Re-identification risk testing
How residual risk is assessed per dataset before anything is released.
De-identification removes what identifies a person directly. Residual risk is what remains: the chance that someone could still be identified by combining what's left. Quarry assesses it for every dataset before release.
What's assessed
- Quasi-identifiers. Fields that could narrow identity in combination: age band, sex, region, dates, rare conditions, rare call types.
- Small groups. Combinations that describe very few people are generalised (wider bands, coarser regions) or suppressed.
- Free text. A sample of transcripts and reports is reviewed for details that slipped past entity detection.
- Linkage. Whether the dataset could be joined to public data to single someone out.
Legal standards
| Data | Standard |
|---|---|
| US health data | HIPAA Safe Harbor, or Expert Determination by a qualified expert |
| Indian personal data | Assessed under India's Digital Personal Data Protection framework |
| EU data, if any | Planned: assessed against GDPR's anonymisation standard |
The outcome
The assessment and its conclusion are part of the de-identification report. If the risk is too high, the dataset is generalised further or not released.
Your side
Licences prohibit attempts to re-identify anyone and linkage to other data to identify people. See the permitted-use matrix.