How to use or disclose PHI for research purposes (continued)
•De-identification
–Remove all 19 identifiers; or
–Statistical Certification – the information may be considered de-identified, if an independent, qualified statistician:
a.Determines that the risk of re-identification of the data, alone or in combination with other data, is very small; and
b.Documents the methods and results by which the health information is de-identified, and the expert makes his/her determination of risk. Note: the expert may not be the researcher or anyone directly involved in the research study.