Anonymous Until It Isn't

Every healthcare AI conversation I sit in eventually arrives at the same reassuring sentence: “It’s fine, the data’s de-identified.” It works like a password. Strip the names and the birthdays and the ZIP codes, and the data stops being protected health information, which means it falls outside HIPAA, the lawyers exhale, and the model training can begin. I’ve said the sentence myself, more than once.

A 2019 study in Nature Communications by Luc Rocher, Julien Hendrickx, and Yves-Alexandre de Montjoye spent some time taking that password apart. Using a generative model, the team found that 99.98 percent of Americans could be correctly re-identified in any dataset using just 15 demographic attributes. Not a carefully chosen dataset. Any dataset. The number has stuck with me because the entire economic logic of de-identified health data assumes the opposite is true.

HIPAA gives you two ways to de-identify data, both laid out in the Privacy Rule’s de-identification guidance. The first is Expert Determination, where a qualified statistician documents that the re-identification risk is very small. The second, and the one almost everyone actually uses, is Safe Harbor: delete 18 specified categories of identifiers (names, dates, geography below the state level, and so on), and as long as you have no actual knowledge that what’s left could identify someone, the data is no longer PHI.

That’s the bargain. Once the 18 identifiers are gone, the data walks out from under HIPAA entirely and can be used for any purpose. It’s a clean, rule-based checklist, which is exactly why it’s popular (you can hand it to an engineer and they’ll apply it deterministically). The trouble is that the bargain rests on an assumption baked into the standard itself: that de-identification is a one-way door. Release the data, forget the patient.

What’s easy to miss is that HHS never actually promised the door was locked. The guidance says outright that both methods, even applied correctly, still leave data with some residual risk of identification. The two words that get dropped in practice are “some risk.” We treat de-identified as a synonym for safe. It was never meant to be.

Rocher’s team built a copula-based generative model that estimates how likely a given record is to belong to one specific person, even when the dataset is heavily incomplete (the partial, sampled extracts that get sold and shared all the time). Across 210 populations, the model predicted individual uniqueness with AUC scores between 0.84 and 0.97. Then came the headline result: 15 attributes, things as ordinary as age, gender, and marital status, are enough to single out virtually everyone.

The part that matters for anyone building in this space is how the re-identification happens. It’s machine learning doing the work. The same class of technique we use to pull signal out of messy health data is the technique that pulls a named individual back out of a dataset we swore was anonymous. De-identification and re-identification are running on the same engine, and the engine keeps getting better while the 18-identifier checklist stays frozen.

De Montjoye framed the practical objection well in the press materials around the paper. Organizations reassure themselves that the datasets they release are incomplete, so re-identification can’t really work, and his finding is that this “might not help.” Incompleteness was the last line of defense. The study walked right through it.

Here’s the contrast I can’t stop thinking about. HIPAA is, right now, in the middle of its first serious technical overhaul in over a decade. The proposed Security Rule update, published in early 2025 and still grinding through more than 4,700 public comments as of this writing, would make encryption and multi-factor authentication mandatory, require a living inventory of every system that touches ePHI, and strip away the old “addressable” wiggle room. It’s a real answer to a real threat environment. Large breaches hit more than 286 million people in 2024 alone.

But notice what’s being hardened. The Security Rule governs how you protect health data that’s inside your walls. All that encryption and segmentation and asset-mapping is about keeping the vault shut. The de-identification standard is a different animal. It’s the rule that decides which data gets to leave the building with no HIPAA protection at all. And that standard, the one machine learning most directly undermines, lives in the Privacy Rule and hasn’t fundamentally moved since the list of 18 identifiers was first written more than two decades ago.

We are reinforcing the vault and leaving the side door propped open. The data we hand out freely, because a checklist told us it was no longer PHI, is precisely the data Rocher’s model is best at unwinding.

None of this means de-identified data is useless or that you should stop using it. It means treating “it’s de-identified” as the end of the privacy conversation is a mistake, and an expensive one to keep making. The honest mental model isn’t a switch that flips data from protected to safe. It’s a dial, and the dial reads “residual risk that climbs every year the models improve.”

For teams shipping healthcare AI, that reframing has teeth. Safe Harbor is cheap and deterministic, but for anything feeding a model (especially a model that might memorize and resurface its training data) Expert Determination is the more defensible path, because it actually reasons about your data, your recipients, and a realistic attacker. Minimize the attributes you retain, because every quasi-identifier you keep is one of Rocher’s 15. And write re-identification prohibitions into your data agreements even when HIPAA doesn’t force you to, because the regulation describes a world with fewer generative models in it than the one you’re operating in.

The number to keep on a sticky note is 15. That’s how many ordinary facts it takes to find almost anyone. The checklist deletes 18 identifiers and calls it done, but it was built for a time when re-identifying a person was hard. That time is over, and the rulebook hasn’t caught up.