Determined, not just de-identified.
A signed, scoped opinion on re-identification risk from qualified statistical experts. Built to be examined. Expert Determination is the highest standard of defensibility under HIPAA, and Integral delivers it in days, not months.
What Expert Determination is
Under HIPAA, Expert Determination (§164.514(b)(1)) is one of two recognized methods for de-identification. A qualified statistical expert applies accepted statistical and scientific principles to evaluate re-identification risk and documents that the risk is very small. The result is a signed, defensible opinion that travels with the data.
Unlike Safe Harbor, which follows a fixed list of 18 identifiers, Expert Determination is scoped to the specific dataset, the intended use, and the recipient. It preserves more data utility because remediation is targeted to the actual risk, not a generic checklist.
Infrastructure privacy is not data privacy
SOC 2 secures the container. Expert Determination assesses the contents. Infrastructure controls protect data in transit and at rest. Expert Determination evaluates whether the data itself can be re-identified, given the specific scope of the engagement.
How Expert Determination works at Integral
Scope the engagement
Define the dataset, the intended use, the recipients, and the regulatory context. The scope determines the assessment boundaries.
Statistical risk assessment
Qualified statistical experts analyze the dataset for re-identification risk using accepted statistical and scientific principles.
Remediation guidance
Where risk exceeds the threshold, the expert specifies targeted remediation. Integral engineers the remediation to preserve signal.
Signed determination
The expert issues a signed opinion with full methodology provenance. The determination is scoped, specific, and built to be examined.
Continuous re-assessment
As data, recipients, or context evolve, the determination is re-evaluated. Documentation stays current.
Why it matters
Defensible under examination
Every determination is signed, scoped, and documented with full methodology provenance. It is built to withstand regulatory and legal scrutiny.
Days, not months
Integral's platform automates the heaviest parts of the assessment workflow. Most engagements reach a signed determination in days.
Utility preserved
Remediation is targeted to actual risk. Data retains its analytical and training value because the engineering is scoped to what matters.
Trusted by teams building on sensitive data
“It felt like a true collaboration. Integral was responsive, detail-oriented, and genuinely invested in getting it right. That kind of partnership is rare, and it is exactly what we needed to move with confidence.”
“Integral provided the expertise and structure we needed to turn complex, regulated healthcare data into actionable insights. Their team is consistently responsive, highly knowledgeable, and deeply collaborative. They bring a level of rigor, attention to detail, and flexibility that is critical in this space.”
“Before Integral, compliance projects were a limiting factor. It would take months to get one done, and we still couldn't explain why certain decisions were made. Integral's approach is notably more creative and scalable than any other solution. Their operations process is very clean, which builds confidence with our clients. And by automating most of the process, Integral has cut our timelines in half. That speed has made a huge difference for us.”
Frequently asked questions
Is Expert Determination only for HIPAA-covered data?
Expert Determination is defined under HIPAA (§164.514(b)(1)). For non-HIPAA regulated data, Integral provides equivalent independent assessments and signed defensibility opinions using the same statistical methodology.
What is the difference between Expert Determination and Safe Harbor?
Safe Harbor follows a fixed list of 18 identifiers. Expert Determination is a statistical assessment scoped to the specific dataset and use case. It preserves more data utility and provides a higher standard of defensibility.
Who performs the determination?
Qualified statistical experts with demonstrated experience in privacy risk assessment. Integral's experts apply accepted statistical and scientific principles as required under HIPAA.
How long does it take?
Most engagements reach a signed determination in days. Timeline depends on dataset complexity, but the platform automates the heaviest parts of the workflow.
What documentation is produced?
A signed Expert Determination opinion, full methodology provenance, remediation specifications (if applicable), utility metrics, and a re-assessment schedule.
