How to Choose a De-Identification Expert Determination Firm: A Security Risk Assessment Guide

Choosing a de-identification expert determination firm requires evaluating both its statistical approach and how it protects protected health information (PHI) while performing the work. Under the HIPAA Privacy Rule, Expert Determination is one of two methods for de-identifying PHI; it requires a qualified person to assess identification risk and document the methods and results. A separate security review can help you evaluate how the firm handles PHI during the engagement.

What qualifications should a de-identification expert determination firm have?

HIPAA does not require a particular degree, professional license, or certification to serve as an expert. The standard instead calls for a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable. HHS says relevant expertise may come from education and experience in statistical, mathematical, or other scientific fields, and notes that experience with health information de-identification methodologies is relevant. See HHS guidance on de-identification.

When assessing a firm, ask who will personally perform or supervise the analysis. Review the expert’s relevant education, training, professional experience, and prior work with health data. Ask the firm to explain how its team applies accepted scientific or statistical principles to your dataset and use case. A company’s marketing claims or a staff member’s general privacy experience alone do not establish that the person conducting the determination has the required expertise.

Also distinguish the Expert Determination work from the firm’s information-security practices. If the firm receives PHI as a business associate, its permitted use of that information—including de-identifying it—must be authorized by the applicable business associate agreement (BAA). HHS explains that business associate contracts address permitted uses, safeguards, breach reporting, subcontractors, and the return or destruction of PHI when feasible at termination. Review the agreement and the firm’s security evidence rather than treating a de-identification report as proof of secure handling. See HHS business associate contract guidance.

How does an expert assess whether identification risk is very small?

The Expert Determination method requires the expert to determine that the risk is “very small” that an anticipated recipient could identify a person using the data alone or together with other reasonably available information. The expert must then document the methods and results that support the determination. HIPAA does not prescribe one required statistical technique or a universal numerical cutoff for “very small.” See 45 CFR § 164.514 and HHS de-identification guidance.

A sound re-identification risk assessment should be specific to the dataset and its release context. Ask how the expert identifies vulnerable records or combinations of attributes, evaluates potential linkage, and decides whether to generalize, suppress, aggregate, or otherwise transform data. The expert should explain the assumptions and limits of the analysis, not just present a conclusion or a single risk score.

Because risk depends on the data and its environment, avoid relying on a firm’s claim that it applies the same threshold to every project. Ask how the firm will reassess risk if the dataset, release conditions, or recipient changes. HHS emphasizes that a risk assessment appropriate for one dataset and environment may not be appropriate for another.

How do anticipated recipients and available information affect the assessment?

The standard considers whether an anticipated data recipient could identify a person using the dataset alone or with other reasonably available information. The recipient and release context therefore matter. Relevant questions include who will receive the data, what information they can access, whether the data will be public or restricted, and what linkage opportunities may exist. Ask the firm to state which recipient and release conditions its conclusion assumes.

Discuss what outside information may reasonably be available to the anticipated recipient, including public records or other datasets, and how the recipient’s access and capabilities affect the assessment. HHS guidance describes evaluating the recipient’s ability to identify individuals and the information available in the specific environment. A determination tied to a defined recipient or setting should not automatically be treated as covering a materially different release.

Clarify whether the firm’s analysis covers only the fields in the supplied dataset or also considers contextual details and combinations of attributes that may make a record distinctive. The expert’s written assumptions should make it possible for you to understand when the conclusion applies—and when you should seek a new assessment.

What methods and results should the expert determination document?

The HIPAA rule expressly requires documentation of the methods and results of the analysis that justify the determination. It does not prescribe a particular report template. Ask for documentation detailed enough to show how the expert reached the conclusion and what dataset and release scenario it covers. See 45 CFR § 164.514(b)(1).

As a practical review, look for documentation that identifies:

• The dataset and version assessed, including the relevant data fields and intended release context.
• The anticipated recipient or recipient class and the assumptions about reasonably available information.
• The statistical or scientific principles and methods applied, including the approach to identifying and evaluating re-identification risk.
• The findings, limitations, and any transformations or risk-mitigation steps recommended or applied.
• The expert’s identity and relevant qualifications, along with the basis for the final determination.
• Conditions that could require reassessment, such as a material change in the dataset, recipient, or release environment.

