Privacy, Security, and Regulatory Compliance
What the exam tests
Privacy, security, and regulatory compliance tests HIPAA Privacy and Security Rules, breach notification, de-identification, authorization, minimum necessary, research ethics, and applicable trial regulations. Know the difference between use and disclosure permissions, safeguards, and documentation.
Core rules
- HIPAA permits treatment, payment, and operations without authorization; research generally needs authorization, waiver, or de-identified or limited data.
- Safe Harbor removes 18 identifiers, including dates except year and ZIP codes beyond the first three digits; expert determination requires a qualified statistical analysis.
- The Security Rule requires administrative, physical, and technical safeguards, risk analysis, access control, audit controls, integrity, and transmission security.
- Minimum necessary applies to uses and disclosures, with exceptions such as treatment.
- 21 CFR Part 11 and ICH-GCP govern electronic records and trial conduct where applicable.
Worked example
A researcher requests admission dates and full ZIP codes. Under Safe Harbor, those are identifiers, so the dataset is not de-identified. Options: remove or generalize dates and ZIPs; obtain IRB-approved authorization or waiver; use a limited data set with a data use agreement; or use expert determination. The reasoning: de-identification is a legal and statistical status, not merely removing names. Document the method and re-identification risk.
Traps
- Calling data anonymous because direct identifiers were removed.
- Treating encryption as optional for mobile devices and portable media.
- Using consent and authorization as synonyms in HIPAA contexts.
- Sharing a limited data set without a data use agreement.