alone or in combination.

Primary sources:

The checklist cannot determine whether an organization is a covered entity/business associate, whether information is PHI, or whether a method was correctly applied.

Raw lines 9 to 22
23## Safe Harbor Categories
25The human review must address all categories:
271. names;
282. geographic subdivisions smaller than a state, subject to ZIP-code rules;
293. date elements more specific than year, with the age-90 rule;
304. telephone numbers;
315. fax numbers;
326. email addresses;
337. Social Security numbers;
348. medical record numbers;
359. health-plan beneficiary numbers;
3610. account numbers;
3711. certificate/license numbers;
3812. vehicle identifiers and serial numbers;
3913. device identifiers and serial numbers;
4014. web URLs;
4115. IP addresses;
4216. biometric identifiers;
4317. full-face photographs and comparable images;
4418. other unique identifying numbers, characteristics, or codes.
46Parts and derivatives can still be identifiers. HHS specifically notes that free text is not exempt and can contain listed identifiers or identifying context.

Safe Harbor Categories

The human review must address all categories:

  1. names;
  2. geographic subdivisions smaller than a state, subject to ZIP-code rules;
  3. date elements more specific than year, with the age-90 rule;
  4. telephone numbers;
  5. fax numbers;
  6. email addresses;
  7. Social Security numbers;
  8. medical record numbers;
  9. health-plan beneficiary numbers;
  10. account numbers;
  11. certificate/license numbers;
  12. vehicle identifiers and serial numbers;
  13. device identifiers and serial numbers;
  14. web URLs;
  15. IP addresses;
  16. biometric identifiers;
  17. full-face photographs and comparable images;
  18. other unique identifying numbers, characteristics, or codes.

Parts and derivatives can still be identifiers. HHS specifically notes that free text is not exempt and can contain listed identifiers or identifying context.

Raw lines 23 to 47
48## Expert Determination Record
50Record without embedding the sensitive data:
52- expert qualifications and independence;
53- data context and recipients;
54- anticipated data linkages and attacker knowledge;
55- methods and assumptions;
56- risk threshold and rationale;
57- mitigation and residual risk;
58- validity period and change triggers;
59- documentation location and approval.
61Do not claim that hashing, pseudonymization, encryption, a data-use agreement, or a low cell count alone constitutes Expert Determination.

Expert Determination Record

Record without embedding the sensitive data:

  • expert qualifications and independence;
  • data context and recipients;
  • anticipated data linkages and attacker knowledge;
  • methods and assumptions;
  • risk threshold and rationale;
  • mitigation and residual risk;
  • validity period and change triggers;
  • documentation location and approval.

Do not claim that hashing, pseudonymization, encryption, a data-use agreement, or a low cell count alone constitutes Expert Determination.

Raw lines 48 to 62
63## Aggregate Disclosure
65Aggregate tables can still disclose information through:
67- small cells;
68- row/column totals;
69- differencing across releases;
70- rare combinations;
71- nested geographies;
72- longitudinal patterns;
73- extreme values;
74- genomics;
75- external linkage.
77Controls may include:
79- minimum cell thresholds;
80- primary suppression;
81- complementary suppression;
82- category aggregation;
83- top/bottom coding;
84- rounding or perturbation under an approved method;
85- release coordination;
86- query budgets;
87- access controls and data-use agreements;
88- secure enclaves;
89- expert review.
91There is no universal small-cell threshold that proves HIPAA de-identification. The table generator defaults to 11 only as a conservative operational safeguard and applies complementary suppression within a row. The data steward must select policy.

Aggregate Disclosure

Aggregate tables can still disclose information through:

  • small cells;
  • row/column totals;
  • differencing across releases;
  • rare combinations;
  • nested geographies;
  • longitudinal patterns;
  • extreme values;
  • genomics;
  • external linkage.

Controls may include:

  • minimum cell thresholds;
  • primary suppression;
  • complementary suppression;
  • category aggregation;
  • top/bottom coding;
  • rounding or perturbation under an approved method;
  • release coordination;
  • query budgets;
  • access controls and data-use agreements;
  • secure enclaves;
  • expert review.

There is no universal small-cell threshold that proves HIPAA de-identification. The table generator defaults to 11 only as a conservative operational safeguard and applies complementary suppression within a row. The data steward must select policy.

Raw lines 63 to 92
93## Template Status Values
95For each category use:
97- `not_present` — documented inventory confirms absence;
98- `removed` — documented transformation confirms removal;
99- `generalized` — allowed generalization documented and approved;
100- `expert_reviewed` — addressed under the referenced Expert Determination;
101- `unresolved` — not complete.
103Every non-unresolved status needs evidence text. Never include an example identifier in evidence.

Template Status Values

For each category use:

  • not_present — documented inventory confirms absence;
  • removed — documented transformation confirms removal;
  • generalized — allowed generalization documented and approved;
  • expert_reviewed — addressed under the referenced Expert Determination;
  • unresolved — not complete.

Every non-unresolved status needs evidence text. Never include an example identifier in evidence.

Raw lines 93 to 104
105## Actual-Knowledge and Residual-Risk Review
107Document:
109- free-text review;
110- derived fields;
111- linkage and differencing;
112- unusual occupations or events;
113- rare diseases/combinations;
114- dates and ages;
115- geography;
116- longitudinal uniqueness;
117- recipient context;
118- prior releases;
119- residual identifiers.
121Escalate uncertainty. Do not mark the checklist complete merely because all obvious columns were removed.

Actual-Knowledge and Residual-Risk Review

Document:

  • free-text review;
  • derived fields;
  • linkage and differencing;
  • unusual occupations or events;
  • rare diseases/combinations;
  • dates and ages;
  • geography;
  • longitudinal uniqueness;
  • recipient context;
  • prior releases;
  • residual identifiers.

Escalate uncertainty. Do not mark the checklist complete merely because all obvious columns were removed.

Raw lines 105 to 122
123## Output Language
125Allowed:
127> Documentation checklist complete for the selected method. This output is not a HIPAA compliance or de-identification determination.
129Not allowed:
131> HIPAA compliant.
133> Safe to publish.
135> Anonymous.

Output Language

Allowed:

Documentation checklist complete for the selected method. This output is not a HIPAA compliance or de-identification determination.

Not allowed:

HIPAA compliant.
Safe to publish.
Anonymous.
Raw lines 123 to 136
137## Script
139```bash
140python3 scripts/deidentification_checklist.py \
141 assets/deidentification_checklist_template.json
142```
144The distributed template is unresolved by design.

Script

python3 scripts/deidentification_checklist.py \
  assets/deidentification_checklist_template.json

The distributed template is unresolved by design.

Raw lines 137 to 144
Runs code python3 scripts/deidentification_checklist.py :140