Re-ID Risk Scoring

To comply with the Health Insurance Portability and Accountability Act (HIPAA), you must identify both key identifiers and quasi-identifiers. Key identifiers are unique PHI values such as name and social security number, while quasi-identifiers are less unique attributes like age, state, gender, and occupation., which can be used to identify persons simultaneously.

The HIPAA expert determination method rule requires that there is only a statistically very small chance of re-identifying an individual in a dataset. This affects HIPAA-covered business associates who use this data and want to find out which values they need to change.

Likewise, FERPA regulations for student privacy call these attributes indirect identifiers, which 34 CFR 99.3(f) describes as (translated) „other information that, alone or in combination with other information, can be linked or linkable to a specific student that would allow a reasonable person...to identify the student with reasonable certainty.“.

The data masking product IRI FieldShield And the data management platform IRI Voracity, which also includes FieldShield, include a graphical job wizard for statistical analysis and evaluation of re-identification risk based on quasi-identifiers in DB or flat file rows.

 
 
 
The risk scoring assistant in the graphical IDE of IRI Workbench For FieldShield and Voracity, it creates detailed and visual reports that statistically measure the risk of re-identification. These reports assess this risk across three attack modes and display the number of records within each equivalence class:
 
 
 
 
Another diagram offers an interactive view of the different combinations of quasi-identifiers, along with their separation and difference values, to further assess their ability to re-identify a data set:
 
 
 
 
In addition to interactive graphics, which can be saved in various image formats, FieldShield's re-ID risk assessment report offers detailed descriptions of the metrics:
 
 
 

After reviewing the risk assessment report in consultation with a qualified statistician, to whom IRI can also refer you, you can create additional FieldShield jobs that address one or more of the quasi-identifiers generalize or blur, so that they remain useful for research or marketing purposes but are less likely to lead to re-identification. Afterwards, you can easily re-evaluate the modified datasets from the attribute model you created during the first pass through the wizard.

More information about the assistant can be found in this article or contact us using the form below.