# Expert Determination

URL: https://sellmydatatoai.net/glossary/expert-determination

Expert Determination is the HIPAA de-identification method in which a qualified expert certifies that the risk of identifying anyone in the data is very small.

Expert Determination is the HIPAA de-identification method in [45 CFR 164.514(b)(1)](https://www.law.cornell.edu/cfr/text/45/164.514), under which a person with appropriate statistical and scientific knowledge determines that the risk of identifying an individual is "very small" and documents the methods and results.

## Who can make an Expert Determination?

Anyone with relevant expertise can make an Expert Determination. [HHS guidance](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html) says there is "no specific professional degree or certification program" for the role, and that the Office for Civil Rights would review the expert's background and experience. HHS sets no numerical risk threshold, because the right level depends on the data, the environment and the recipient.

## Does an Expert Determination expire?

The Privacy Rule does not require an expiry date, but HHS notes that some experts issue time-limited certifications and that a new release may need fresh review. For an AI license, the determination should name the recipient and its security and contract controls, because the risk depends on them.

Expert Determination suits clinical notes, images and longitudinal records that [HIPAA Safe Harbor](https://sellmydatatoai.net/glossary/hipaa-safe-harbor) would strip of value. Our [de-identification guide](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data) covers testing re-identification risk on a sample.