{"id":777,"date":"2018-05-08T11:50:43","date_gmt":"2018-05-08T11:50:43","guid":{"rendered":"https:\/\/az.research.umich.edu\/medschool\/document\/de-identified-data-sets\/"},"modified":"2026-02-23T11:29:48","modified_gmt":"2026-02-23T16:29:48","slug":"de-identified-data-sets","status":"publish","type":"document","link":"https:\/\/az.research.umich.edu\/medschool\/guidance\/de-identified-data-sets\/","title":{"rendered":"De-identified Data Sets"},"template":"","categories":[24],"tags":[],"content-type":[41],"topic":[45],"update-type":[],"class_list":["post-777","document","type-document","status-publish","hentry","category-institutional-review-boards-irbmed","content-type-guidance","topic-hipaa-protected-health-information"],"acf":{"use_legacy_editor":true,"updated_date":"2020-09-09 22:15:00","update_notice":false,"author":"IRBMED","summary":"<strong>NOTE<\/strong>:\u00a0This page provides\u00a0<a href=\"\/medschool\/guidance\/hipaa\">HIPAA<\/a>-related guidance on \u201c<a class=\"gtip\" href=\"\/medschool\/glossary\/de-identified\">de-identified<\/a> data sets,\u201d applicable\u00a0only\u00a0to data based on\u00a0<a class=\"gtip\" href=\"\/medschool\/glossary\/protected-health-information-phi\">Protected Health Information<\/a>\u00a0(usually medical records). Other\u00a0federal regulations\u00a0enforced by the IRB have\u00a0different\u00a0standards and definitions for \u201cde-identified,\u201d which may impact IRB regulatory status. See heading below \u201cContrast with <a class=\"gtip\" href=\"\/medschool\/glossary\/common-rule-0\">Common Rule<\/a>.\u201d","button_links":null,"related_content":[745,744,855,764,752],"legacy_path":"de-identified-data-sets","legacy_node_id":319,"legacy_related_nids":"285, 284, 416, 306, 293","legacy_content_section":[{"legacy_section_type":"heading","legacy_heading":"Definition","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"A <a class=\"gtip\" href=\"\/medschool\/glossary\/de-identified\">de-identified<\/a> data set is a data set that meets both of the following:\r\n<ul>\r\n \t<li>Does not identify any individual that is a subject of the data.<\/li>\r\n \t<li>Does not provide any reasonable basis for identifying any individual that is a subject of the data.<\/li>\r\n<\/ul>\r\nA dataset is\u00a0<a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/special-topics\/de-identification\/index.html\">de-identified under HIPAA Privacy Rule<\/a>\u00a0by one of the following means:\r\n<ul>\r\n \t<li>Safe Harbor Method<\/li>\r\n \t<li>Expert Determination Method<\/li>\r\n<\/ul>\r\n<a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/special-topics\/de-identification\/index.html#safeharborguidance\">Safe Harbor Method<\/a>\u00a0of removing HIPAA identifiers, which includes\u00a0both\u00a0the following provisions,\r\n<ul>\r\n \t<li>Removal of all\u00a0<a href=\"\/medschool\/guidance\/protected-health-information-phi\">18 elements enumerated in the Privacy Rule<\/a>\u00a0that could be used to identify the individual or the individual's relatives, household members, and employers (when applicable)\r\n<ol class=\"rteindent1\">\r\n \t<li>Name<\/li>\r\n \t<li>Geographic subdivisions smaller than a state.<\/li>\r\n \t<li>All elements of dates (except year) for dates that are directly related to an individual, and all ages over 89 and all elements of dates (including year) indicative of such age<\/li>\r\n \t<li>Telephone numbers<\/li>\r\n \t<li>Fax numbers<\/li>\r\n \t<li>Email addresses<\/li>\r\n \t<li>Social security numbers<\/li>\r\n \t<li>Medical record numbers<\/li>\r\n \t<li>Health plan numbers<\/li>\r\n \t<li>Account numbers<\/li>\r\n \t<li>Certificate or license numbers<\/li>\r\n \t<li>Vehicle identification\/serial numbers, including license plate numbers<\/li>\r\n \t<li>Device identification\/serial numbers<\/li>\r\n \t<li>Universal Resource Locators (URLs)<\/li>\r\n \t<li>Internet protocol (IP) addresses<\/li>\r\n \t<li>Biometric identifiers, including finger and voice prints<\/li>\r\n \t<li>Full face photographs and comparable images<\/li>\r\n \t<li>Any unique identifying number, code, or other similar information.