Which measure is most directly intended to minimize the risk of re-identification in research using electronic health records?

• A. Access controls
• B. De-identification
• C. Data security measures
• D. Governance policies

Answer: (B)

De-identification directly targets the risk of linking data back to an individual. By removing or masking identifiers such as names, dates, addresses, or other quasi-identifiers, the data become much harder to tie to a specific person. This step addresses the core way someone could re-identify someone from the dataset, often making the information effectively non-identifiable for research purposes. Techniques can include stripping direct identifiers and reducing or generalizing quasi-identifiers, sometimes following formal methods like the HIPAA Safe Harbor or an expert determination process.

Other measures play important roles but are not as directly focused on re-identification. Access controls limit who can view data but do not necessarily remove identifiers from the data themselves. Data security measures protect against breaches and unauthorized access during storage or transmission, but they don’t reduce the inherent identifiability of the data. Governance policies provide oversight and set rules, yet they don’t by themselves alter the data to prevent re-identification.

So, the measure that most directly minimizes re-identification risk is de-identification.