# K-Anonymity Decay in Multi-Turn Clinical LLM Conversations

> A peer-reviewed study (Frontiers in Digital Health, 2026) showing how individually HIPAA-Safe-Harbor-compliant disclosures accumulate across a multi-turn clinical LLM conversation until a patient's k-anonymity collapses. Simulating 5,000 synthetic Synthea patients, 79.9% fall below k < 5. Open data, MIT-licensed code.

**Weatherhead J, Hasan A, Weatherhead J, Golovko G, Grant B, Garcia JD, Certuche HS, Powell RP, Abril JM, McCaffrey P.** K-anonymity decay in multi-turn clinical large language model conversations. *Frontiers in Digital Health.* 2026;8:1832168. https://doi.org/10.3389/fdgth.2026.1832168

- **Read at publisher:** https://doi.org/10.3389/fdgth.2026.1832168
- **Code on GitHub (MIT):** https://github.com/JamesWeatherhead/k-anonymity-decay
- **All publications:** https://james.jcweatherhead.com/research/

K-Anonymity Decay is a peer-reviewed study of a privacy paradox in clinical AI: each thing a clinician tells a language model can be individually compliant with HIPAA Safe Harbor, yet the quasi-identifiers pile up across a conversation until the patient is no longer anonymous. Simulating 5,000 synthetic patients, it shows that most fall below safe k-anonymity thresholds within a handful of turns, evidence that de-identification has to account for context, not just single messages. Published in Frontiers in Digital Health (2026), it is one of the three contributions in my dissertation on privacy-preserving clinical AI, alongside the ASQ-PHI benchmark and the Local PHI Scrubber.

## At a glance

| | |
|---|---|
| Simulated patients reaching k < 5 | **79.9%** (3,994 of 5,000) |
| Median turns to k < 5, worst case | **4** (rarity-ordered disclosure) |
| Quasi-identifiers tracked | **11** |
| Patient data | **100% synthetic** (Synthea) |

## The paradox it measures

HIPAA's Safe Harbor rule (45 CFR 164.514) lets health information be shared once 18 direct identifiers are stripped: names, addresses, dates, phone numbers, record numbers, and the rest. Under Safe Harbor, generalized details like an age decade, a broad region, or a diagnosis code are treated as sufficiently de-identified.

Here is the paradox. A clinician can ask a language model about a patient using only Safe-Harbor-compliant facts, an age decade, gender, race, a diagnosis, a medication, with none of the 18 prohibited identifiers, and still re-identify them. Each of those quasi-identifiers is harmless alone, but across a multi-turn conversation they accumulate and combine, and the patient's k-anonymity (the number of people who share the same attributes) collapses from thousands to single digits. Individual compliance does not guarantee cumulative privacy.

## What the study found

Across a typical clinical conversation, **79.9% of the simulated patients (3,994 of 5,000) fall to k < 5**, and **86.2% (4,311) fall to k < 11**. Both thresholds are borrowed from real policy: CMS suppresses cells smaller than 5, and Epic's Slicer Dicer requires IRB review for cohorts of 11 or fewer.

A single worked example makes the decay concrete. One simulated patient, a 60-year-old man with prediabetes, starts indistinguishable among the full population of 133,262. After six turns disclosing his age, gender, race, ethnicity, marital status, and a primary diagnosis, his k has collapsed to **2**. The full, peer-reviewed results and figures live at the DOI.

## Disclosure order changes how fast it happens

The speed of collapse depends on the order in which details come out. The study models three disclosure patterns and reports the median number of turns to cross k < 5:

- **Progressive (7 turns):** demographics first, then clinical detail, the natural way a case tends to unfold.
- **Random (8 turns):** attributes disclosed in an unpredictable order.
- **Rarity-ordered (4 turns, worst case):** the rarest attributes first, which strips anonymity the fastest.

## How it was measured

- **Population:** 133,262 synthetic patients from [Synthea](https://synthea.mitre.org/), with a 5,000-patient sample simulated through conversations.
- **Quasi-identifiers:** 11 attributes tracked, age decade, gender, race, ethnicity, marital status, primary and secondary condition, primary medication, a procedure indicator, an allergy indicator, and first-encounter year.
- **Thresholds:** k < 5 (CMS cell suppression) and k < 11 (Epic Slicer Dicer's IRB threshold).
- **Privacy by construction:** every patient is synthetic, so the whole study runs with no real PHI and no IRB.

## Data and code

- **Paper:** *Frontiers in Digital Health.* 2026;8:1832168. The official abstract and full text live at the DOI (open access): https://doi.org/10.3389/fdgth.2026.1832168
- **Code:** the simulation and analysis are open source (MIT, Python), reproducing the results on public Synthea data: https://github.com/JamesWeatherhead/k-anonymity-decay

## How to cite

BibTeX:

```bibtex
@article{weatherhead2026kanonymity,
  author  = {Weatherhead, James and Hasan, A. and Weatherhead, J. and Golovko, G.
             and Grant, B. and Garcia, J. D. and Certuche, H. S. and Powell, R. P.
             and Abril, J. M. and McCaffrey, P.},
  title   = {K-anonymity decay in multi-turn clinical large language model
             conversations},
  journal = {Frontiers in Digital Health},
  year    = {2026},
  volume  = {8},
  pages   = {1832168},
  doi     = {10.3389/fdgth.2026.1832168}
}
```

RIS:

```
TY  - JOUR
AU  - Weatherhead, James
AU  - Hasan, A.
AU  - Weatherhead, J.
AU  - Golovko, G.
AU  - Grant, B.
AU  - Garcia, J. D.
AU  - Certuche, H. S.
AU  - Powell, R. P.
AU  - Abril, J. M.
AU  - McCaffrey, P.
TI  - K-anonymity decay in multi-turn clinical large language model conversations
JO  - Frontiers in Digital Health
VL  - 8
SP  - 1832168
PY  - 2026
DO  - 10.3389/fdgth.2026.1832168
ER  -
```

CSL-JSON:

```json
{
  "type": "article-journal",
  "title": "K-anonymity decay in multi-turn clinical large language model conversations",
  "author": [
    { "family": "Weatherhead", "given": "James" },
    { "family": "Hasan", "given": "A." },
    { "family": "Weatherhead", "given": "J." },
    { "family": "Golovko", "given": "G." },
    { "family": "Grant", "given": "B." },
    { "family": "Garcia", "given": "J. D." },
    { "family": "Certuche", "given": "H. S." },
    { "family": "Powell", "given": "R. P." },
    { "family": "Abril", "given": "J. M." },
    { "family": "McCaffrey", "given": "P." }
  ],
  "container-title": "Frontiers in Digital Health",
  "volume": "8",
  "page": "1832168",
  "issued": { "date-parts": [[2026]] },
  "DOI": "10.3389/fdgth.2026.1832168"
}
```

## Related work

- [ASQ-PHI](https://james.jcweatherhead.com/research/asq-phi/): the benchmark that scores whether de-identification methods actually remove PHI while keeping text useful, the companion contribution to this paper.
- [Local PHI Scrubber](https://james.jcweatherhead.com/local-phi-scrubber/): the on-device, human-in-the-loop redaction tool that applies this line of work at the point of use (AMIA 2026 oral).
- [All three peer-reviewed papers](https://james.jcweatherhead.com/research/), with plain-language summaries and BibTeX.