I have been asked by a client to deidentify the PHI data in their database and I'm either over-simplifying the process or my client is overly paranoid. Perhaps you can tell me which is the case.
This client's need for de-identification is two-fold. When they lose a client they have the right to keep a deidentified copy of the data for analytical purposes. Also, they need to be able to move the data to dev/test environments in a deidentified form.
Here's an example of what would be in the database:
This data is used for analysis and some of the important factors are:
Age at admission (Admission Date - Birthdate)
Length of stay (Discharge Date - Admission Date)
Improvement (Discharge Score - Admission Score)
Here are my questions...
If I simply randomize the names, is this not deidentified enough to satisfy HIPAA requirements?
I didn't think so. What if I also randomize the Facility name? If I only know the other pieces of information, birthdate, gender, dates, and scores, has this been reasonably deidentified?
Ok, assuming the answer is no, what if I then choose a random birthdate and adjust the admission and discharge dates so that age at admission and length of stay are still the same? For example, if the patient was born on 1/1/1930 and was admitted on 1/1/2011 and discharged on 1/10/2011 the birthdate could be randomly chosen as 5/5/1920 and the other dates would be 5/5/2001 and 5/14/2001. The age at admission and length of stay would be the same. Would this be reasonably deidentified?
Also, one other question. If the client has a list of patients with their birthdates in an excel spreadsheet (no other information), would that data be considered PHI? My client says yes, but that doesn't make sense because no medical information is tied to those names.
Thanks for your input!