Re-identification Risk

The primary driver of linkage attacks. Quasi-identifiers are attributes like date of birth, gender, and 5-digit ZIP code that are not unique on their own but become identifying in combination.

• Population Uniqueness: If a record's combination of quasi-identifiers is unique within the population (e.g., a 95-year-old male in a small ZIP code), the risk of linking to an external voter registry is extremely high.
• k-Anonymity Violation: A dataset fails k-anonymity if any combination of quasi-identifiers appears fewer than k times. Low k-values directly correlate with high re-identification risk.

Re-identification is a linkage attack that requires an external dataset to cross-reference. The risk scales with the granularity and public accessibility of auxiliary information.

• Public Voter Rolls: Often contain name, address, date of birth, and party affiliation, making them a perfect key for linking against de-identified health records.
• Social Media & Data Brokers: Adversaries can purchase or scrape datasets containing granular location pings, purchase histories, and demographic details to resolve identities.
• Genomic Databases: Direct-to-consumer genetic databases create a probabilistic link to family members, enabling re-identification of supposedly anonymous genomic research data.

The information loss vs. privacy trade-off. Highly granular data preserves analytical utility but dramatically increases re-identification risk.

• Full Dates vs. Year Only: Retaining full dates (e.g., 2023-03-15) provides a precise temporal fingerprint. Shifting to year-only or applying a date shift algorithm reduces uniqueness.
• Geocoding Precision: A full street address is a direct identifier. A 5-digit ZIP code is a quasi-identifier. A 3-digit ZIP code or state-level aggregation significantly lowers risk.
• Free-Text Narratives: Unstructured clinical notes contain high-cardinality details (e.g., "mechanic at the plant on Route 9") that act as quasi-identifiers and are difficult to detect automatically.

Risk assessment must assume a motivated, knowledgeable adversary. The formal definition of re-identification risk is the probability that an attacker can correctly link a record to an individual using reasonably available means.

• Insider Threat: A hospital employee with access to both the de-identified research set and the identified EHR system poses a significantly higher risk than an external hacker.
• Background Knowledge: An adversary may know a specific individual's clinical history (e.g., "my neighbor had a rare surgery last March") and use that to pinpoint a single record in a de-identified dataset.
• Computational Power: Modern adversaries can automate linkage attacks across millions of records using commodity hardware, making manual risk assessments obsolete.

The relationship between the sampling fraction and the target population directly impacts risk.

• Small Sample, Rare Disease: A de-identified dataset of patients with a rare genetic disorder in a specific region is inherently high-risk because the base population is small and easily enumerated.
• Complete Population Sampling: If a dataset contains every individual from a specific hospital system, an adversary who knows a target was treated there knows the target's record is definitively present, shifting the attack from probabilistic to deterministic.
• Longitudinal Linkage: Records spanning multiple encounters over time create a unique temporal signature. A sequence of 4 admission dates can be as identifying as a name.

The choice of privacy model dictates the mathematical upper bound on re-identification risk.

• HIPAA Safe Harbor: A heuristic approach. Risk is not zero, but compliance is achieved by removing 18 specific identifiers. Does not protect against quasi-identifier linkage.
• Expert Determination: A statistical opinion. Risk is deemed "very small" by a qualified expert, but this is a point-in-time assessment that may not account for future auxiliary data.
• Differential Privacy: A provable guarantee. The parameter epsilon (ε) quantifies the privacy loss budget. A lower epsilon (e.g., 0.1) provides a strong mathematical bound that the output is indistinguishable regardless of any single individual's presence, making it robust to any auxiliary information.

A foundational privacy model ensuring that an individual's released data cannot be distinguished from at least k-1 other individuals whose data also appears in the release. It prevents identity disclosure by ensuring each combination of quasi-identifiers (like ZIP code, age, and gender) appears at least k times.

• Homogeneity Attack: A key vulnerability where sensitive attributes within a k-anonymous group are identical, revealing private information without re-identification.
• Background Knowledge Attack: Occurs when an attacker uses external information to narrow down which record belongs to the target within the anonymous group.
• l-Diversity: An extension that requires each equivalence class to have at least l 'well-represented' sensitive values to mitigate homogeneity attacks.

A mathematical framework providing a provable guarantee of privacy by injecting calibrated statistical noise into query results. The presence or absence of any single individual in the dataset becomes statistically indistinguishable.

• Epsilon (ε): The privacy loss parameter; a lower epsilon (e.g., 0.1) provides stronger privacy by adding more noise, while a higher epsilon (e.g., 10) offers weaker guarantees.
• Global Sensitivity: Measures the maximum impact a single record can have on a query's output, dictating the scale of noise required.
• Composition Theorems: Formal rules governing how privacy guarantees degrade when multiple differentially private queries are executed on the same dataset.

A privacy attack where an adversary cross-references a de-identified dataset with publicly available external datasets to re-identify individuals by matching shared quasi-identifiers.

• The Sweeney Attack: The canonical example where Dr. Latanya Sweeney re-identified the Governor of Massachusetts' medical records by linking anonymized hospital discharge data with the public voter registration database using ZIP code, gender, and date of birth.
• Record Linkage: The algorithmic process of joining records from disparate sources based on fuzzy matching of attributes like names, addresses, and dates.
• Prosecutor Risk: The probability that an attacker can re-identify a specific, known individual within the dataset.

A data protection technique that replaces direct identifiers (e.g., name, medical record number) with artificial pseudonyms, allowing data to be re-linked under controlled conditions. It is distinct from irreversible anonymization.

• Reversibility: Pseudonymized data is still considered personal data under GDPR because the mapping table or algorithm allows re-identification by the data controller.
• Consistent Mapping: A robust system ensures the same individual receives the same pseudonym across all records, preserving longitudinal data integrity for research.
• Cryptographic Pseudonyms: Generated using one-way hash functions or encryption, providing stronger separation between the pseudonym and the original identity.

A HIPAA de-identification method where a qualified statistician applies accepted statistical and scientific principles to determine that the risk of re-identifying an individual from the data is very small.

• Risk Threshold: The expert must document the methodology and justify that the residual re-identification risk is acceptably low, though HIPAA does not define a specific numeric threshold.
• Adversary Modeling: The expert must consider reasonably anticipated attacks, including the availability of external datasets and the attacker's computational capabilities.
• Statistical Disclosure Control: The suite of techniques (suppression, generalization, swapping) the expert applies to transform the data before certifying it as de-identified.

The remaining probability that protected health information persists in a dataset after an automated de-identification pipeline has been executed, often due to false negatives in detection.

• False Negative Rate (FNR): The proportion of actual PHI instances that a detection model incorrectly classifies as non-sensitive, representing a direct measure of privacy leakage.
• Burned-in PHI: Text visually rendered into medical image pixels (e.g., patient name on an ultrasound) that optical character recognition may miss, creating residual risk.
• Adversarial Testing: Red-team exercises where security engineers actively attempt to re-identify records in a de-identified corpus to empirically measure residual risk.