HIPAA Expert Determination Method A risk-based approach to de-identification that preserves data value.
Use and share valuable healthcare data for research, analytics, AI, development, testing, and other secondary purposes. Info Incognito evaluates your data, assesses the risk of re-identification, and develops documented de-identification requirements designed to reduce the risk to an appropriately low level while preserving the usefulness of the data.
HIPAA Expert Determination Workflow
Why Expert Determination?
The HIPAA Privacy Rule allows de-identification through an expert determination that the risk of re-identification is very small. This approach is often necessary when datasets contain detailed clinical information, dates, geographic information, or other quasi-identifiers that make the Safe Harbor method impractical.
Expert Determination requires more than simply removing names and addresses. Re-identification risk can result from combinations of data elements, unique characteristics within a dataset, and information that may be available from external sources. Info Incognito combines expertise in mathematics, statistics, data management, and technology to evaluate these risks and develop practical de-identification requirements that balance privacy protection with data utility.
What You Receive
Data analysis results
Identification of direct identifiers, indirect identifiers, quasi-identifiers, and sensitive attributes that may contribute to re-identification and inference.
De-identification requirements
Specific requirements for transforming the data. Practical recommendations for generalization, suppression, masking, and other techniques. We strive to ensure privacy while preserving data utility.
Data sharing risk assessment
Evaluation of the characteristics of the dataset as well as relevant external information to determine potential re-identification risks. This includes documentation of the sensitivity of the data, the mitigating controls preventing re-identification, the motives and capacity for attempting re-identification, and other factors.
Verification process metrics
Reports providing key metrics generated from performing the de-identification process.
Determination summary and attestation
A comprehensive, objective, defensible, and auditable document describing the purpose, analysis, methodology, findings, recommendations, and conclusions. Includes expert credentials, statement of independence, and, if appropriate, attestation that the risk of re-identification is “very small”.
When Organizations Use Expert Determination
-
Research datasets containing detailed patient information
-
Clinical and observational research
-
AI and machine learning development
-
Healthcare analytics
-
Data warehouses and data lakes
-
Software development and testing
-
Sharing data with research partners
-
Datasets containing dates, geographic information, or other quasi-identifiers
-
Medical imaging and DICOM datasets
-
Large datasets where removing information under Safe Harbor would significantly reduce data utility
Why Info Incognito?
Deep Expertise
Mathematics, statistics, data management, and technology.
Real-World Experience
Extensive experience in data and medical-image de-identification.
Practical Solutions
Risk-based approaches that preserve data utility.
Trusted Partner
Objective, defensible, and well-documented methodology.