Certification | Maintenance of Certification | Subspecialties

  Home | ABOG Bulletin Board | Contact Us | Find | FAQs

"DE-IDENTIFICATION" OF PATIENT CASE LISTS

General. Pursuant to the Health Insurance Portability and Accountability Act of 1996, (HIPAA), the Secretary of the Department of Health and Human Services has issued a Final Privacy Rule (HIPAA Privacy Rule) governing the terms and conditions on which health care providers can make available "individually identifiable health information". Under the HIPAA Privacy Rule, Candidates would have to obtain the "prior written knowledgeable consent" of their patients before they could release any information concerning those patients which would permit them to be individually identified. The HIPAA Privacy Rule does, however, permit the release of patient information if the information released does NOT permit the patient to be individually identified.

The American Board of Obstetrics and Gynecology has determined that it would be substantially impossible for Candidates seeking certification to obtain prior written knowledgeable consent from all patients who might be included on the patient case lists which the Board requires for its Oral Examinations. Accordingly, the patient lists which Candidates are required to submit for their Oral Examinations MUST BE "DE-IDENTIFIED", that is, Candidates MUST EXCLUDE from the records they submit to the Board such information as could permit the identification of the patient.

De-Identification of Patient Case Lists: Requirements

The HIPAA Privacy Rule specifically enumerates the categories of information which must be removed from patient case lists in order for such case lists to be "de-identified" and thereby become available for submission to the Board.

1. Section 164.514(a) provides, in pertinent part, as follows:

"Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information." [Emphasis added]

2. Section 164.514(b) provides that:

"A covered entity (physician/candidate) may determine that health information is not individually identifiable health information ONLY IF: ***The following identifiers of the individual or of relatives, employers or household members of the individual ARE REMOVED:

a. Names

b. All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the currently publicly available data from the Bureau of the Census:

(1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people, and

(2) The initial three digits of a zip code for all such geographic units contains 20,000 or fewer people is changed to 000.

c. All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;

d. Telephone numbers;

e. Fax numbers;

f. Electronic mail addresses;

g. Social security numbers;

h. Medical record numbers;

i. Health plan beneficiary numbers;

j. Account numbers;

k. Certificate/license numbers;

l. Vehicle identifiers and serial numbers, including license plate numbers;

m. Device identifiers and serial numbers;

n. Web Universal Resource Locators (URLs);

o. Internet Protocol (IP) and address numbers;

p. Biometric identifiers, including finger and voice prints;

q. Full face photographic images and any comparable images; and

r. Any other unique identifying number, characteristic, or codes; except as permitted by paragraph (c) of this Section.

This means that Candidates, when preparing the patient case lists required by the Board, should NOT include ANY of the information specified in Items (a) through (r) above.

3. Finally, Section 164.514(b)(2)(i)&(ii) stipulates that patient information can ONLY be provided to the Board if the "covered entity (physician/candidate) does not have actual knowledge that the information (provided to the Board in the patient case lists) could be used alone or in combination with other information to identify an individual who is the subject of the information".

Summary

When a candidate prepares the required patient case lists, it is the responsibility of the candidate to do so in accordance with the requirements listed previously. Specificially, the information listed in Section 2. a. through r. above must not be included in the list. Failure to prepare a list in accordance with these rules may result in the candidate not being allowed to sit for the oral examination.

WARNING

The de-identification of patient case lists does not sanction the omission of any cases involving patients under the candidate's care. The completeness of the candidate's case list is subject to audit and the Board has identified and implemented various audit procedures which are consistent with the HIPAA privacy rule. Any effort to use the HIPAA privacy rule to mislead the Board as to the breadth and depth of the candidate's practice, the numbers of patients or the outome of their treatment will subject the candidate to disqualification from examination and other discipline as appropriate.

Next: Oral Examination Requirements

Back to the Top

Resources for:

  Candidates | Diplomates | The Public | Medical Organizations