Avoid blurred lines: data masking and real de-identification are not the same
Often confused, data masking and de-identification are not synonymous terms when it comes to unlocking protected health information (PHI). Data masking looks at direct identifiers (name, email, social security, patient id number) and applies techniques to remove them from the data. Eliminating this type of information seems like a no brainer when it comes to sharing health data for secondary purposes – but what about the rest of the data?
Quasi-identifiers are pieces of information that do not immediately identify an individual, but when combined, can. They include zip/post code, date of birth, diagnostic codes, blood type and more. These fields are also what analysts and researchers are really looking for in shared datasets; they don’t perform analysis on direct identifiers.
The major drawback to using data masking is the lack of risk measurement. Using a risk-based approach to sharing PHI is the only way to ensure the data being released has the lowest level of risk. Measuring the risk enables organizations to stay defensible when sharing data, and worse yet, in the event of a data breach. The fact that many reputable industry organizations, like HITRUST, the Institute of Medicine and PhUSE, are publishing standards that establish a risk measurement as a best practice is a good indication that the de-identification industry is changing.
Our recent white paper, Don’t Blur the Lines between Data Masking and Real De-Identification, is designed to clear up the confusion by describing the true purpose of data masking with a focus on the right techniques to use. It also outlines the wrong techniques and limits of masking, especially when confused with data de-identification. Don’t blur the lines between two very different concepts – blurred lines may cost your organization greatly.
Download Don’t Blur the Lines today!
The post Blurred Lines appeared first on Privacy Analytics.