Under HIPAA, de-identified information can be shared without authorization if it is...

• A. Truly de-identified
• B. Contains patient initials
• C. Contains full date of birth
• D. Contains contact information

Answer: (A)

Under HIPAA, information can be shared without patient authorization when it has been de-identified according to accepted standards, meaning all identifiers are removed or rendered unrecoverable so the data cannot reasonably be linked to an individual. When information is truly de-identified, it falls outside the scope ofPHI protections for purposes like research or quality improvement, because there’s no reasonable way to identify the person. This is why the best choice is truly de-identified. Including patient initials, a full date of birth, or contact information would leave identifying details in the data, so it would not be considered de-identified and would require authorization or another permissible use under HIPAA.