De-Identified Data Request With Dates and Rare Diagnoses

No. Safe Harbor is a specific checklist, not a general 'we removed names' standard. Free-text notes are not de-identified merely because names were removed elsewhere; the notes themselves contain clinician and family member names and must be scrubbed or removed. Device serial numbers are explicitly listed identifiers under Safe Harbor. Three-digit ZIP codes are permitted only when the geographic unit contains more than 20,000 people and the three digits are not in restricted ranges; a ZIP3 containing one registry patient fails that condition. Date shifting is not a Safe Harbor method; Safe Harbor requires removal of dates except year, so shifted dates require expert determination. The pathogenic variant is not named in the Safe Harbor list, but a rare variant in a small cohort can be highly identifying, and the registry may have actual knowledge that the combination identifies individuals. The 90+ aggregation is appropriate but does not cure the other features. The dataset therefore is not de-identified under Safe Harbor and should not be released on that basis.

Use either expert determination or a limited data set with a DUA, and in either case reduce the data first. Remove free-text notes entirely or de-identify them with validated scrubbing and manual review; remove device serial numbers or replace them with a non-linkable device category. Collapse ZIP3 to state or suppress the single-patient ZIP; consider removing geographic detail altogether. Replace the specific variant with a gene-level or functional category, or obtain explicit authorization for genetic data as state law requires. Complete an expert-determination analysis that documents the anticipated recipient, the data elements, and the risk of identification, and obtain IRB approval or exemption. The DUA should prohibit re-identification, external linkage, and onward sharing, and should specify retention, destruction, security, and breach notification. Apply minimum-necessary review so that dates are released only if the research question requires them. If dates are essential, use a limited data set with a DUA rather than claiming Safe Harbor. Document the risk assessment and the committee's decision.

Decline the linkage as proposed. A voter file contains names, addresses, and other public identifiers; linking it to a rare-disease registry with dates, ZIP3, age, sex, and a pathogenic variant creates a substantial re-identification risk, especially when one ZIP3 contains a single patient. The stated purpose, market analysis, is not the purpose for which the registry collected the data, and it is not covered by the research DUA or the consent under which patients contributed genetic information. State genetic-data authorization does not permit this use. Even if the sponsor argues that the voter file is public, combining public data with registry data is precisely the re-identification pathway that governance is meant to control. Offer a lawful alternative: aggregate, non-linkable market analyses, or a separate request limited to de-identified summary statistics with small-cell suppression. If the sponsor insists, require a new protocol, IRB review, patient authorization where required, and an expert determination that specifically evaluates the linkage. The committee should record the refusal and the rationale.