CMS Comparative Effectiveness Research Public Use Data Pilot Project

The purpose of this project is to increase access to CMS data through the creation of public use data and a means of accessing these data, while continuing to strictly protect beneficiary and provider confidentiality. The Health Information Portability and Accountability Act (HIPAA) Privacy Rule (PR) specified the 18 items of information that, if removed from a dataset would render it de-identified. There have been assertions that even datasets de-identified to this extent are still "easily" re-identified. The notion that re-identification is easy has made it into mainstream thought on the subject, yet there is little or no basis for this assertion in fact. The purpose of the de-identification challenger is to ascertain whether, and by what means, it would be possible to re-identify Medicare beneficiaries in CMS claims HIPAA-de-identified datasets or "health information that has been de-identified following the requirements for De-identification of Protected Health Information Section 164.514(b)(2)". In making CMS data more accessible it is paramount to ensure that beneficiary and provider privacy and confidentiality are not compromised. Much of the data that comes to CMS is personally identifiable. Various laws, regulations, and court rulings govern accessibility to these data. Any effort to improve access to CMS data needs to carefully adhere to all requirements and restrictions to be sure beneficiaries are protected. A central part of the current project is to ensure that identifying data are appropriately masked to be sure that beneficiary and provider privacy is strictly protected. This contract will ascertain whether, and by what means, it would be possible to re-identify a HIPAA-de-identified dataset, or "health information that has been de-identified in accordance with the requirements for De-identification of Protected Health Information as stated in 45 CFR Section 165.514.