title: Evaluating re-identification risks with respect to the HIPAA privacy rule.
abstract: OBJECTIVE
  Many healthcare organizations follow data protection policies that specify which patient identifiers must be suppressed to share "de-identified" records. Such policies, however, are often applied without knowledge of the risk of "re-identification". The goals of this work are: (1) to estimate re-identification risk for data sharing policies of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule; and (2) to evaluate the risk of a specific re-identification attack using voter registration lists.
  
  
  METHODS
  We define several risk metrics: (1) expected number of re-identifications; (2) estimated proportion of a population in a group of size g or less, and (3) monetary cost per re-identification. For each US state, we estimate the risk posed to hypothetical datasets, protected by the HIPAA Safe Harbor and Limited Dataset policies by an attacker with full knowledge of patient identifiers and with limited knowledge in the form of voter registries.
  
  
  RESULTS
  The percentage of a state's population estimated to be vulnerable to unique re-identification (ie, g=1) when protected via Safe Harbor and Limited Datasets ranges from 0.01% to 0.25% and 10% to 60%, respectively. In the voter attack, this number drops for many states, and for some states is 0%, due to the variable availability of voter registries in the real world. We also find that re-identification cost ranges from $0 to $17,000, further confirming risk variability.
  
  
  CONCLUSIONS
  This work illustrates that blanket protection policies, such as Safe Harbor, leave different organizations vulnerable to re-identification at different rates. It provides justification for locally performed re-identification risk estimates prior to sharing data.
authors.affiliation: Department of Biomedical Informatics, School of Medicine, Vanderbilt University, Nashville, Tennessee 37203, USA.
authors.forename: Kathleen
authors.initials: K
authors.lastname: Benitez
authors.forename: Bradley
authors.initials: B
authors.lastname: Malin
mesh_terms: D022126:Access to Information / Q000331:legislation & jurisprudence*; D016494:Computer Security; D003219:Confidentiality / Q000331:legislation & jurisprudence*; D057286:Electronic Health Records; D019983:Guideline Adherence; D020408:Health Insurance Portability and Accountability Act; D006801:Humans; D015233:Models, Statistical; D012042:Registries / Q000592:standards; D018570:Risk Assessment; D014481:United States