HIPAA Compliance Checklist for Clinical Reports

HIPAA Compliance Checklist for Clinical Reports

18 HIPAA Identifiers - De-identification Checklist

Verify that ALL of the following identifiers have been removed or altered:

• 1. Names - Patient name, family members, healthcare providers (unless necessary and consented)

• 2. Geographic subdivisions smaller than state

  • No street addresses
  • No cities (unless >20,000 population and part of ZIP can be kept if >20,000)
  • No counties
  • First 3 digits of ZIP code acceptable only if geographic unit >20,000 people
  • All other portions of ZIP codes removed

• 3. Dates (except year)

  • No exact dates of birth (year only acceptable; year of birth for those >89 must be aggregated)
  • No admission dates
  • No discharge dates
  • No dates of service
  • No dates of death
  • Use relative time periods (e.g., "3 months prior") or years only

• 4. Telephone numbers

  • No phone numbers of any kind
  • Including patient, family, provider contact numbers

• 5. Fax numbers

  • No fax numbers

• 6. Email addresses

  • No email addresses for patient or related individuals

• 7. Social Security numbers

  • No SSN or partial SSN

• 8. Medical record numbers

  • No MRN, hospital ID, or clinic numbers
  • Use coded study ID or case number if needed

• 9. Health plan beneficiary numbers

  • No insurance ID numbers
  • No policy numbers

• 10. Account numbers

  • No billing account numbers
  • No financial account information

• 11. Certificate/license numbers

  • No driver's license numbers
  • No professional license numbers (unless for author credentials)

• 12. Vehicle identifiers and serial numbers

  • No license plate numbers
  • No VIN numbers

• 13. Device identifiers and serial numbers

  • No pacemaker serial numbers
  • No implant device serial numbers
  • Generic device description acceptable (e.g., "implantable cardioverter-defibrillator")

• 14. Web URLs

  • No personal websites
  • No URLs identifying individuals

• 15. IP addresses

  • No IP addresses

• 16. Biometric identifiers

  • No fingerprints
  • No voiceprints
  • No retinal scans
  • No other biometric data

• 17. Full-face photographs and comparable images

  • No full-face photographs without consent
  • Crop or blur faces if showing
  • Remove identifying features (jewelry, tattoos, birthmarks if not clinically relevant)
  • Black bars over eyes NOT sufficient
  • Ensure no reflection or background identification

• 18. Any other unique identifying characteristic or code

  • No unique characteristics that could identify individual
  • No rare disease combinations that could identify
  • Consider if combination of remaining data points could identify individual

Additional De-identification Considerations

Ages and Dates

• Patients aged ≤89: Exact age or age range acceptable
• Patients aged >89: Must be aggregated to "90 or older" or ">89 years"
• Dates: Use only years OR use relative time periods
  • Example: "3 months prior to presentation" instead of "on January 15, 2023"
  • Example: "admitted in 2023" instead of "admitted on March 10, 2023"

Geographic Information

• State or country is acceptable
• Removed specific cities (unless population >20,000 and no other identifying information)
• Removed hospital/clinic names
• Use general descriptors: "a community hospital in the Midwest" or "a tertiary care center"

Rare Conditions and Combinations

• Consider if very rare disease alone could identify patient
• Consider if combination of:
  • Age + diagnosis + geographic area + timeframe could identify patient
• May need to be vague about certain unique details
• Balance between providing clinical information and protecting privacy

Images and Figures

• All patient identifiers removed from image headers/metadata
• DICOM data stripped
• Dates removed from images
• Medical record numbers removed
• Faces cropped, blurred, or obscured
• Identifying marks removed or obscured:
  • Tattoos
  • Jewelry
  • Birthmarks or unique scars (if not clinically relevant)
• Scale bars and annotations do not contain identifying information
• Background environment de-identified (room numbers, nameplates, etc.)

Voice and Video

• No audio recordings with patient voice (unless consent obtained)
• No video showing identifiable features (unless consent obtained)
• If video necessary, face must be obscured

Informed Consent Checklist (for Case Reports/Publications)

Consent Requirements

• Informed consent obtained BEFORE publication submission
• Consent obtained from patient directly (if capable)
• If patient deceased or incapacitated, consent from legal representative or next of kin
• For pediatric cases, parental/guardian consent obtained

Consent Form Elements

The informed consent form must include:

• Purpose of publication (education, medical knowledge)
• What will be published (case details, images, outcomes)
• Journal or publication venue (if known)
• Open access vs. subscription (public availability)
• De-identification efforts explained
• Potential for re-identification acknowledged
• No effect on clinical care
• Right to withdraw consent (timing limitations)
• Contact information for questions
• Patient signature and date
• Witness signature (if required)

Consent Documentation

• Signed consent form on file
• Copy provided to patient
• Consent available for editor review
• Statement in manuscript confirming consent obtained

Example statement for manuscript: "Written informed consent was obtained from the patient for publication of this case report and any accompanying images. A copy of the written consent is available for review by the Editor-in-Chief of this journal on request."

