id: "SI-19(07)" title: "Validated Algorithms and Software" family: "SI" family_name: "System and Information Integrity" sort_id: "si-19.07" priority: "P1" implementation_level: "organization" parent: "SI-19" enhancement: True
Statement
Perform de-identification using validated algorithms and software that is validated to implement the algorithms.
Guidance
Algorithms that appear to remove personally identifiable information from a dataset may in fact leave information that is personally identifiable or data that is re-identifiable. Software that is claimed to implement a validated algorithm may contain bugs or implement a different algorithm. Software may de-identify one type of data, such as integers, but not de-identify another type of data, such as floating point numbers. For these reasons, de-identification is performed using algorithms and software that are validated.
Assessment Objective: de-identification is performed using validated algorithms;
Assessment Objective: de-identification is performed using software that is validated to implement the algorithms.
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
de-identification procedures
system configuration
de-identified datasets
algorithm and software validation tools
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Organizational personnel responsible for de-identifying the dataset
organizational personnel with information security and privacy responsibilities
Validated algorithms and software