Take the 2-minute tour ×
Healthcare IT Stack Exchange is a question and answer site for healthcare IT professionals and solution providers. It's 100% free, no registration required.

Imagine you are designing a system that's comprised of overdue worklists for doctors (e.g., Doctor X you have 3 overdue studies to look at). In the notification, you identify the studies they have to review by their accession number / CPT code / date of service, so that the doctor can see what studies they are missing (in case they disagree that they have three overdue studies).

Could that accession number / service / date of service be included in an email that may be sent or forwarded to a non-hospital system?

On the one hand, knowledge of the accession number+service+date, does not let you identify any patient (so I would say no) or the results of the study without additional information.

On the other hand, each accession number is tied to only one individual, so it is the type of PHI that is typically removed when anonymizing data for say research purposes.


migrated to security.stackexchange.com by jonsca May 1 '12 at 11:15

This question belongs on our site for Information security professionals.

Browse other questions tagged or ask your own question.