Minimum Necessary Access for a Research Data Extract
A hospital's research office requests an extract of 50,000 patient records for a retrospective study on diabetes outcomes. The request includes names, MRNs, full dates of service, ZIP codes, and free-text notes. The study team is internal but includes a contracted analyst from a vendor. The IRB approved the study with a waiver of authorization but specified that the dataset be 'limited.' The privacy officer notes the hospital is subject to HIPAA and state law that treats ZIP codes as identifiers. The analyst needs the data on a laptop for two weeks of analysis.
1. What changes would you require before releasing this extract, and why?
Read the worked answer
Apply the minimum necessary principle and the IRB's 'limited dataset' constraint, then reconcile with state law.
Required changes:
- Remove direct identifiers (names, MRNs). Assign a study-specific pseudonymous ID with the crosswalk held separately by the covered entity.
- Reduce dates. Full dates of service plus ZIP plus other fields create re-identification risk. Shift or truncate dates to what the analysis needs (e.g., month/year or relative day offsets), and generalize ZIP to the first 3 digits or remove it. State law treating ZIP as an identifier means HIPAA's limited dataset latitude does not fully apply; follow the stricter rule.
- Free-text notes: these routinely contain names, dates, and identifiers. Either exclude notes or run de-identification with human review; do not release raw notes to a vendor analyst.
- Vendor analyst: execute a business associate agreement, confirm the analyst is trained, and restrict access to the minimum fields.
- Laptop: no PHI on an unmanaged laptop. Require an encrypted, managed device or a secure remote analysis environment, with no local copies and an access log.
Document the justification for each retained field against the study aims.
2. The researcher argues that pseudonymized data is 'de-identified' and therefore unregulated. How do you respond?
Read the worked answer
Correct the misconception precisely. Pseudonymization is not de-identification under HIPAA. A dataset with a re-identification crosswalk held by the covered entity remains identifiable because the entity can re-link it; it is still PHI and still subject to the Privacy and Security Rules.
- True de-identification requires either the Safe Harbor removal of all 18 identifier categories (including ZIP and full dates, which this request retains) or Expert Determination by a qualified statistician documenting very small re-identification risk.
- The IRB waiver of authorization permits research use of PHI but does not convert it to de-identified data; the 'limited' condition constrains the dataset further.
- State law independently treats ZIP as an identifier, so even a HIPAA limited dataset argument fails here.
Practical framing for the researcher: the goal is to meet the study aims with the least identifiable data, not to relabel the data to escape controls. Offer to help scope fields to the analysis so the extract can be smaller and safer without harming the science.