Safe Harbor vs. Expert Determination

Safe Harbor Method

• All 18 identifiers removed
• No actual knowledge that remaining information could identify individual
• Most straightforward method
• Recommended for most clinical reports

Expert Determination Method

• Qualified statistician/expert determined very small re-identification risk
• Methodology documented
• Analysis methods specified
• Conclusion documented
• May allow retention of some data elements
• Requires statistical expertise

Method used: [ ] Safe Harbor [ ] Expert Determination

Minimum Necessary Standard

Use and Disclosure

• Only minimum PHI necessary for purpose is used
• Purpose of disclosure clearly defined
• Limited to relevant information only
• Consider de-identified data or limited data set as alternatives

Exceptions to Minimum Necessary

Minimum necessary does NOT apply to:

• Treatment purposes (providers may need full information)
• Patient-authorized disclosures
• Disclosures required by law
• Disclosures to HHS for compliance investigation

Authorization for Use/Disclosure of PHI

When Authorization Required

Authorization needed for:

• Research (unless IRB waiver granted)
• Marketing purposes
• Sale of PHI
• Psychotherapy notes
• Uses beyond treatment, payment, operations (TPO)

Authorization Elements

If authorization required, it must include:

• Specific description of PHI to be used/disclosed
• Person(s) authorized to make disclosure
• Person(s) to receive information
• Purpose of disclosure
• Expiration date or event
• Right to revoke and how
• Right to refuse to sign
• Potential for re-disclosure by recipient
• Patient signature and date

Limited Data Set

Limited Data Set Option

A limited data set removes 16 of 18 identifiers but may retain:

• Dates (admission, discharge, service, birth, death)
• Geographic information (city, state, ZIP code)

Requirements for Limited Data Set

• Data Use Agreement (DUA) required
• DUA specifies permitted uses
• Only for research, public health, or healthcare operations
• Recipient agrees not to re-identify
• Recipient agrees to safeguard data

Security Safeguards Checklist

Administrative Safeguards

• Security management process in place
• Workforce security measures
• Access management (role-based)
• Security training for workforce
• Incident response procedures

Physical Safeguards

• Facility access controls
• Workstation use policies
• Workstation security measures
• Device and media controls
• Secure disposal procedures

Technical Safeguards

• Access controls (unique user IDs, passwords)
• Audit controls and logging
• Integrity controls
• Transmission security (encryption)
• Automatic logoff after inactivity

Breach Notification Checklist

If Unauthorized Disclosure Occurs

• Determine if breach occurred (unauthorized access/use/disclosure)
• Assess risk of harm to individual
• If breach affects <500 individuals:
  • Notify individual within 60 days
  • Report to HHS annually
• If breach affects ≥500 individuals:
  • Notify individuals within 60 days
  • Notify HHS within 60 days
  • Notify media if affects ≥500 in a state/jurisdiction
• Document breach and response
• Implement corrective action

Breach Notification Content

Notification must include:

• Description of breach
• Types of information involved
• Steps individuals should take
• What organization is doing
• Contact for questions

Research-Specific Compliance

IRB/Privacy Board Considerations

• IRB approval obtained (if research)
• HIPAA authorization obtained OR waiver granted
• Waiver justification documented:
  • Minimal risk to privacy
  • Research cannot practically be conducted without waiver
  • Research cannot practically be conducted without PHI
  • Plan to protect identifiers
  • Plan to destroy identifiers when appropriate

Clinical Trial Reporting

• Subject identified by ID number only
• No names in regulatory submissions
• Initials only if required by regulatory authority
• Dates limited to year or relative time
• Protocol includes privacy protections

Special Populations

Pediatric Cases

• Parent/guardian consent obtained
• Child assent obtained (if age-appropriate)
• Extra care with identifiable photos
• School information removed

Deceased Patients

• HIPAA protections apply for 50 years post-death
• Next of kin consent for publication
• Autopsy information de-identified

Mental Health and Substance Abuse

• Extra protections under 42 CFR Part 2
• Explicit consent for disclosure
• Cannot re-disclose without consent

Final Compliance Verification

Reviewed by: ____________________
Date: ____________________
Signature: ____________________

Compliance Status: [ ] Compliant [ ] Needs revision [ ] Not compliant

Issues identified:

1. [Issue]
2. [Issue]

Corrective actions:

1. [Action]
2. [Action]

Re-review required: [ ] Yes [ ] No
Re-review date: ____________________

Documentation to Maintain

Keep on file:

• Signed patient consent (if applicable)
• IRB approval (if research)
• HIPAA waiver (if applicable)
• De-identification verification
• Data use agreement (if limited data set)
• Authorization forms (if applicable)
• Training records for personnel handling PHI
• Audit logs

Retention period: Minimum 6 years per HIPAA requirement