Assessment Objective
Determine if:
- SI-19a. [Assignment: elements] are removed from datasets;
- SI-19b. the effectiveness of de-identification is evaluated [Assignment: frequency].
Assessment Methods
Examine
- System and information integrity policy
- system and information integrity procedures
- personally identifiable information processing policy
- de-identification procedures
- system configuration
- datasets with personally identifiable information removed
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel responsible for identifying unnecessary identifiers
- organizational personnel responsible for removing personally identifiable information from datasets
- organizational personnel with information security and privacy responsibilities
Test
- Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | SI-19 [P] De-identification |