I.  PURPOSE
 

To protect the privacy of client Protected Health Information (PHI) by removing information that is individually identifiable when it is not necessary for the intended purpose of the use or disclosure.

To establish a requirement for de-identification and re-identification of PHI, as well as the creation and use of limited data sets.
 

II.  DEFINITIONS
 

No definitions are associated with this policy.
 

III.  POLICY
 

It is the policy of the Department of Mental Health (DMH) to set forth requirements for de-identification and re-identification of PHI. PHI is de-identified when the identifiers listed in Procedure Section A.1. have been removed and there is no reasonable basis to believe the information can be used to identify a person. De-identified information is not PHI.

Unless otherwise restricted or prohibited by other federal or state law, DMH can use and share information as appropriate for the work of DMH, without further restriction, if DMH or another entity has taken steps to de-identify the information consistent with the requirements and restrictions of this policy.

DMH may use or disclose a limited data set that meets the requirements of this policy if DMH enters into a data use agreement with the limited data set recipient (or with the data source, if DMH will be the recipient of the limited data set) in accordance with the requirements of this policy.
 

IV.  PROCEDURES
 

V.  AUTHORITIES
 

Code of Federal Regulations Title 45 Section 164.514(a)(c)(e), Other Requirements Relating to Uses and Disclosures of Protected Health Information
Code of Federal Regulations 45 Section 164.502(d), Uses and Disclosures of Protected Health Information: General Rules – Uses and Disclosures of De-Identified Protected Health Information
 

VI.  ATTACHMENT
 

Data Use Agreement