Beyond PHI Redaction: Automating Quasi-Identifier Discovery and Risk Analysis for Expert Determination

Removing names, record numbers, birthdates, and addresses is only the first step in de-identification. A dataset can contain no direct identifiers and still leave patients distinguishable. a 42-year-old in a small geographic area may not be unique, and neither may a patient with a rare disease – but combine age, geography, facility, admission period, and an uncommon diagnosis, and one patient may be the only person matching that profile. These quasi-identifiers aren’t defined by a fixed checklist. Their identifying power depends on the dataset, the patient population, and the release context, which means they must be discovered, not looked up.

This webinar shows how to automate quasi-identifier assessment for healthcare data end to end. We’ll demonstrate how to:

• profile a dataset and classify direct identifiers, candidate quasi-identifiers, sensitive attributes, and free-text fields, and the patient level
• detect rare clinical concepts at the patient level and evaluate which combinations of demographic, geographic, temporal, organizational, and clinical fields make patients distinguishable
• calculate group-size distributions, singleton rates, k-anonymity, l-diversity, and t-closeness, and generate risk-tiered samples so expert review starts with the highest-risk patients
• apply the least destructive mitigation – age binning, geographic generalization, date coarsening, clinical concept roll-up, or selective suppression – then recompute risk and measure the impact on data utility

A central example is rare disease risk. A diagnosis found in only one patient may require review, but the right response is often to generalize geography or time rather than remove the diagnosis researchers need. The goal is reducing re-identification risk while preserving clinical value, with a fully traceable record of profiling, transformations, and residual risk that supports HIPAA Expert Determination.

This webinar is intended for data architects, engineers, privacy professionals, and data scientists building de-identification workflows for research, analytics, and data sharing.