+SI-19(04) Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers

SI-19(04) Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers

Control

Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.

Discussion

There are many possible processes for removing direct identifiers from a dataset. Columns in a dataset that contain a direct identifier can be removed. In masking, the direct identifier is transformed into a repeating character, such as XXXXXX or 999999. Identifiers can be encrypted or hashed so that the linked records remain linked. In the case of encryption or hashing, algorithms are employed that require the use of a key, including the Advanced Encryption Standard or a Hash-based Message Authentication Code. Implementations may use the same key for all identifiers or use a different key for each identifier. Using a different key for each identifier provides a higher degree of security and privacy. Identifiers can alternatively be replaced with a keyword, including transforming "George Washington" to "PATIENT" or replacing it with a surrogate value, such as transforming "George Washington" to "Abraham Polk."

Assessment Objective

direct identifiers in a dataset are removed, masked, encrypted, hashed, or replaced.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures personally identifiable information processing policy de-identification procedures system configuration documentation of de-identified datasets tools for the removal, masking, encryption, hashing or replacement of direct identifiers system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel responsible for de-identifying the dataset organizational personnel with information security and privacy responsibilities

1. Prezentare generală

1.1 Referințe

1.2 Cerințe identificate

1.3 Reglementări asociate

2. Cerințe identificate

Cerințe

3. Reglementări asociate

Reglementări

Tichete legate

Legături
is blocked by SI-19(04) Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers – Assessment Procedure
is blocked by De-Identification (Anonymization)
is blocked by Removal, Masking, Encryption, Hashing or Replacement of Direct Identifiers