<\/li>\r\n<\/ol>\r\n<p class=\"rteindent1\"><em><strong>Note on #2<\/strong><\/em>: ZIP codes, counties, census tracts, and other equivalents must be removed; the first 3 digits of a zip code may be included in a de-identified data set for an area where more than 20,000 people live. Many levels of geographic identifiers are permitted in a <a href=\"\/medschool\/guidance\/limited-data-sets\">Limited Data Set<\/a><\/p>\r\n<p class=\"rteindent1\"><em><strong>Notes on #3<\/strong><\/em>: Many records contain dates of service or other events that imply age. Elements of dates that are not permitted in a HIPAA-de-identified dataset include the day, month, and any other information that is more specific than the year of an event. For instance, \"January 1, 2009\" and \"January 2009\" are both considered to contain PHI.<\/p>\r\n<p class=\"rteindent1\">Not only birth or death dates, but also dates of service (appointment, biopsy, surgery, etc.) are considered dates \u201cdirectly related to the individual.\u201d<\/p>\r\n<p class=\"rteindent1\">Dates\u00a0are permitted in a <a href=\"\/medschool\/guidance\/limited-data-sets\">Limited Data Set<\/a>.<\/p>\r\n<p class=\"rteindent1\"><strong><em>Note on #18: <\/em><\/strong>According to OCR <a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/special-topics\/de-identification\/index.html#safeharborguidance\">Guidance on Satisfying the Safe Harbor Method<\/a>, examples include<\/p>\r\n\r\n<ul>\r\n \t<li>identifying number - study-specific subject identification numbers,<\/li>\r\n \t<li>identifying code - barcodes designed to be unique for each patient for tracking purposes<\/li>\r\n \t<li>identifying characteristic - anything that distinguishes an individual and allows for identification; this may also be called an \u201cindirect identifier.\u201d<\/li>\r\n<\/ul>\r\n<\/li>\r\n \t<li>The\u00a0<a class=\"gtip\" href=\"\/medschool\/glossary\/covered-entity\">covered entity<\/a>\u00a0or its workforce, e.g., the <a class=\"gtip\" href=\"\/medschool\/glossary\/principal-investigator-pi\">principal investigator<\/a>, has no actual knowledge that the remaining information could be used alone or in combination with other information to identify the individual who is the subject of the information<\/li>\r\n<\/ul>\r\n<a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/special-topics\/de-identification\/index.html#guidancedetermination\">Expert Determination Method<\/a>\u00a0based on statistical analysis. In order to be considered de-identified under this method, an individual with knowledge of and experience with generally accepted statistical and scientific methods for rendering information not individually identifiable must provide certification that the data is de-identified.\u00a0 When making such a determination, the individual should find that the <a class=\"gtip\" href=\"\/medschool\/glossary\/risk\">risk<\/a> is very small that the information could be used (either alone or in combination with other reasonably available information) to identify any individual who is a subject of the data.\u00a0 Additionally, the methods and results of the analysis must be documented, and retained by the principal investigator to provide to the covered entity upon request.\r\n\r\nRefer also to Michigan Medicine <a href=\"https:\/\/michmed-administration.policystat.com\/policy\/6508847\/latest\/\">Policy 01-04-340<\/a>\u00a0<em>(level-2 login required)<\/em>\u00a0on De-identification and Re-identification of <a class=\"gtip\" href=\"\/medschool\/glossary\/protected-health-information-phi\">Protected Health Information (PHI).<\/a>","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"Creating a De-Identified Data Set","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"Michigan Medicine\u00a0<a href=\"https:\/\/michmed-administration.policystat.com\/policy\/11720794\/latest\/\">Policy\u00a001-04-340<\/a>\u00a0<em>(level-2 login required)<\/em>\u00a0permits its workforce to create de-identified data sets for research purposes. Before accessing the PHI, researchers should seek a determination from the IRB to confirm appropriate de-identification by filling out an\u00a0<a href=\"https:\/\/az.research.umich.edu\/medschool\/informational\/eresearch-regulatory-management-errm\">eResearch Regulatory Management<\/a>\u00a0(eResearch or eRRM) application.","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"Research Involving a De-identified Data Set","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"Researchers intending to obtain an already-de-identified data are encouraged but not required to seek a determination from the IRB by filling out an\u00a0<a href=\"https:\/\/az.research.umich.edu\/medschool\/guidance\/eresearch-regulatory-management-errm\">eResearch Regulatory Management<\/a>\u00a0(eResearch or eRRM) application for \u201cActivities not regulated as human subjects research.