Expert Determination

The core output is a documented certification from a qualified statistician stating that the risk of re-identification is very small. This is not a subjective opinion but a formal statistical conclusion. The expert must document the methodology and justification for their determination, creating an auditable compliance artifact that withstands regulatory scrutiny.

Unlike Safe Harbor's rule-based removal of 18 identifiers, Expert Determination uses statistical models to quantify actual re-identification risk. The expert considers:

• Population uniqueness of record combinations
• Adversary knowledge and available auxiliary datasets
• Replicability of the de-identification process This allows retention of data elements that Safe Harbor would require removed, preserving analytical utility.

The expert must evaluate risk within the specific data release context, not in isolation. Key factors include:

• Data recipient agreements and controls
• Environment where data will be accessed
• Motivation and capacity of potential adversaries
• Longitudinal risk as external data sources evolve This contextual analysis makes the determination dynamic and environment-specific.

The HIPAA Privacy Rule requires a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable. Typical qualifications include:

• Advanced degree in statistics, biostatistics, or epidemiology
• Demonstrated experience in statistical disclosure control
• Familiarity with re-identification attack methodologies
• Professional certification or peer recognition in the field

Expert Determination's primary advantage over Safe Harbor is analytical utility retention. By applying statistical disclosure control techniques—such as generalization, suppression, and perturbation—rather than wholesale identifier removal, the expert can preserve:

• Granular geographic information for epidemiological studies
• Precise date fields for longitudinal analysis
• Rare disease cohorts that would be stripped under Safe Harbor This makes it the preferred method for research datasets.

The 'very small' risk determination is not a one-time event. The expert must consider whether re-assessment is needed when:

• New auxiliary datasets become publicly available
• Computational capabilities for linkage attacks advance
• The data release scope or recipient pool changes
• Time has elapsed since the original certification This creates a lifecycle obligation rather than a point-in-time compliance check.