K-Anonymity Decay

HIPAA's Safe Harbor rule (45 CFR 164.514) lets health information be shared once 18 direct identifiers are stripped: names, addresses, dates, phone numbers, record numbers, and the rest. Under Safe Harbor, generalized details like an age decade, a broad region, or a diagnosis code are treated as sufficiently de-identified.

Here is the paradox. A clinician can ask a language model about a patient using only Safe-Harbor-compliant facts, an age decade, gender, race, a diagnosis, a medication, with none of the 18 prohibited identifiers, and still re-identify them. Each of those quasi-identifiers is harmless alone, but across a multi-turn conversation they accumulate and combine, and the patient's k-anonymity, the number of people who share the same attributes, collapses from thousands to single digits. Individual compliance does not guarantee cumulative privacy.

Across a typical clinical conversation, 79.9% of the simulated patients (3,994 of 5,000) fall to k < 5, and 86.2% (4,311) fall to k < 11. Both thresholds are borrowed from real policy: CMS suppresses cells smaller than 5, and Epic's Slicer Dicer requires IRB review for cohorts of 11 or fewer.

A single worked example makes the decay concrete. One simulated patient, a 60-year-old man with prediabetes, starts indistinguishable among the full population of 133,262. After six turns disclosing his age, gender, race, ethnicity, marital status, and a primary diagnosis, his k has collapsed to 2. The full, peer-reviewed results and figures live at the DOI.

The speed of collapse depends on the order in which details come out. The study models three disclosure patterns and reports the median number of turns to cross k < 5:

• Progressive (7 turns): demographics first, then clinical detail, the natural way a case tends to unfold.
• Random (8 turns): attributes disclosed in an unpredictable order.
• Rarity-ordered (4 turns, worst case): the rarest attributes first, which strips anonymity the fastest.

• Population: 133,262 synthetic patients from Synthea, with a 5,000-patient sample simulated through conversations.
• Quasi-identifiers: 11 attributes tracked, age decade, gender, race, ethnicity, marital status, primary and secondary condition, primary medication, a procedure indicator, an allergy indicator, and first-encounter year.
• Thresholds: k < 5 (CMS cell suppression) and k < 11 (Epic Slicer Dicer's IRB threshold).
• Privacy by construction: every patient is synthetic, so the whole study runs with no real PHI and no IRB.

• Paper: Frontiers in Digital Health. 2026;8:1832168. The official abstract and full text live at the DOI (open access).
• Code: the simulation and analysis are open source (MIT, Python) at github.com/JamesWeatherhead/k-anonymity-decay, which reproduces the results on public Synthea data.

Peer-reviewed and citable. Copy a ready-made citation, or read the official abstract at the DOI.

@article{weatherhead2026kanonymity,
  author  = {Weatherhead, James and Hasan, A. and Weatherhead, J. and Golovko, G.
             and Grant, B. and Garcia, J. D. and Certuche, H. S. and Powell, R. P.
             and Abril, J. M. and McCaffrey, P.},
  title   = {K-anonymity decay in multi-turn clinical large language model
             conversations},
  journal = {Frontiers in Digital Health},
  year    = {2026},
  volume  = {8},
  pages   = {1832168},
  doi     = {10.3389/fdgth.2026.1832168}
}

TY  - JOUR
AU  - Weatherhead, James
AU  - Hasan, A.
AU  - Weatherhead, J.
AU  - Golovko, G.
AU  - Grant, B.
AU  - Garcia, J. D.
AU  - Certuche, H. S.
AU  - Powell, R. P.
AU  - Abril, J. M.
AU  - McCaffrey, P.
TI  - K-anonymity decay in multi-turn clinical large language model conversations
JO  - Frontiers in Digital Health
VL  - 8
SP  - 1832168
PY  - 2026
DO  - 10.3389/fdgth.2026.1832168
ER  - 

{
  "type": "article-journal",
  "title": "K-anonymity decay in multi-turn clinical large language model conversations",
  "author": [
    { "family": "Weatherhead", "given": "James" },
    { "family": "Hasan", "given": "A." },
    { "family": "Weatherhead", "given": "J." },
    { "family": "Golovko", "given": "G." },
    { "family": "Grant", "given": "B." },
    { "family": "Garcia", "given": "J. D." },
    { "family": "Certuche", "given": "H. S." },
    { "family": "Powell", "given": "R. P." },
    { "family": "Abril", "given": "J. M." },
    { "family": "McCaffrey", "given": "P." }
  ],
  "container-title": "Frontiers in Digital Health",
  "volume": "8",
  "page": "1832168",
  "issued": { "date-parts": [[2026]] },
  "DOI": "10.3389/fdgth.2026.1832168"
}

• ASQ-PHI: the benchmark that scores whether de-identification methods actually remove PHI while keeping text useful, the companion contribution to this paper.
• Local PHI Scrubber: the on-device, human-in-the-loop redaction tool that applies this line of work at the point of use (AMIA 2026 oral).
• All three peer-reviewed papers, with plain-language summaries and BibTeX.