An Adversarial Analysis of the Reidentifiability of the Heritage Health Prize Dataset

I analyze the reidentifiability of the Heritage Health Prize dataset taking into account the auxiliary information available online and offline to a present-day adversary. A key technique is identifying providers, which is useful both as an end in itself and as a stepping stone towards identifying members. My primary findings are: 1. Grouping providers based on shared members results in the formation of clusters which likely correspond to hospitals; 2. There is enough auxiliary information to identify most of these hospitals, and possibly also individual providers; 3. An adversary who has detailed information about a member’s health conditions will be able to uniquely identify him or her; 4. While there are numerous websites where users can share reviews, health conditions, etc., their adoption is not currently high enough to serve as a source of auxiliary information for a large-scale member-reidentification attack. I provide bounds on the efficacy of the methods I describe, but time constraints prevented me from attempting a more complete attack. To the best of my judgment, reidentification is within the realm of possibility; however, it is far from straightforward and will require algorithmic sophistication as well as sleuthing for auxiliary data. While identification of providers might be useful to contestants for improving predictive performance, large-scale reidentification of members—that has the potential to pose a threat to privacy and to the fidelity of the contest—appears unlikely to be feasible due to the paucity of auxiliary information. ∗e-mail: [email protected]; web: http://randomwalker.info/