Releasing 2.3 Million Claims Rows to Academic Researchers
A health insurer plans to release 2.3 million claims rows to 40 academic researchers as a flat file. Direct identifiers are removed, but the file keeps 5-digit ZIP, full date of birth, admission and discharge dates, sex, and a stable member pseudonym so that researchers can link a member's records over time. On a spot check, one combination of ZIP, birth date and sex matched exactly one member. A free-text 'notes' field is included because clinicians say it is essential; it contains dictated summaries. The researchers have also asked for the pseudonym to be consistent with an earlier 2019 release so they can extend a longitudinal study. The legal team proposes relying on the HIPAA Safe Harbor method and shipping the file through a secure transfer portal.
1. Is the HIPAA Safe Harbor method satisfied as described? What changes are required before release?
Read the worked answer
No. Safe Harbor requires the removal of all eighteen identifier categories, and several survive here.
Dates: all elements of dates directly related to an individual must be removed except year - admission and discharge dates cannot stay in full. Full date of birth is an identifier, and any age over 89 must be aggregated. ZIP: a 5-digit ZIP must be reduced to three digits, and any three-digit prefix covering fewer than 20,000 people must be aggregated to 000. The spot check confirms the risk empirically: a unique record under ZIP plus birth date plus sex is a re-identification candidate.
The notes field is the hardest problem. Free-text narrative routinely contains names, dates, relatives, employers and rare events; Safe Harbor does not de-identify narrative text reliably. Either remove it, or move it under expert determination with validated redaction plus human review - do not ship it because clinicians find it useful.
After generalisation, re-test the actual file: compute equivalence-class sizes on the quasi-identifier set and require a minimum of five (many programmes use eleven) before any release decision.
2. How should the stable pseudonym and the request for cross-release linkage be handled?
Read the worked answer
A stable pseudonym is a persistent key, and two releases joined on that key become a far richer longitudinal dataset than either file alone - precisely what linkage attacks exploit. The classic result that the large majority of a population is unique on five-digit ZIP, sex and full date of birth applies with full force once the pseudonym lets an attacker accumulate records and match against voter files or registry data.
Three defensible options. Re-salt the pseudonym per release, so linkage works within a release but not across releases; researchers can still follow a member's claims inside the file, which is usually what the analysis actually needs. If cross-release continuity is genuinely required, provide a consistent key only for a consented cohort, restricted to a trusted research environment with output checking. Third, expose cross-release linkage only as privacy-preserving queries over an enclave rather than as a file.
Whichever is chosen, require a data use agreement with explicit re-identification and re-disclosure prohibitions, named users rather than institutions, and an attestation per release. The secure portal protects data in transit; it does nothing about what happens to a flat file on a researcher's laptop.
3. Generalisation is eroding analytical utility and researchers are objecting. How do you balance utility against re-identification risk without simply caving?
Read the worked answer
Quantify the loss against the intended analyses rather than arguing about it. Re-run the cohort's headline calculations - admission rates, length of stay, readmission rates - on the transformed file and report relative error per statistic. That converts 'we need dates' into 'these three analyses shift by under 1%, that one by 12%', which is a decision the governance group can actually take.
Often the utility objection dissolves with better transformations. Researchers rarely need a raw discharge date; they need length of stay and days to readmission. Release derived intervals and drop the dates - that preserves every analysis while destroying the identifier. Where longitudinal timing matters, per-member random date shifting preserves intervals while obscuring true dates.
Offer tiered access instead of one file: a public aggregate release with differential privacy noise for descriptive work, a generalised file for cohort analysis, and an enclave for row-level and notes-based work under supervision.
Document the expert determination, the chosen k threshold and its rationale, and an explicit accepted residual risk signed by an accountable owner, reviewed annually or whenever a new external dataset could be joined to the release.