RES-2022-148 - Laserfiche WebLink

Home Browse Search

Attachment 3: HCA Small Numbers Standard 1. Why do we need a Small Numbers Standard? It is the Washington State Health CareAuthority's (HCA) legal and ethical responsibility to protect the privacy of its clients and members. However, HCA also supports open data and recognizes tfr6 aOitity of information to be used to further HCA's mission and vision. As HCA continues down the path of Data Governance maturity, establishing standards such as this is key in helping HCA analysts and management meet the needs of external data requestors while maintaining the trust of our clients and members and tomplying with agency, state and federal laws and policies. Publishing data products that include small numbers creates two concerns. As a reported number gets smaller, the risk of re-identifying an HCA client or member increases. This is especially true when i combination of variables are included in the data product to arrive at the small number (e.g. location, racelethnicity, age, or other demographic information). Small numbers can also create questions around statistical relevance. When it comes to publicly posting data products on HCA's internet site, or sharing outside the agency, the need to know the exact valu! in a celltnat is less than 11 must be questioned. As the agency moves away from traditional, static reports to a dynamic reporting environment (e.g. Tableau visualizations), it is easier for external data consumers to arrive at small numbeis. Further, thoseLxternal consumers have an increasing amount of their own data that could be used to re-identify individuals. As a result, more rigor and a consistent approach needs to be in place to protect the privacy bf HCA's clients and members. Until now, some HCA data teams have elected to follow small numbers guidelines established by the Department of Health, which include examples of suppression methods for working with small numbers. HCA is now establishing its own standard, but is planning to work with DOH and other agencies dealing with healthcare data to try and develop a consistent small numbers methodology at a statewide level. 2. Scope HCA often uses Category 4 data to create summary data products for public consumption. This Standard is intended to define one of the requirements for a summary data product to be considered Category 1. Specifically, it is intended to define the level of suppression that must be applied to an aggregiteo uata product derived from Category 4 data for the data product to qualify as Category 1. Cat-gory 1 products are data products that are shared external to the agency, in large part those products that are posted on HCA's lnternet website (.www.hca.wa.gov). The primary scope of this Standard is for those data products posted publicly (e.g. on the website), or, shared as public information. The following are examples of when this Standard does not apply to data products are: a. Those shared directly with an externalentity outside HCA, the Standard suppression of small numbers would not be required. However, you should notify the recipient that the data products contains sensitive information and should not be shared or published b. Those exchanged under a data share agreement (DSA) that will not be posted or shared outside the Contractor. c. Those created for HCA-only internal use. This standard does not supersede any federal and state laws and regulation Washingfon Sfafra Health Care Authority Page 21 HCA Contract No. K5885-1