Part 2 public-health identification-risk test

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.54(b) requires de-identified content such that there is no reasonable basis to believe the information can identify a patient. Under 45 CFR 164.514(b), expert determination addresses a very small identification risk using appropriate methods, while Safe Harbor combines identifier removal with the specified actual-knowledge condition. The release and recipient context matter.

Review combinations and context

Current 42 CFR 2.54(b) ties the condition to the information disclosed. Evaluate direct and quasi-identifiers, geography, dates, rare events, treatment details, small populations, household facts, provider and location patterns, images, narrative, metadata, and other datasets available to the recipient.

Keep the method evidence

The recognized methods appear in 45 CFR 164.514(b). An expert determination should retain its documented analysis and controls. A Safe Harbor decision should retain identifier-removal evidence and the covered entity's lack of actual knowledge that remaining data can identify the person.

Reassess changed facts

Trigger review when fields, code, population, geography, time range, linkage keys, recipient, contract, public release, external data, attack knowledge, or access controls change. Preserve the prior and new dataset versions and decisions.

Define the attack and recipient context

Identify who will receive or access the data, what other information is reasonably available to them, their technical and subject-matter knowledge, possible motives, contractual and access controls, and whether the output will be public or restricted. Consider deliberate linkage as well as accidental recognition by staff or community members.

Document anticipated recipients rather than analyzing an abstract average user. A local authority may know facts that a national analyst does not.

Examine direct and combined signals

Review identifiers, dates, detailed geography, very old ages, household facts, rare diagnoses, small program size, unusual medication or service patterns, provider schedules, facilities, images, narrative, event sequences, codes, metadata, and linkage keys. Test combinations across all released tables and companion files.

Look for uniqueness, singling out, inference, and linkage. A field that appears harmless alone can become identifying when paired with a public event, social-media post, news report, voter record, or other dataset.

Apply the chosen standard

For expert determination, preserve the expert's qualifications, methods, data and recipient assumptions, risk measures, controls, result, and documentation. For Safe Harbor, preserve identifier-removal tests and the actual-knowledge assessment. Do not blend the two methods informally to avoid an unmet requirement.

Part 2 privacy, de-identification specialists, and experienced counsel should resolve the cross-reference and any uncertainty for the specific organization.

Use controls without confusing them with data transformation

Access limits, authentication, contractual restrictions, logging, secure environments, query controls, cell suppression, output review, and prohibition on re-identification may reduce risk and support an expert's analysis. They do not excuse Safe Harbor identifier removal or turn identifiable content into a section 2.54 release by themselves.

Preserve which controls the decision assumes and monitor whether they remain effective. A later public release can invalidate an analysis based on restricted access.

Reassess and respond

Set triggers for schema, code, population, geography, time, rare-event, recipient, access, purpose, publication, external-data, and attack changes. Monitor complaints, unusual queries, attempted linkage, new data brokers, and community events that alter identifiability. Version the dataset and decision.

If risk is no longer acceptable, stop releases, contain available copies where possible, obtain expert and legal review, transform or replace the dataset, notify recipients of restrictions or correction, and document remediation.

Keep decisions calibrated to the real scale of the data. A statewide annual table and a weekly extract from one small program can expose very different risks even with identical columns. Review missingness, outliers, suppression patterns, and derived measures because they can reveal a rare event indirectly. Document why retained detail is necessary for the public-health purpose and how the chosen method addresses it. This reasoning makes later change review more reliable than a simple pass or fail label.

Example

Seventeen data extracts are tested. Fourteen have documented method evidence, combined-field review, recipient-context analysis, output version, controls, change trigger, and approval; three expose rare location-date pairs. Risk review passes 14 of 17 extracts.

Identification-risk checklist

• define anticipated recipients, access, external information, motives, and publication context;
• test direct fields and combinations across every table, file, and output;
• document the complete expert-determination or Safe Harbor method;
• distinguish transformation requirements from supporting access and contract controls;
• monitor schema, population, recipient, publication, linkage, and attack changes; and
• stop, contain, transform, correct, and reassess when risk changes.

The test is contextual and version-specific. A prior de-identification decision does not automatically cover a changed dataset or audience.