Legal Requirements and Ethical Behavior: The Case of Certifying Statistical Deidentification

• Activity Number: 367
• Type: Invited
• Date/Time: Wednesday, August 11, 2004 : 2:00 PM to 3:50 PM
• Sponsor: Cmte on Professional Ethics
• Author(s): Barbara Bailar*+ and Alvan O. Zarate*+ and Alan Zaslavsky*+ and Laura Zayatz*+
• Companies: NORC, University of Chicago and U.S. National Center for Health Statistics and Harvard Medical School and U.S. Census Bureau
• Keywords: ethics ; privacy ; confidentiality ; deidentification ; HIPAA ; disclosure limitation

Abstract

New federal regulations have been implemented to protect the privacy of health information that identifies individuals. These regulations, in particular the HIPAA (Health Insurance Portability and Accountability Act) Privacy Rule, constrain the use and sharing of health data for research. Researchers may comply with these new regulations by using statistical methods to deidentify the records. "A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable" must certify that there is "small risk" the information could be used to identify the individual who is the subject of the information. Yet, the standard of risk is undefined, the nature of the potential threats is unknown, and the technical issues in deidentifying data and assessing risk are complex. Under these circumstances, what does it mean for a statistician to certify a "small risk"? We bring together experts in the areas of data deidentification methods, health research, and statistical ethics to discuss the practical, legal, and ethical implication of providing such certification.