Evaluating re-identification risks with respect to the HIPAA privacy rule.

Area of Science:

• Health Informatics
• Data Privacy
• Information Security

Background:

• Healthcare organizations implement data protection policies to de-identify patient records for sharing.
• Current policies often lack an understanding of the actual risk of patient re-identification.
• The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule outlines standards for de-identification.

Purpose of the Study:

• To estimate the re-identification risk associated with HIPAA Privacy Rule data sharing policies.
• To evaluate the effectiveness of a specific re-identification attack using publicly available voter registration lists.
• To quantify the variability in re-identification risk across different US states and protection policies.

Main Methods:

• Defined risk metrics including expected re-identifications, population proportion in small groups, and cost per re-identification.
• Assessed hypothetical datasets protected by HIPAA Safe Harbor and Limited Dataset policies.
• Simulated re-identification attacks with full and limited attacker knowledge (voter registries) for each US state.

Main Results:

• Re-identification vulnerability ranged from 0.01%–0.25% for Safe Harbor and 10%–60% for Limited Datasets.
• Voter registration list attacks reduced re-identification risk in many states, sometimes to 0%, due to data availability.
• Estimated re-identification costs varied significantly, from $0 to $17,000.

Conclusions:

• Standardized data protection policies like Safe Harbor result in variable re-identification risks for different organizations.
• Performing local, context-specific re-identification risk assessments is essential before sharing de-identified health data.
• This study highlights the need for tailored data protection strategies beyond blanket policies.