\u201d\r\n<ul>\r\n \t<li>Health information that has been properly\u00a0de-identified according to HIPAA Privacy Rule\u00a0is not considered to be\u00a0PHI.<\/li>\r\n \t<li>Research on non-identifiable information, or on <a class=\"gtip\" href=\"\/medschool\/glossary\/coded\">coded<\/a> private information where the researchers\u00a0never\u00a0have access to \u201cre-identify,\u201d does not qualify as \u201cresearch involving <a class=\"gtip\" href=\"\/medschool\/glossary\/human-subject-0\">human subjects<\/a>\u201d per\u00a0<a href=\"https:\/\/www.hhs.gov\/ohrp\/regulations-and-policy\/guidance\/research-involving-coded-private-information\/index.html\">OHRP Guidance.<\/a><\/li>\r\n \t<li>U-M Human Research Protections Program does not require formal IRB determination for\u00a0activities falling outside the definitions of \u201cresearch involving human subjects\u201d (<a href=\"https:\/\/research-compliance.umich.edu\/operations-manual-contents-page\">HRPP Operations Manual<\/a> Part 4.V)<\/li>\r\n<\/ul>\r\nIf you are sharing data outside U-M, open an \"Outgoing DUA\" <a href=\"http:\/\/orsp.umich.edu\/unfunded-agreement-types\">Unfunded Agreement (UFA)<\/a>\u00a0form in\u00a0<a href=\"http:\/\/eresearch.umich.edu\">eResearch<\/a>\u00a0Proposal Management (<a href=\"http:\/\/www.umich.edu\/~eresinfo\/pm.html\">eRPM<\/a>). The Medical School Office of Research <a href=\"https:\/\/medresearch.umich.edu\/office-research\/about-office-research\/our-units\/data-office-clinical-translational-research\/data-biospecimen-sharing\">Data &amp; Biospecimen<\/a> sharing expects a formal DUA for external sharing of any individual-level clinical data, even if de-identified.\r\n\r\nIf you are receiving a dataset from an outside entity that requires a formal DUA, use the \u201cincoming DUA\u201d <a href=\"http:\/\/orsp.umich.edu\/unfunded-agreement-types\">Unfunded Agreement (UFA)<\/a>\u00a0 in\u00a0<a href=\"http:\/\/eresearch.umich.edu\/\">eResearch<\/a>\u00a0Proposal Management (<a href=\"http:\/\/www.umich.edu\/~eresinfo\/pm.html\">eRPM<\/a>). DUAs may not be required for HIPAA-de-identified data.","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"Retaining a Code to Permit Re-identification","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"<a class=\"gtip\" href=\"\/medschool\/glossary\/hipaa\">HIPAA<\/a>\u00a0<a href=\"https:\/\/privacyruleandresearch.nih.gov\/pr_08.asp#8a\">Privacy Rule permits<\/a>\u00a0a covered entity or its workforce to assign to, and retain with, de-identified health information a code or other means of record identification\u00a0<strong>if<\/strong>\u00a0that code\r\n<ol>\r\n \t<li>is not derived from or related to the information about the individual,\u00a0<strong>and<\/strong><\/li>\r\n \t<li>could not be translated to identify the individual.<\/li>\r\n<\/ol>\r\nThe covered entity\u00a0<strong>may not<\/strong>\u00a0use or disclose the code or other means of record identification\u00a0<strong>for any other purpose<\/strong>\u00a0than re-identification, and may not disclose its method of re-identifying the information.\r\n\r\nA table showing data elements\u00a0<strong>permitted<\/strong>\u00a0in\u00a0de-identified data and limited data sets\u00a0is available through the References section of\u00a0<a href=\"https:\/\/michmed-administration.policystat.com\/policy\/11720792\/latest\">UMHS Policy 01-04-032<\/a>\u00a0<em>(level-2 login required)<\/em>\u00a0on Limited Data Sets.","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"Contrast with Common Rule","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"Under the <a href=\"https:\/\/www.hhs.gov\/ohrp\/regulations-and-policy\/regulations\/45-cfr-46\/index.html\">Common Rule<\/a>\u00a0a dataset is \u201cde-identified\u201d\u00a0<strong>only<\/strong>\u00a0when\u00a0<strong>no one<\/strong>\u00a0could \u201cre-identify\u201d the data:\u00a0<strong>not<\/strong>\u00a0the recipients,\u00a0<strong>nor<\/strong>\u00a0the data provider,\u00a0<strong>nor<\/strong>\u00a0anyone else. If the data were \u201c<a class=\"gtip\" href=\"\/medschool\/glossary\/coded\">coded<\/a>,\u201d any \u201ckey to the code\u201d must\u00a0be\u00a0<strong>destroyed<\/strong>\u00a0to \u201cde-identify\u201d the dataset.