Re-Identification Risk

The single greatest multiplier of risk. Re-identification rarely occurs from the target dataset alone; it requires linking to external auxiliary datasets.

• Voter registration records: Used by Latanya Sweeney to re-identify the governor of Massachusetts in 1997 using only ZIP code, birth date, and sex.
• Public social media profiles: Provide explicit identifiers that can be joined with pseudonymized medical records.
• Commercial data brokers: Aggregate thousands of attributes per individual, creating high-dimensional linkage keys.

The attack surface expands with every publicly available dataset that shares quasi-identifiers with the protected clinical data.

Quasi-identifiers are attributes that, individually, do not identify a person but become uniquely identifying in combination. The granularity of these fields directly determines risk.

• High-risk: Full date of birth, 5-digit ZIP code, exact admission/discharge timestamps, rare disease codes (orphan diseases).
• Medium-risk: Age in years, 3-digit ZIP prefix, broad procedure categories.
• Low-risk: Age in 5-year bands, state-level geography, aggregated diagnosis-related groups.

k-anonymity formalizes this: a dataset satisfies k-anonymity if each combination of quasi-identifier values appears for at least k individuals. Higher k means lower granularity and lower risk.

The curse of dimensionality works in the attacker's favor. As the number of attributes per record increases, the probability that any given combination is unique approaches certainty.

• A dataset with 10 demographic fields may have few unique rows.
• A dataset with 10 demographics plus 500 lab values, 50 diagnosis codes, and free-text notes creates an ultra-high-dimensional fingerprint.
• Even if each individual field is coarse, the cross-product of many fields creates near-unique signatures.

Mitigation: Dimensionality reduction via feature selection, aggregation, or synthetic data generation before federated sharing.

The fidelity of information leaked through model parameters or predictions is a direct channel for re-identification.

• Model inversion attacks: Reconstruct training samples from gradient updates. High-fidelity gradients (e.g., from large batch sizes or early training rounds) leak more.
• Membership inference: Overfitted models leak stronger signals about whether a specific record was in the training set.
• Prediction API outputs: Returning raw logits or confidence scores instead of hard labels provides more information for attribute inference.

Defense: Gradient clipping, small batch sizes, differential privacy noise injection, and limiting prediction API output to minimal necessary information.

Risk is fundamentally a function of how statistically distinct an individual is within the underlying population. This is not a property of the dataset alone but of the real-world distribution.

• Orphan disease patients: Inherently higher risk because their condition itself is a strong quasi-identifier. A dataset containing a single case of a disease with 200 known cases worldwide is trivially re-identifiable.
• Rural vs. urban populations: Sparse populations have fewer individuals sharing any given demographic profile.
• Genetic data: Every genome is effectively unique. Even summary statistics from GWAS can reveal individual participation.

Mitigation: Population-level risk assessment before federated inclusion; k-map (mapping to population uniqueness) rather than k-anonymity alone.

Time is a powerful quasi-identifier. Temporal patterns in clinical data create unique signatures that persist across pseudonymized records.

• Admission/discharge sequences: The exact pattern of hospital visits over time is often unique to an individual.
• Lab value trajectories: A sequence of creatinine measurements over 6 months can act as a biometric signature.
• Medication timing: Dosing schedules and prescription refill patterns create temporal fingerprints.

Longitudinal datasets amplify this risk exponentially compared to cross-sectional snapshots. Each additional timestamp adds a dimension to the linkage key.

Mitigation: Temporal aggregation (e.g., monthly instead of daily), jittering timestamps, or restricting the time window of shared data.