Health Sciences IRBs KnowledgeBase

Frequently Asked Question

De-identified data: refers to data that have been stripped of all subject identifiers, including all 18 HIPAA identifiers.  This means that there can be no data points that are considered limited identifiers under HIPAA, i.e. geographic area smaller than a state, elements of dates (date of birth, date of death, dates of clinical service), and age over age 89.  If the data set contains any limited identifiers, it is considered a limited data set under HIPAA.  If the data includes an indirect link to subject identifiers (e.g. via coded ID numbers), then the data is considered by the IRB to be coded, not de-identified. 

Please note that data can be considered de-identified under the Common Rule but NOT the HIPAA Privacy Rule (Identifiability and the Common Rule: Guidance ).

Anonymous data: essentially the same thing as de-identified data, this refers to data that have been stripped of all subject identifiers and that have no indirect links to subject identifiers.  There should be no limited identifiers in anonymous data set.

Coded data: this refers to data that have been stripped of all direct subject identifiers, but in this case each record has its own study ID or code, which is linked to identifiable information such as name or medical record number.  The linking file must be separate from the coded data set.  This linking file may be held by someone on the study team (e.g. the PI) or it could be held by someone outside of the study team (e.g. researcher at another institution). A coded data set may include limited identifiers under HIPAA.  Of note, the code itself may not contain identifiers such as subject initials or medical record number. 

For guidance on whether research with coded information or samples requires IRB review, please see this FAQ: Does my research with coded information or specimens require IRB review? .