There is a HIPAA rule that states that listing a birth year that makes a person 90 years old or older is considered to be PHI. We want to host deidentified datasets in our Atlas instance, but I’m having trouble finding guidance on how to conform the birth years for people in the Persons table so that I am not in violation of HIPAA. Has anyone else run into this problem, and if so, how should we resolve it?
1 Like
You mean you don’t want a bunch of Benjamin Buttons? 
@MNairn has tackled this with our IQVIA data. She can tell you what we do. It’s not elegant per say but it’s what worked for our rule set.
1 Like
Hello @mnlubke,
We have two versions of our OMOP CDM: a “PHI” version for those with appropriate IRB approvals, and a second “de-identified” version for preliminary or exploratory analyses. I suspect many other organizations do as well.
For the de-identified version, we are using @hripcsa and colleagues’ Shift-and-Truncate (SANT) method, as described in their excellent 2016 paper in JAMIA (Preserving temporal relations in clinical data while maintaining privacy).
For elderly patients specifically, we shift their birth dates with the same random date-shift value as their other clinical event dates, but we then also shift their birth dates annually by 1 year on their date-shifted birthdays to ensure they always appear to be 89 years old.
2 Likes
We’ve been using the shift and truncate method as well, so all the dates are already shifted. But to clarify what you’re saying here, are you saying that for all patients aged 89+, you’re just instead marking their ages/birth years so that they are 89? You aren’t touching the birth years for all other people then, I assume, correct?
Yes, @mnlubke, that is correct.
Let’s assume someone was born on April 22, 1920. For this patient, we randomly generate a date-shift value of 229 days, and shift all of her dates – including her birthday – by this duration. Her date-shifted birthday is now December 7, 1920.
On December 7, 2010, this patient turns 90 years old in date-shifted time. On this day, we shift the patient’s birthday forward by 1 year to December 7, 1921. Now the patient appears to be 89 years old in date-shifted time.
On December 7, 2011, this patient turns 90 years old again in date-shifted time. We repeat the procedure: move the patient’s birthday forward by 1 year to December 7, 1922. Magically, the patient is 89 years old again in date-shifted time.
We continue to shift elderly patients’ dates of birth forward by 1 year annually on their date-shifted birthdays.
The birthdays of all patients under the age of 90, in date-shifted time, are not changed.