Art, The SSN itself has to be encrypted. And if needed the same encryption must work on other HIPAA defined PHI variables like date and ZIP/FIPS codes. We prefer to encrypt the SSN as that is the only link across files, across sites and especially across projects. -G

> Date: Wed, 14 Nov 2007 20:42:49 -0500 > From: art297@NETSCAPE.NET > Subject: Re: Strong Variable Level Encryption > To: SAS-L@LISTSERV.UGA.EDU > > George, > > I may be totally off-base, but I recently confronted a situation where a > data provider indicated that they couldn't provide me with the needed data > because they weren't satisfied with any of the existing methods for > encrypting id information. > > We resolved the matter when I indicated that I didn't need the id > information, thus agreed on a data set organized with records like the > following: > > *unique ID > var1 var2 .. etc > *unique ID > var1 var2 .. > var300 .. etc > *unique ID > var1 var2 .. etc > > Where "*unique ID" was simply text indicating that the following records > were related to the same id. > > As such, I could easily parse the file to obtain unique records for each > ID, without ever knowing what the ID was and without having any way to > trace it back to any source. > > If you are facing a similar task, possibly the same methodology might get > around the need for any encryption. > > HTH, > Art > --------- > On Wed, 14 Nov 2007 18:29:23 -0500, George Joseph <gjman@HOTMAIL.COM> > wrote: > > >I need help with Variable level encryption of SSN. SAS help desk sent me > >references to two papers. > >1) Annette Landan-Effective Data Encryption Algorithm. > >2) Sheng Luo-Using Bitwise Function to Scramble Data fields with Key. > > > >The second paper (Luo) does have some interesting method to encrypt credit > >card # but when I ran it on a test dataset I found that if the record > >repeated itself it was encrypted differently. And that just wont fly with > >medical records where the same SSN will have multiple observations. > > > >I did see some Macros on the UGA list serve archives but I was wondering > if > >someone has any updated version of the same or perhaps newer algorithms. > If > >they are FIPS 140 compliant that would be even better. > > > >Thank!!!