Can someone explain or walk me through the steps on how to de-identify the data in access. I am using access through myResearch on a Mac. Please share. Thank you!
Hi Pallavi. There's no single technical procedure for de-identifying data in an Access database. It just takes care & judgment.
- See whether you have personal identifiers in your Access database. I'm sure you know what these are from HIPAA trainings, but as a reminder - it's not just names, DOBs, SSNs, addresses, etc., but MRNs and even clinical dates. (And take care with free-text fields, where clinicians may sometimes write carelessly e.g. "Mr. Senyak was in good spirits today....")
- If you don't have any patient identifiers, congratulations - you're done.
- If you do have identifiers, make a copy of your Access database and start cleaning up the copy for submission.
- For the purposes of the final project, don't simply erase the contents of identifier fields - instead, put in made-up data so your section leader can see how the database works.
- If you're deidentifying a real Access database for genuine research, you will probably want to use date shifting. Often (especially in longitudinal studies) you're interested in the exact intervals between two dates (say, an intial exam date and a follow-up exam date). In date shifting, when you export your data for somebody who isn't authorized to see PHI, you shift all of the dates *for a given subject* forward or back by some random interval (say +/- 0-365 days). That way, all the intervals are still correct, but the dates given are not exact and therefore not PHI. *You don't have to use date shifting for the final project, but do make sure that you don't give your section leader genuine clinical dates, which are PHI.*
- For the final project, you only need a small number of records (enough to demonstrate how your system works, including one-to-many relationship), so hopefully it's easy enough just to enter entirely made-up data, if that's the quickest approach.
- See whether you have personal identifiers in your Access database. I'm sure you know what these are from HIPAA trainings, but as a reminder - it's not just names, DOBs, SSNs, addresses, etc., but MRNs and even clinical dates. (And take care with free-text fields, where clinicians may sometimes write carelessly e.g. "Mr. Senyak was in good spirits today....")
- If you don't have any patient identifiers, congratulations - you're done.
- If you do have identifiers, make a copy of your Access database and start cleaning up the copy for submission.
- For the purposes of the final project, don't simply erase the contents of identifier fields - instead, put in made-up data so your section leader can see how the database works.
- If you're deidentifying a real Access database for genuine research, you will probably want to use date shifting. Often (especially in longitudinal studies) you're interested in the exact intervals between two dates (say, an intial exam date and a follow-up exam date). In date shifting, when you export your data for somebody who isn't authorized to see PHI, you shift all of the dates *for a given subject* forward or back by some random interval (say +/- 0-365 days). That way, all the intervals are still correct, but the dates given are not exact and therefore not PHI. *You don't have to use date shifting for the final project, but do make sure that you don't give your section leader genuine clinical dates, which are PHI.*
- For the final project, you only need a small number of records (enough to demonstrate how your system works, including one-to-many relationship), so hopefully it's easy enough just to enter entirely made-up data, if that's the quickest approach.