I need to suggest mechanisms for masking unique codes in a database with different unique codes that are not derived from the original unique codes, but are equivalently unique in that they could still be used to show the relationships of rows across multiple tables in the database.

And I need to show that there are multiple, simple mechanisms for doing this. Which mechanisms can I suggest?

Again, the new unique code or ID cannot be derived from the original and I can not know what mechanism is ultimately used to generate the non-identifying unique code. I just need to argue that it's easily done.

EDIT: I don't need to convince them to use a specific mechanism. I just need to convince a judge that there are standard mechanisms to choose from.

Any help is appreciated.

Here is the context for why I'm asking:

I have requested data from a government agency. The agency says it can give me most of the data I want, except for the unique IDs that show the relationships between the tables because these IDs could be used to identify individual people. The data are in multiple tables and are linked by these unique IDs.

These data are covered by HIPAA. And under HIPAA’s “safe harbor” de-identification method, any unique identifying number, characteristic, or code needs to be removed except as permitted by paragraph (c) of a section of the law titled “Re-identification.”

This is the "re-identification" section ,which says I can't be aware of the mechanism. And the new ID can't be derived from the old one:

The implementation specifications further provide direction with respect to re-identification, specifically the assignment of a unique code to the set of de-identified health information to permit re-identification by the covered entity.

If a covered entity or business associate successfully undertook an effort to identify the subject of de-identified information it maintained, the health information now related to a specific individual would again be protected by the Privacy Rule, as it would meet the definition of PHI. Disclosure of a code or other means of record identification designed to enable coded or otherwise de-identified information to be re-identified is also considered a disclosure of PHI.

(c) Implementation specifications: re-identification. A covered entity may assign a code or other means of record identification to allow information de-identified under this section to be re-identified by the covered entity, provided that: (1) Derivation. The code or other means of record identification is not derived from or related to information about the individual and is not otherwise capable of being translated so as to identify the individual; and (2) Security. The covered entity does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification.

  • 3
    $\begingroup$ LOL, we cannot help you there. Any method we propose is public and therefore disclosed :| $\endgroup$
    – Maarten Bodewes
    Jan 20, 2021 at 19:33
  • $\begingroup$ @MaartenBodewes Let me explain: The agency can use any mechanism that doesn't derive the dummy ID from the original ID, they just can't tell me what mechanism they used. I don't need to convince them to use a specific mechanism. I just need to convince a judge that there are standard mechanisms to choose from. Then the judge tells them to do it with a standard mechanism of their choosing. Just because the unique ID is redacted doesn't mean that the entire logic of the database should be redacted. $\endgroup$ Jan 21, 2021 at 0:05
  • $\begingroup$ Technically a substitute unique ID may be thought of as "de-identification", but if it is 1:1 with the original, even if not derived from the original, re-identification is quite possible. I'd look at differential privacy techniques to reduce entropy of the substitute IDs. I'm assuming you are not a "covered entity or business associate". $\endgroup$
    – pseudon
    Jan 21, 2021 at 16:11


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.