Healthcare IT
1. How safe do you think the “safe harbor” of HIPAA’s 18 fields is? Why?

There are two approaches towards HIPAA-compliant de-identification of PHI. These are expert determination and safe harbor (U.S. Department of Health and Human Services - HHS, 2018). In essence, safe harbor, which this section will concern itself with, has got to do with the removal of certain identifiers from the data set. In this case, a total of 18 “identifiers of the individual or of relatives, employers, or household members of the individual, are removed” (HHS, 2018). A key advantage of safe harbor is its simplicity. This is more so the case given that its implementation does not call for any technical or specialized knowhow. Its application is rather straightforward. It is important to note that even the removal of the said identifiers does not result in the total elimination or removal of the patient re-identification risk.

One of the key disadvantages of safe harbor is that except under very few circumstances, the safety of data is actually not guaranteed. This effectively means that the risk of re-identification happens to be rather high in some instances. For instance, assume a scenario whereby a public file has met the safe harbor standard but there is an ‘intruder’ who happens to know of a specific person in the data. All that the said intruder would have to do is retrieve the data set (which, by the way, satisfies the conditions of safe harbor) and fish for specific identifiers in relation to the person he is interested in. In this case, we could assume that the data set contains the first three ZIP code digits and ages (in years). All that the intruder has to do in this case is be certain of the age of his person of interest and perhaps where he resides to positively identify the record associated with the said person of interest. This is just one example of an instance whereby re-identification would happen with relative ease.

2. What do you think is the right balance between “patient’s privacy” and “public good”? Why?

It is important to note that some researchers have in the past argued that data protection laws could effectively impede the research process because in some instances they essentially make access to data a complex process for researchers (Steeves, 2007). A good example in this case, according to the author, would be the requirement to obtain consent. On this front, it becomes “difficult for researchers to access data that would otherwise be available to them”...…to enhance the safety of ePHI cannot be overstated.

To begin with, firewalls would come in handy in this regard. Firewalls seek to ensure that the network is cushioned against attacks by external parties. According to O’Dowd (2019), “firewalls are the first line of defense for securing healthcare network against the public internet.” As the author further points out, firewalls constantly monitor traffic (both outgoing and incoming) and thus only permit data that is pre-cleared to go through. Secondly, hard drives could also be encrypted. This move would effectively minimize data access by third parties if the said third parties were to gain physical access to hard drives used to store patient information and other related data. Thanks to the said encryption, the data contained therein cannot be read. Third, a two-factor authentication mechanism could be adopted with an intention of ensuring that security is extended beyond the basic combination of password and username. With two-factor authentication, the user can be verified via an additional method. A key component of this identification mechanism is the need for users to make use of a second factor, i.e. finger print scan or code set to phone, to identify themselves. This protects PHI from access by persons able to ‘beat’ the first line of defense, i.e. username and…