HIPAA's Safe Harbor list, applied line by line to a seeded composite draft, turns up eleven slips in NU569's Unit 9 review, from an age past 89 to a tattoo. Searches like "nu 569 unit 9 assignment example", "nu569 unit 9 sample" and "nu569 unit 9 example" land here.
Eleven Lines That Should Never Reach a Submitted Paper: A De-Identification Review of a Seeded Draft
[Student Name]
Purdue University Global
NU569: FNP I Clinical - Lifespan Health Focus
Unit 9 De-Identification Review
[Instructor Name]
[Date]
The draft is invented and deliberately seeded with identifiers for the exercise; every name, date and number in it is fictional.
The Standard
Under the HIPAA Privacy Rule, health information is de-identified by one of two methods. The Safe Harbor method requires removing eighteen categories of identifiers of the individual and of the individual's relatives, employers and household members, and requires that the writer have no actual knowledge that what remains could identify the person (45 C.F.R. § 164.514, 2024). The other method, expert determination, relies on a qualified statistician certifying that re-identification would be very unlikely; it is named and set aside here, since a course paper has no statistician attached (U.S. Department of Health and Human Services, Office for Civil Rights, 2012).
Part 1: The Seeded Draft (invented)
1. Patient: [Walter Brandt], a 91-year-old retired ferry pilot.
2. Seen on June 4, [2026], at [Harbor Point Family Clinic].
3. Date of birth: [March 2, 1935].
4. Lives in [Kettle Cove], ZIP [04577], with his daughter [Anne].
5. Daughter's cell: [207-555-0148].
6. Chief complaint: two weeks of worsening breathlessness.
7. Lab header pasted from the chart: MRN [000482117].
8. Pacemaker, model [composite], serial [PM-44821-B], placed [2019].
9. Retired in [1998] after 40 years piloting the [Kettle Cove] island ferry.
10. Exam: bilateral crackles; 2+ ankle edema.
11. Photo attached: left forearm edema, showing an anchor tattoo with "[Marguerite]."
12. Email for results: [wbrandt35@example.com].
13. Assessment: acute decompensated heart failure.
14. Social: his late wife [Marguerite] ran the ferry café for [30] years.
Part 2: The Audit, in the Rule's Order
1. Names. Line 1, patient's name; line 4, daughter's name; line 14, wife's name. Revision: "the patient," "his daughter," "his late wife."
2. Geographic subdivisions smaller than a state. Line 4, town and full ZIP; line 2, clinic name, which locates him; line 9, the named ferry route. Revision: "a coastal town"; ZIP removed entirely, since the first three digits may remain only where that area holds more than 20,000 people, and this one may not; "a family clinic"; "an island ferry."
3. Dates, except year, directly related to the individual. Line 2, exact visit date; line 3, date of birth; line 8, placement year stays as year only. Revision: "in 2026"; birth date removed.
4. Ages over 89. Line 1, age 91. Revision: "90 or older." Past 89, even the birth year reveals age, so both the birth date and the year go.
5. Telephone numbers. Line 5. Revision: removed.
6. Email addresses. Line 12. Revision: removed.
7. Medical record numbers. Line 7, in a pasted header. Revision: header removed.
8. Device identifiers and serial numbers. Line 8, pacemaker serial. Revision: "a pacemaker."
9. Full-face photographs and comparable images. Line 11: not a face, but the tattoo with a name is a unique identifying characteristic. Revision: photo removed, replaced with "left forearm pitting edema, 2+."
10. Any other unique identifying number, characteristic or code. Line 11, the named tattoo, as above.
11. Retired-in year with career length, line 9, combined with age: see Part 3.
Not triggered: Social Security, health plan, account, certificate or license numbers; vehicle identifiers; web URLs; IP addresses; biometric identifiers such as fingerprints; fax numbers.
Part 3: What Safe Harbor Does Not Catch
The second Safe Harbor condition is actual knowledge. Even with the eighteen categories removed, a reader in a small coastal town might still recognize "a man over 90 who piloted the island ferry for 40 years and whose late wife ran the café." Studies of re-identification attacks on health data show that combinations of ordinary details, age, place, occupation and rare events, can identify individuals even when direct identifiers are gone (El Emam et al., 2011). Those details are quasi-identifiers. The list does not name them, but the writer's knowledge makes them matter.
Revision for the quasi-identifiers: "a retired man over 90 who worked on the water for most of his career." The wife's café, the ferry and the town are dropped; none is needed for the clinical teaching point, which is decompensated heart failure in a very old man with a pacemaker.
Revised Opening
"The patient is a man aged 90 or older, retired from work on the water, who lives with his daughter and presented in 2026 with two weeks of worsening breathlessness."
References
45 C.F.R. § 164.514 (2024). https://www.ecfr.gov/current/title-45/section-164.514
El Emam, K., Jonker, E., Arbuckle, L., & Malin, B. (2011). A systematic review of re-identification attacks on health data. PLoS ONE, 6(12), e28071. https://doi.org/10.1371/journal.pone.0028071
U.S. Department of Health and Human Services, Office for Civil Rights. (2012). Guidance regarding methods for de-identification of protected health information in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html
How this NU569 Unit 9 example is structured
The audit is organized by the rule, not by the draft. It opens on the standard: the Safe Harbor method at 45 CFR 164.514(b)(2), which requires removing eighteen categories of identifiers belonging to the individual or to relatives, employers and household members, with a second condition of no actual knowledge that the leftover details could point to the person. Expert determination, the other route, is named and set aside, since a course paper has no statistician attached. The table follows the categories in the rule's own order, showing which the draft triggered and which it did not. Two rows need explanation beyond the list: the age over 89, where the birth year must also go, and the ZIP code, where only the first three digits may stay, and only for areas above twenty thousand people. A last section covers quasi-identifiers the list omits.
Get an NU569 Unit 9 example written to your instructions
Describe the case type and write-up format your Unit 9 audit covers, and share the prompt and rubric, but keep any draft built on a real patient to yourself. We assemble a composite draft seeded with the identifiers that most often slip through and audit it row by row against the Safe Harbor list. Free the first time, back within 24-48h. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.
NU569 Unit 9 questions, answered
What are the eighteen Safe Harbor identifiers?
Names; geographic units smaller than a state; date elements other than year, plus ages over 89; telephone and fax numbers; email addresses; Social Security numbers; medical record, health plan and account numbers; certificate or license numbers; vehicle and device identifiers; web addresses; IP addresses; biometric identifiers; full-face photographs and comparable images; and any other unique identifying number, characteristic or code.
Is a composite patient automatically de-identified?
Very nearly, if it is built well: details are drawn from several encounters or invented, so no single person matches. A composite can still slip if one striking detail comes from a real patient, an uncommon occupation, say, or a memorable event. Reviewing even a composite draft against the list is a sound habit, and graders often ask for exactly that.
Does my school's policy go further than HIPAA?
Often, yes. Many programs and clinical sites forbid any real patient information in coursework, even de-identified, and some require composites only. Where the program rule is stricter, it governs your papers. The review in the sample cites HIPAA because it is the common floor, and it notes that a school or site may set the bar higher.