Expert Determination Method

Unlike the Safe Harbor method, which mandates the removal of 18 specific identifiers, Expert Determination uses statistical and scientific principles to measure and mitigate re-identification risk. The expert must document the methods and results that justify the determination, ensuring the approach is defensible and reproducible rather than a simple checklist exercise.

HIPAA does not define 'very small' with a specific numerical threshold, but industry practice often aligns with thresholds like 0.04 for k-anonymity or cell sizes greater than 3 to 5 individuals. The expert must consider that the risk is vanishingly small in the context of the specific data release, accounting for the recipient's technical capabilities and the availability of external data sets.

The person making the determination must be a qualified statistician or scientist with appropriate knowledge and experience in rendering data non-identifiable. This individual applies generally accepted statistical and scientific principles, and their qualifications, methodology, and analytical results must be fully documented to withstand potential regulatory scrutiny or audit.

The core of the method involves a formal risk assessment that evaluates three dimensions:

• Prosecutor Risk: The risk that a specific known individual is in the dataset.
• Journalist Risk: The risk that a specific individual can be re-identified by a motivated attacker.
• Marketer Risk: The risk that a record can be linked to an individual at random. The expert must demonstrate that all relevant attack models yield a very small risk.

A key advantage over the Safe Harbor method is the preservation of data utility. Instead of stripping all dates and geographic subdivisions smaller than a state, the expert can apply techniques like generalization (e.g., converting exact birth dates to birth years) or perturbation (adding statistical noise). This retains analytical value for clinical research while still achieving the required privacy protection.

The expert must produce a formal de-identification attestation that details the specific methods, statistical models, and risk thresholds used. This documentation serves as the legal basis for the covered entity's compliance with the HIPAA Privacy Rule. It must be retained and made available to regulators, demonstrating that the de-identification was not an arbitrary process but a scientifically grounded one.

The prescriptive alternative to Expert Determination. Requires the removal of 18 specific identifiers including names, dates (except year), geographic subdivisions smaller than a state, and full-face photographs. The covered entity must also have no actual knowledge that the remaining information could be used alone or in combination to identify the individual. Unlike Expert Determination, Safe Harbor provides a bright-line checklist but often results in significant data utility loss, particularly for longitudinal studies requiring precise dates.

The core quantitative benchmark an expert must satisfy. The expert must determine the risk is very small that the information could be used, alone or in combination with other reasonably available information, to identify an individual. While HIPAA does not define a specific numeric threshold, common industry practice and academic precedent often reference a cell size suppression rule (e.g., n<11) or a re-identification risk below 0.05 to 0.09. The expert must document the specific statistical methods used to reach this conclusion.

The overarching process under the HIPAA Privacy Rule by which health information is stripped of identifiers so it is no longer considered PHI. Two methods satisfy this standard:

• Expert Determination: Statistical or scientific principles applied by a qualified expert.
• Safe Harbor: Removal of 18 enumerated identifiers. Once de-identified, the data is no longer subject to HIPAA restrictions and can be used for secondary research, algorithm training, and public health analysis without patient authorization.

The formal analysis conducted by the expert to measure the probability that an individual can be singled out from a dataset. This involves evaluating three key attack vectors:

• Singling Out: Isolating a specific record.
• Linkability: Combining the dataset with external, publicly available data (e.g., voter registries, social media).
• Inference: Deducing sensitive attributes with high probability. The expert must consider reasonably available external data, not just theoretical worst-case scenarios, and document the risk for each vector.

A middle-ground classification between fully identified PHI and de-identified data. A Limited Data Set excludes direct identifiers (like names, SSNs, and medical record numbers) but may retain dates of admission, discharge, birth, and death, as well as city, state, and ZIP code. It is not considered de-identified and is still PHI, requiring a Data Use Agreement (DUA) with the recipient that specifies permitted uses and prohibits re-identification. Useful for research where temporal analysis is critical.

The foundational federal regulation, issued under the Health Insurance Portability and Accountability Act of 1996, that establishes national standards for the protection of individually identifiable health information. The rule governs the use and disclosure of PHI by covered entities (providers, health plans, clearinghouses) and their business associates. Section §164.514(a) specifically defines the de-identification standard, making Expert Determination a legally recognized mechanism to exempt data from the rule's stringent privacy protections.