This course is aimed as an introduction to de-identification and privacy risk assessment. The course consists of two lessons: “Introduction to HIPAA Privacy & De-Identification” and “Understanding Direct and Indirect Identifiers”. If the basics covered by the two lessons in this course are well understood, then individuals can proceed directly to courses 2 or 3 as applicable. Courses 2 and 3 are coming soon! Anticipated release in January 2025.

The intended audience for this training is state, territorial, local, and/or tribal (STLT) Applied Epidemiologists, Statisticians, Analytical Staff or similar individuals.

All content was developed and delivered by Dr Colin Moffatt, Dr Daniel Barth-Jones PhD, MPH and Dr James Janisse PhD.

By the end of the course, learners will be able to: 

• Identify the main principles of HIPAA Privacy Rule and how they apply to the public health field, including definitions of key terms and requirements. 
• Summarize the ethical, legal and regulatory reasons for de-identification. 
• Identify situations where combinations of variables could present re-identification risk and correctly describe how these risks can be mitigated. 

Lesson 1: Introduction to HIPAA Privacy & De-Identification

By the end of the lesson, participants will be able to:

1. Discuss the ethical, and legal/regulatory reasons for de-identification. 
2. Define "de-identification" under the Health Insurance Portability and Accountability Act (HIPAA) privacy rule. 
3. Identify how stastical disclosure control and de-identification methods can protect individual's privacy and confidentiality and increase public trust. 
4. Summarize when and how statistical disclosure controls should be applied in epidemiological public health practice. 
5. Explain the requirements for Safe Harbor and Expert Determination (ED) de-identification under the HIPAA Privacy Rule. 
6. Define HIPAA Limited Data Sets and the required conditions for their use. 

Lesson 2: Understanding Direct and Indirect (Quasi-) Identifiers

By the end of the lesson, participants will be able to:

1. Define what "direct" and "indirect" ("quasi-") identifiers are, and provide common examples of each. 
2. Explain the requirements for remediation of direct and indirect identifiers. 
3. Identify situations in which combining indirect identifiers creates risk. 
4. Summarize high level mitigation strategies to reduce risk. 

This training series was funded by the Council of State & Territorial Epidemiologists (CSTE) (Contract No.: Contract PO8182). The contents of this training are solely the responsibility of the authors and do not necessarily represent the official views of CSTE.

Disclaimer: The information in these training courses has been provided for general informational purposes only and has not been designed to reflect the current law within your own jurisdiction. No information contained in this training course should be construed as legal advice from CSTE, CDC, Privacy Hub, or the individual authors, nor is it intended to be a substitute for legal counsel on any subject matter. Trainees and viewers of this material should not act, or refrain from acting, based on any information included in, or accessible through, these training courses without seeking the appropriate legal or other professional advice on the particular facts and circumstances at issue from a lawyer licensed in your own state, county, territory, or other appropriate jurisdiction. Further, all views and opinions expressed in the content and website are those of the author and do not necessarily represent that of CSTE, CDC and the federal government.

Competencies: 

• 1.1 – Data Analytics and Assessment Skills – Identifies the diversity of individuals and populations 
• 1.3 – Data Analytics and Assessment Skills – Designs surveillance systems using the principles of ethics, DEIA, and justice
• 1.6 – Data Analytics and Assessment Skills – Manages data
• 1.7 – Data Analytics and Assessment Skills – Analyzes data
• 1.8 – Data Analytics and Assessment Skills – Interprets results from data analysis
• 2.3 – Public Health Sciences Skills – Applies public health informatics in using epidemiologic data, information, and knowledge
• 2.4 – Public Health Sciences Skills – Manages information systems to promote effectiveness and security of data collection, processing, and analysis
• 3.2 – Communication Skills – Applies principles of risk communication
• 7.1 – Policy Development and Program Planning Skills – Applies epidemiology to the development of policies, programs, services, and laws
• 7.2 – Policy Development and Program Planning Skills – Evaluates programs, policies, services, laws, and organizational performance
• 7.3 – Policy Development and Program Planning Skills – Engages in organizational strategic planning
• 7.4 – Policy Development and Program Planning Skills – Applies principles of ethical and legal practice to epidemiologic activities, data analysis, assessment, and dissemination
• 7.5 – Policy Development and Program Planning Skills – Advocates for policies and public health actions that improve community health and resilience

Each lesson in this course contains a multiple choice knowledge check at the end of the lesson. Questions provide immediate feedback, and there is no overall passing score required to complete this course.