reviewing-reidentification-risk

To measure re-identification risk, analyze quasi-identifiers like age, geography, and dates to measure record uniqueness, compute k-anonymity and l-diversity, and run empirical auxiliary-data linkage attacks to document residual risk.

K-anonymity and l-diversity analysis for HIPAA Expert Determination involves scoring combinations of quasi-identifiers to identify singleton records and ensure a dataset has a very small risk of re-identification before release.

Test for linkage attacks by running empirical re-identification attack metrics against your dataset using auxiliary records to identify unique combinations of quasi-identifiers that could enable singling out.

Document residual risk for a clinical dataset release by applying generalization or suppression to reduce risk, re-scoring the dataset, and producing a defensible residual-risk memo detailing attacker assumptions and attack metrics.

Yes, this approach supports HIPAA Expert Determination by measuring record uniqueness, documenting attacker assumptions, running empirical linkage attacks, and generating a residual-risk memo without exposing raw records.

Combinations of age, geography, dates, sex, rare diagnoses, and providers often create singleton records during privacy audits, enabling singling out and increasing the risk of successful linkage attacks.