Need to publicly share your research data per sponsoring agency regulations (such as the NIH Policy for Data Management and Sharing)
Data De-Identification Services
Navigation Sidebar
The Office of the Vice President for Research in conjunction with the Clinical & Translational Science Institute (CTSI) offers a data de-identification service for the University research community. This service helps with the removal or masking of elements in research datasets that contain Protected Health Information (PHI) prior to publicly sharing or publishing the data.
What does de-identified data mean?
De-identified data means that individually identifiable health information (Protected Health Information, or PHI) has been deleted from the research data set. Health information relates to the physical or mental health of an individual, the provision of health care to an individual, or payment for health care. In particular, de-identified data means that all 18 HIPAA Identifiers have been removed, including derivatives such as initials and truncated Social Security numbers. Additionally, the remaining data must not be identifiable, i.e. able to be used alone or in combination with other information to identify an individual. (For example, genetic data or samples devoid of HIPAA identifiers can be used to identify an individual.) The Data De-identification Service can help make this determination.
Once data are de-identified, the data are not considered PHI under the Health Insurance Portability and Accountability Act (HIPAA), so HIPAA’s requirements do not apply. See the University’s HIPAA Policy 30 for more detail.
When is data de-identification needed?
If any of the following scenarios are true, then a research data set containing PHI must be de-identified prior to sharing.
Submitting raw data to journals to support your publication of research results. (See the Office of Human Subject Protection’s Guideline on De-Identification for Publishing for more detail.)
Sharing your data with non-University of Rochester partners without subject authorization, an IRB waiver of authorization, or a Data Use Agreement for limited datasets. See HIPAA Policy 25 and related procedures for more detail.
Data de-identification is a permissible direct cost under the NIH Policy for Data Management and Sharing and researchers are encouraged to and should budget for de-identification in their budget proposals.
Services we offer
- Consultations for de-identification service, up to the first 2 hours, for every individual award are available at no cost to researchers.
- Upon completion of the consultation, an estimate for de-identification will be provided to the requestor.
- After the consultation and the estimate is confirmed, de-identification of data will be performed at a rate of $93.89/ hour. Billing will be initiated once de-identification of a dataset commences.
Contact
Request for service
To request a data de-identification consultation or service, complete the request form. If you have questions, please contact jeanne_wiltse@urmc.rochester.edu.