Not all de-identification is created equal
HIPAA provides two paths to de-identification. Safe Harbor is the more basic approach - remove 18 identifiers and move on. Expert Determination is the more rigorous one - a statistically driven, flexible approach that preserves far more data utility while achieving stronger privacy posture.
{
"method": "expert_determination",
"dataset": "claims_q1_2026",
"privacy_model": "k-map + differential_privacy",
"linkage_tokens": "retained",
"geographic_fields": "preserved (3-digit zip)",
"clinical_dates": "preserved",
"demographic_fields": "generalized",
"re_identification_risk": "0.04%",
"data_utility_preserved": "94.2%",
"determination": "signed - expert opinion attached",
"status": "determined"
}Independent Assessment
Formal opinion through qualified statistical analysis, scoped to your use case.
Defensible Documentation
Signed PDF opinion that stands up to regulatory and procurement review.
Utility Preservation
Configurable remediation that preserves analytical value.
Speed
Days, not months. Automated profiling with expert validation.
What Expert Determination Provides
Safe Harbor applies a fixed set of rules regardless of context. Expert Determination adapts to your data, your use case, and your analytical needs.
Linkage Token Compatible
Scope re-identification risk when performing data linkage while using tokenization products for cross-dataset matching.
Flexible Remediation
Preserve insight over priority demographic fields, retain temporal elements for clinical dates, or configure age ranges to your needs. You choose the trade-off prioritization.
Formal Documentation
Every determination produces a signed PDF opinion based on qualified statistical analysis. Audit-ready for regulators, partners, and legal teams.
Alternative Privacy Models
Differential privacy, k-map analysis, generalization, truncation, and feature engineering. The privacy model matches the data and use case.
Synthetic Replacement
Replace real PHI in clinical notes with synthetic entities instead of redacting. Text reads naturally. Clinical context stays intact.
Higher Utility, Stronger Posture
Safe Harbor removes everything on the list. Expert Determination removes what's necessary and proves it with math. More useful data, stronger defensibility.
Safe Harbor vs. Expert Determination
Two HIPAA de-identification paths. Very different outcomes for your data.
| Safe Harbor | Expert Determination | |
|---|---|---|
| Approach | Remove or generalize 18 fixed identifiers | Statistical risk assessment through qualified analysis |
| Flexibility | None - rigid, predefined rules | Fully configurable per dataset, use case, and privacy posture |
| Linkage Tokens | Must be removed (identifier #18) | Can be retained with formally determined low re-identification risk |
| Data Utility | Lower - rigid removal destroys analytical value | Higher - optimized trade-offs preserve what matters |
| Documentation | Self-attestation - no expert required | Expert-signed PDF with statistical justification |
| Remediation | One-size-fits-all | Customer-directed trade-offs (geographic vs. demographic, date preservation, etc.) |
| Privacy Models | Not applicable | Differential privacy, k-map, generalization, truncation, feature engineering |
| Unstructured Data | Redaction only | Synthetic replacement ("hiding in plain sight") |
| Regulatory Defensibility | Moderate - follows the checklist | Strong - backed by statistical analysis, expert opinion, and formal documentation |
How Integral delivers Expert Determination faster
Traditional Expert Determinations take 3-6 months. Integral compresses this with programmatic systems for labor-intensive steps while keeping qualified experts in the loop where it matters.
Ingest & Profile
Connect your dataset from a data warehouse, cloud storage, or flat file. Integral profiles every column, detects data types, and maps potential identifiers automatically.
Assess Re-identification Risk
Statistical models calculate re-identification probabilities across every combination of quasi-identifiers. You see exactly where your risk concentrations are.
Recommend Remediation
Based on the risk profile, Integral recommends remediation strategies tailored to your use case. You choose the trade-offs; Integral identifies precise, defensible transformations scoped to your compliance requirements.
Expert Review & Determination
Qualified statistical analysis validates the methodology and produces a signed Expert Determination. A defensible artifact for regulators, partners, and legal reviews.
Determinations are version-controlled and automatically re-evaluated as your data changes. See Compliant Pipeline for full continuous monitoring capabilities.
Why Integral for Expert Determination
Expert Determination requires deep domain expertise, not just software. The right assessment depends on the data, the use case, the recipient class, and the regulatory context. Integral has delivered Expert Determinations across diverse data types, customer scenarios, and regulatory environments for years.
Every engagement produces a signed Expert Determination scoped to your specific data and use case - a formal opinion based on qualified statistical analysis that provides strong, defensible risk assessment. Not a generic report. Not a black-box score. A defensible artifact built for regulatory scrutiny, partner due diligence, and enterprise procurement.
Every engagement starts with your data and your use case. Every determination is built to defend.
Trusted by data teams across the regulated data supply chain, from originators and brokers to labeling platforms and model builders.
See what your data looks like after remediation
Integral shows you field-level transformations before you commit, so you can optimize the balance between privacy and utility.
Trusted by data teams
“Before Integral, compliance projects were a limiting factor. It would take months to get one done, and we still couldn't explain why certain decisions were made. Integral's approach is notably more creative and scalable than any other solution. Their operations process is very clean, which builds confidence with our clients. And by automating most of the process, Integral has cut our timelines in half. That speed has made a huge difference for us.”
“It felt like a true collaboration. Integral was responsive, detail-oriented, and genuinely invested in getting it right. That kind of partnership is rare in compliance work, and it is exactly what we needed to move with confidence.”
Frequently Asked Questions
What is Expert Determination and how does it differ from Safe Harbor? +
HIPAA provides two paths to de-identification. Safe Harbor requires removing 18 specific identifiers regardless of context. Expert Determination uses statistical analysis to formally assess re-identification risk, allowing you to retain more data utility while achieving stronger defensibility. The result is a signed opinion from a qualified expert that documents the methodology and justifies the approach.
How long does an Expert Determination take with Integral? +
Integral delivers Expert Determinations in days, not the 3-6 months typical of traditional approaches. Automated profiling and risk assessment compress the labor-intensive steps while qualified statistical analysis validates the methodology and produces the signed determination.
What does the Expert Determination deliverable include? +
You receive a signed PDF opinion with full methodology documentation, including the statistical models used, re-identification risk scores, remediation strategies applied, and the formal justification for why the dataset meets the de-identification standard. This document is audit-ready for regulators, partners, and legal teams.
What data types and formats do you support? +
Integral supports clinical notes, claims and Rx data, EHR / structured records, medical imaging (DICOM), genomic data, audio and voice recordings, and structured administrative datasets. Our platform handles multi-modal healthcare data with field-level remediation and configurable trade-offs for each data type.
Can Expert Determinations be updated when data changes? +
Yes. Determinations are version-controlled and automatically re-evaluated as your data changes. Integral's Compliant Pipeline continuously monitors for schema changes, data drift, and distribution shifts, triggering re-assessment when needed.
Is Expert Determination required for AI training data? +
If you are using healthcare data to train AI models, Expert Determination provides the strongest defensible posture for demonstrating that training data has been properly de-identified. It is particularly important when the model may be exposed to external parties or when regulatory scrutiny is expected.
See Integral in action.
Book a demo to see how Integral handles your regulated data types.