Video	Why it is in the working set
Video 6: Identifiers, Quasi-identifiers, and Uniqueness	Field classification is where most weak determinations go wrong
Video 8: Thinking Like the Adversary	The adversary model you adopt determines every number that follows
Video 9: Setting and Defending a Risk Threshold	The threshold is the choice a reviewer attacks first
Video 13: The Determination Report and Liability	The report is the only part of your work anyone will ever read

Video	What it teaches you to evaluate
Video 3: The Expert Determination Rule, Word by Word	Whether a determination actually satisfies each phrase of the rule
Video 5: Very Small Risk: The Three Principles	Why there is no number, and what a defensible threshold argument looks like
Video 9: Setting and Defending a Risk Threshold	Whether the number you were given has provenance
Video 13: The Determination Report and Liability	Whether the report you are holding would survive an audit

Term	Meaning in this course
Covered entity	A health plan, health care clearinghouse, or provider subject to HIPAA. Makes the determination; the expert renders the opinion.
Business associate	A party handling PHI on a covered entity's behalf. Needs a BAA that explicitly authorizes de-identification before an expert may work on identifiable data.
PHI	Protected health information. Exits HIPAA entirely once properly de-identified.
§164.514(a)	The de-identification standard: information that does not identify an individual and for which there is no reasonable basis to believe it can be used to identify one.
Safe Harbor	§164.514(b)(2). Remove eighteen categories of identifiers and have no actual knowledge the remainder could identify. Simpler, not safer.
Expert Determination	§164.514(b)(1). A qualified person applies generally accepted statistical and scientific methods, determines the risk is very small, and documents the methods and results.
Limited Data Set	Removes sixteen direct identifiers but keeps dates and geography. Still PHI; requires a data use agreement.
Pseudonymization	Replacing identifiers with codes. A technique, not a HIPAA status; derived codes remain fully regulated PHI.
Re-identification code	§164.514(c). A code permitting the covered entity to re-identify, allowed only if not derived from the individual's information and not disclosed.
Direct identifier	A field that names a person alone: name, SSN, MRN, address, phone, email, biometric.
Quasi-identifier	A field that identifies nobody alone but combines into a fingerprint: age, sex, ZIP, dates, race, rare diagnoses. Contextual, not intrinsic.
Sensitive attribute	The payload worth protecting: diagnoses, treatments, labs, genomics, billing.
Equivalence class	The group of records sharing the same quasi-identifier values.
k	The size of the smallest equivalence class. Probability of a correct pick within a class is at most 1/k.
k-anonymity	Every equivalence class holds at least k records (Sweeney, 2002). Protects identity, not attributes.
l-diversity	Every class holds at least l well-represented sensitive values. The variant (distinct, entropy, recursive) changes the verdict.
t-closeness	Each class's sensitive-attribute distribution is within distance t of the table's (Li et al., 2007), measured by Earth Mover's Distance.
Differential privacy	A guarantee that any output changes by at most a factor of e^ε whether or not one person is in the data. Protects outputs, not truthful microdata.
Laplace mechanism	Adds noise with scale b = sensitivity / ε. For a count at ε = 1: b = 1, standard deviation 1.41.
Prosecutor risk	Adversary knows the target is in the data. Maximum risk = 1 / smallest k.
Journalist risk	Membership unknown; any record will do. Maximum risk = 1 / smallest population class K.
Marketer risk	Bulk re-identification. Average of 1/k across all records. Always prosecutor ≥ journalist ≥ marketer.
Sample vs population uniqueness	Unique in your file versus unique in the world. Only population uniqueness identifies anyone; estimators (Pitman, Zayatz) bridge the gap.
Suppression / generalization / perturbation	The three mitigation classes named in the OCR guidance: delete values or records; coarsen into bands; replace true values with noisy ones.
Complementary suppression	Suppressing additional cells so a masked cell cannot be recovered by subtraction from totals.
Five Safes	Safe projects, safe people, safe settings, safe data, safe outputs. A scaffold for context assessment; each pillar needs a named document.
Data use agreement (DUA)	A contract binding the recipient. Not statutorily required for de-identified data, but a weighable control that lowers attempt probability.
Attestation letter	The two-page deliverable that circulates: invokes the rule, states competence, scope, method categories, the conclusion, conditions, and signature.
Disclosure Review Board	A standing committee with a charter that reviews risk math and code and records dissent.
Contractual envelope	No-re-identification clauses in both directions, downstream flow-down, a public commitment in the privacy policy, method disclosure, and state riders.
FTC three-part test	Data is "not reasonably linkable" only if the company takes reasonable de-identification measures, publicly commits not to re-identify, and contractually binds recipients. Now codified in at least eight state statutes.

After this video you can

In this video

Who this course is for

How to use this series

The working set: four videos to rewatch before real work.

The compliance track: four videos for privacy officers, compliance leaders, and counsel.

Glossary for the series

Key takeaways

Coming next: Video 2, The De-identification Standard