\r\n\r\nThe Common Rule does\u00a0<strong>not<\/strong>\u00a0recognize as \u201cde-identified\u201d information that retains a code to permit re-identification: rather, this is \u201ccoded\u201d information which is \u201cindirectly identifiable.\u201d Therefore, a dataset can be \u201cidentifiable\u201d under Common Rule definitions while also meeting <a class=\"gtip\" href=\"\/medschool\/glossary\/hipaa\">HIPAA<\/a> \u201cde-identified\u201d criteria.","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"See Also","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"<ul>\r\n \t<li>IRBMED Guidance on <a href=\"https:\/\/az.research.umich.edu\/medschool\/guidance\/federal-exemption-categories\">Federal Exemption 4<\/a><\/li>\r\n \t<li><a href=\"https:\/\/hrpp.umich.edu\/u-mic\/\">U-MIC<\/a>\u00a0IRB Board Tip:\u00a0Anonymous, Coded, and De-identified Data in Human Subjects Research<\/li>\r\n \t<li>HRPP\u00a0<a href=\"https:\/\/hrpp.umich.edu\/irb-health-sciences-and-behavioral-sciences-hsbs\/irb-application-process\/data-security-guidelines\/\">Data Security Guidelines<\/a>, heading \"Key Definitions\"<\/li>\r\n \t<li>UMHS Policies on\u00a0<a href=\"https:\/\/michmed-administration.policystat.com\/search\/?q=hipaa\">HIPAA Privacy and Security<\/a> <em>(level-2 login required)<\/em><\/li>\r\n \t<li>OHRP\u00a0<a href=\"https:\/\/www.hhs.gov\/ohrp\/regulations-and-policy\/guidance\/research-involving-coded-private-information\/index.html\">Guidance on Research Involving Coded Private Information or Biological Specimens<\/a>, heading \u201cComparison to the HIPAA Privacy Rule\u201d<\/li>\r\n \t<li>OCR\u00a0<a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/special-topics\/de-identification\/index.html\">Guidance Regarding Methods for De-identification of Protected Health Information<\/a><\/li>\r\n<\/ul>","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null}],"update_notice_type":[],"update_notice_start":"","update_notice_end":"","update_notice_text_blocks":null,"global_contact_block":false,"contact_name":"","contact_email":"","contact_additional_info":"Contact us at\u00a0<a href=\"mailto:irbmed@umich.edu?subject=Question%20from%20Research%20A-Z\">irbmed@umich.edu<\/a>\u00a0or 734-763-4768 \/ (Fax 734-763-1234)\r\n\r\n2800 Plymouth Road, Ann Arbor, MI 48109-2800\r\n\r\n<p>A <a href=\"https:\/\/medresearch.umich.edu\/office-research\/about-office-research\/our-units\/institutional-review-boards-irbmed\/irbmed-contacts-roster#irbmed-staff\">list of IRBMED staff<\/a> is available at our website.<\/p>\r\n\r\nEdited By: <a href=\"mailto:larkspur@umich.edu\">larkspur@umich.edu<\/a>\r\nLast Updated: February 23, 2026 11:30AM","global_contact_block_select":null},"_links":{"self":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/777","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document"}],"about":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/types\/document"}],"version-history":[{"count":1,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/777\/revisions"}],"predecessor-version":[{"id":1888,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/777\/revisions\/1888"}],"acf:post":[{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/752"},{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/764"},{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/855"},{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/744"},{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/745"}],"wp:attachment":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/media?parent=777"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/categories?post=777"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/tags?post=777"},{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/content-type?post=777"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/topic?post=777"},{"taxonomy":"update-type","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/update-type?post=777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}