This list is a procurement aid, not a claim that HIPAA mandates each item as a separate report element. The required core is that the expert apply the qualifying principles and methods, determine that risk is very small in the stated context, and document methods and results supporting that conclusion. The report should let you evaluate whether those requirements were addressed without mistaking a brief certificate or summary statement for the underlying analysis.

How does Expert Determination differ from HIPAA Safe Harbor?

Expert Determination and Safe Harbor are two distinct methods under the HIPAA Privacy Rule. Expert Determination relies on a qualified person’s application of generally accepted statistical and scientific principles and methods, followed by documentation of the analysis. Safe Harbor instead requires removal of specified identifiers and that the covered entity does not have actual knowledge that the remaining information could identify an individual alone or in combination with other information. See 45 CFR § 164.514 and HHS guidance on the two methods.

The Safe Harbor identifier categories include names, certain geographic details, specified date elements and ages over 89, contact details, account and record numbers, device identifiers, web addresses and IP addresses, biometric identifiers, full-face images, and other unique identifying numbers, characteristics, or codes. The rule also includes a condition concerning the covered entity’s actual knowledge. Because Safe Harbor follows specified criteria, do not assume that simply removing a few direct identifiers is enough.

Expert Determination may be useful when a project needs to retain data elements that Safe Harbor would require removing, but the expert must evaluate the resulting identification risk in context. Neither method makes the risk literally zero. For either method, consider the release circumstances and applicable contractual or legal restrictions; de-identification under HIPAA is not a blanket determination about obligations under every other law.

What evidence can help evaluate a firm’s security risk assessment process?

A de-identification determination evaluates identification risk; it is not, by itself, a HIPAA Security Rule risk analysis or proof that the firm is secure. HHS describes Security Rule risk analysis as assessing risks and vulnerabilities that could affect the confidentiality, integrity, and availability of electronic PHI, including the likelihood of occurrence. Ask the firm to explain its controls for protecting PHI during intake, analysis, storage, transfer, and disposal. See HHS guidance distinguishing risk analysis and risk management.

Depending on the services and information involved, request evidence such as a current security assessment or audit summary, written access-control and incident-response procedures, workforce training practices, encryption and data-transfer descriptions, retention and deletion procedures, and a list of subcontractors that may handle PHI. These are practical items to evaluate; they are not a universal HIPAA-prescribed checklist or a guarantee of compliance.

Review the BAA and related service terms to confirm that the firm’s use of PHI for the work is authorized and that responsibilities for safeguards, incident reporting, subcontractors, and return or destruction of PHI are addressed as applicable. HHS notes that a business associate may de-identify PHI only to the extent authorized by its agreement with the covered entity. See HHS guidance on business associates and de-identification and HHS sample business associate agreement provisions.

In short, choose a firm whose expert can explain and document a context-specific risk assessment, and whose security practices and contract terms address the handling of PHI throughout the engagement.

FAQs.

Does HIPAA require a specific degree or certification for a de-identification expert?

No. HIPAA does not specify a required degree or certification. The expert must have appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable. HHS identifies relevant professional experience, academic or other training, and actual experience with health information de-identification methodologies as relevant considerations. See HHS de-identification guidance.

Is there a universal numerical threshold for very small identification risk?

No. HIPAA does not set a universal numerical threshold for “very small” risk. The assessment depends on factors such as the dataset, anticipated recipient, and reasonably available information. See HHS guidance on acceptable identification risk.

What must an Expert Determination document include?

The rule requires documentation of the methods and results of the analysis that justify the expert’s determination. It does not prescribe a particular report format. The documentation should make clear what was assessed, what methods and assumptions were used, and how the results support the conclusion for the anticipated recipient and release context. See 45 CFR § 164.514(b)(1).

How does the Expert Determination method differ from Safe Harbor?

Expert Determination uses a qualified person’s statistical or scientific assessment to determine that identification risk is very small and requires documentation of methods and results. Safe Harbor requires removal of specified identifier categories and the absence of actual knowledge that remaining information could identify an individual. See HHS guidance on HIPAA de-identification methods.