What is the difference between de-identified and anonymized data, and when is authorization or consent still required for using de-identified data?

What is the difference between de-identified and anonymized data, and when is authorization or consent still required for using de-identified data?

• A. De-identified data can potentially be re-identified; anonymized data cannot be linked to individuals. If data originated from a HIPAA-covered entity or if re-identification remains possible, authorization or waivers may be required; fully anonymized data may not require consent
• B. De-identified data cannot be re-identified
• C. Anonymized data can be re-identified
• D. Consent is always required for de-identified data.

Answer: (A)

Understanding de-identification versus anonymization helps explain data use rules. De-identified data means identifiers have been removed or masked, but a pathway to identify the person can still exist if someone obtains the right information or the key. Anonymized data, on the other hand, is treated as no longer linkable to any individual, and re-identification is not feasible. In practice, under HIPAA rules, if data came from a covered entity or if there remains a realistic possibility of re-identification, authorization or a waiver may be required to use that data. When data are truly anonymized and cannot be linked to people, there is typically no need for patient authorization or consent. The statement captures this nuance: de-identified data can potentially be re-identified; anonymized data cannot be linked to individuals; authorization or waivers may be required in cases where re-identification remains possible or the data originate from a HIPAA-covered entity; fully anonymized data may not require consent. The other options misstate the re-identification risk or the consent requirement: de-identified data cannot be re-identified is incorrect, anonymized data can be re-identified is incorrect, and consent is always required for de-identified data is incorrect.

Understanding de-identification versus anonymization helps explain data use rules. De-identified data means identifiers have been removed or masked, but a pathway to identify the person can still exist if someone obtains the right information or the key. Anonymized data, on the other hand, is treated as no longer linkable to any individual, and re-identification is not feasible.

In practice, under HIPAA rules, if data came from a covered entity or if there remains a realistic possibility of re-identification, authorization or a waiver may be required to use that data. When data are truly anonymized and cannot be linked to people, there is typically no need for patient authorization or consent. The statement captures this nuance: de-identified data can potentially be re-identified; anonymized data cannot be linked to individuals; authorization or waivers may be required in cases where re-identification remains possible or the data originate from a HIPAA-covered entity; fully anonymized data may not require consent.

The other options misstate the re-identification risk or the consent requirement: de-identified data cannot be re-identified is incorrect, anonymized data can be re-identified is incorrect, and consent is always required for de-identified data is incorrect.