"Anonymized" means that all of the links between a person and the person's record have been irreversibly broken so that it would be virtually impossible to re-establish any of the people in the original record.
The biggest difference between de-identification and anonymization is that in the former you can get permission to re-identify the patient from the de-identified record, so long as you have IRB (Institutional Review Board) approval. The re-identification method may be as simple as having a confidential list assigning de-identified records back to the original human subjects. There are many possible protocols that might be approved by an IRB that would permit re-identification of de-identified records.
There's no re-identification of anonymized records, because the links back to the subjects are irreversibly broken (by any one of a variety of approved anonymization methods).
What is the legal significance of this difference between "de-identification" and "anonymization"
In the U.S., two federal regulations control the use of medical records and human tissues in biomedical research: The Common Rule (Title 45 Code of Federal Regulations, Part 46, Protection of Human Subjects) and the Standards for Privacy of Individually Identifiable Health Information, Final Rule (usually referred to under the broader act, the Health Insurance Portability and Accountability Act, HIPAA)
The Common Rule sets the basic principles for protecting patients from research risks, mandating the activities of Institutional Review Boards, and using human tissues in support of medical research. It is essential reading for anyone involved in human subject research. The Common Rule also regulates the use of tissues and related records in biomedical research.
Department of Health and Human Services.45 CFR (Code of Federal Regulations), 46. Protection of Human Subjects (Common Rule). Federal Register, Volume 56, p. 28003-28032, June 18, 1991.
You can think of HIPAA as the regulation that pertains to electronic documents. HIPAA provides a list of 18 types of so-called "safe harbor" identifers that,if removed from records, would constitute de-identificaiton.
Department of Health and Human Services. 45 CFR (Code of Federal Regulations), Parts 160 through 164. Standards for Privacy of Individually Identifiable Health Information (Final Rule). Federal Register, Volume 65, Number 250, Pages 82461-82510, December 28, 2000.
If you're banking tissues, you need to follow both HIPAA and the Common Rule (in the U.S.).
Well, the Common Rule doesn't work in the realm of de-identification. The Common Rule works in the realm of anonymization. To get paragraph E4 exemption (from IRB approval) for tissue work, you need to be using anonymized records and tissues. De-identified records won't do the trick.
This means that if you're exempted from HIPAA because you've de-identified your records, you may still need to get IRB approval for tissue-related activities that fall under the Common Rule because de-identification falls short of the anonymization (so-called e4 exemption) needed for IRB exemption under the Common Rule.
In June, 2014, my book, entitled Rare Diseases and Orphan Drugs: Keys to Understanding and Treating the Common Diseases was published by Elsevier. The book builds the argument that our best chance of curing the common diseases will come from studying and curing the rare diseases.
I urge you to read more about my book. There's a generous preview of the book at the Google Books site. If you like the book, please request your librarian to purchase a copy of this book for your library or reading room.
- Jules J. Berman, Ph.D., M.D.
