Harder Than You Think: A Case Study of Re-Identification Risk of HIPAA-Compliant Records

• Activity Number: 332
• Type: Topic Contributed
• Date/Time: Tuesday, August 2, 2011 : 10:30 AM to 12:20 PM
• Sponsor: Section on Health Policy Statistics
• Author(s): Peter K. Kwok*+ and Michael Davern and Elizabeth C. Hair and Deborah Lafky
• Companies: NORC at the The University of Chicago and NORC at the The University of Chicago and NORC at the The University of Chicago and Office of the National Coordinator for Health Information Technology
• Keywords: Statistical disclosure limitation ; HIPAA ; Safe Harbor Privacy Rules ; data confidentiality ; external re-identification ; re-identification risk

Abstract

We have studied the admission records of Hispanics in one hospital system between 2004 and 2009. The data set was stripped of identifying information as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) safe harbor methodology. We simulated an intrusion scenario in which an intruder had access to a substantial amount of information available from a market research company. We used the market research data to try to identify specific people from the hospital system's HIPAA de-identified data set, and sent possible matches to the hospital system for confirmation. Our experiment shows that this intrusion scenario involves many challenges. Even when the intruder is given strong assumptions about their knowledge the re-identification risk is only about 0.22%. We discuss the limits of our analysis and identify areas for future inquiry.