These days, the concept of “identifiability” is moving target. Per the Revised Common Rule (RCR), something is identifiable if the subject’s identity “is or may be readily ascertained by the investigator.” The RCR also states federal departments implementing the RCR will review the notion of identifiability at least once every 4 years, and any technologies or techniques that produce identifiable private information or private information will be added to a list published in the Federal Register.
What does this mean for research? Primarily that something that is not considered identifiable now, and therefore not human subject material, might be identifiable in the future, depending on the availability of new technology or techniques. Right now, for example, genetic testing results that have no direct identifiers attached are generally not considered identifiable. But how quickly will that change? A blog item from last year pointed out that about 60 percent of Americans of Northern European descent can now be identified (or could last year; the percentage may have increased since then) through publicly available genealogy databases, even if they haven’t joined the databases themselves.
Now comes this bit of information about something we really don’t consider to be super private — the phone number. When it’s associated with your health information, HIPAA says it’s an identifier. But you use your phone number for all kinds of things (ever type it in as the identifier for your loyalty card at retailers?), and people who have your phone number can find out all kinds of things about you. You might use that as the identifier for things such as your loyalty discount card at various retailers. The author’s phone number let people find out the author’s name, date of birth, address, property taxes he paid, and the names of his family members. From there it’s a short hop to find out things such as the owner’s mother’s maiden name or other things that could gain someone access to things like bank accounts. Please click on the link to find the full (kinda scary, really) details, and contact the IRB Blog Original Sources Department at paalediths@uams.edu if you have trouble accessing the text.