All apps

De-identification · Privacy / Data-Governance leads

CuRE Curtain

De-identification review — inspect de-id transforms and re-identification risk, and gate data releases.

Part of Safety & Quality

What it does

De-identification review — inspect de-id transforms and re-identification risk, and gate data releases. Curtain renders the de-identification and risk work computed by Conduct and Calculate against one governed OMOP record — not a bolt-on privacy tool with its own copy of the data.

Key capabilities

  • De-identification review and approval
  • Re-identification-risk inspection (k-anonymity & risk scoring)
  • Human-in-the-loop release gating
  • Audit-ready privacy-review trail
  • Field-level de-id transform review (approve/query)
  • Quantitative re-id-risk metrics (prosecutor/journalist/marketer)
  • Longitudinal re-id-risk monitoring

What sets it apart

  • The de-id review workbench renders prosecutor/journalist/marketer risk and population-uniqueness against a threshold — the numbers a privacy officer signs an Expert Determination on — not just binary k/l/t flags.
  • Curtain renders the de-identification and risk work computed by Conduct and Calculate against one governed OMOP record — not a bolt-on privacy tool with its own copy of the data.
  • Re-identification risk is scored on the same governed substrate the rest of CuRE analyzes, so privacy review and analytics never drift apart.
  • Release gating is a human-in-the-loop review over Conduct's release engine — de-identification decisions are inspectable, not a black box.
  • Built on the platform's audit and e-signature primitives, so privacy review shares one validation story with the rest of the evidence chain.
CuRE Curtain · De-identification review
Live demo — synthetic data, runs in your browser

Gate a release on re-identification risk

Tune k-anonymity, l-diversity, t-closeness, and the generalization budget on a synthetic OMOP release, and watch the equivalence classes reform, the privacy↔utility tradeoff shift, and the export gate open or close — computed live in your browser by the same generalize-then-suppress fixed point the product runs.

A synthetic release of 140 records — quasi-identifiers age, zip, sex and a sensitive diagnosis.

Minimum equivalence-class size. Classes smaller than k are generalized or suppressed.

Distinct diagnoses required per class — guards against the homogeneity attack.

Max EMD between class and global sensitive distribution (numeric attributes).

How far age can bin (10→20→40…) and ZIP can truncate (5→3→*) before a class is suppressed instead.

Over-suppressed
46 records suppressed to satisfy the thresholds — loosen k / l or raise the generalization budget to keep more.
🔒
Records released
94
of 140 · 67% retained
Suppressed
46
too identifying to release
Classes clearing gate
6/14
min class size 1
Privacy posture
43%
classes passing k·l·t

Privacy ↔ utility tradeoff

Privacy (classes passing)
43%
Utility (records retained)
67%

Tighten k or l and privacy rises but utility falls as more records suppress; spend more generalization budget to recover utility by merging classes instead. That is the officer's whole job — and it is a real fixed-point computation here, not a mockup.

Equivalence classes · generalized [age | zip | sex]

Generalized quasi-identifierSizeℓkltDisposition
0-39 · 020 · *96✗✓✓Suppressed · k
80-119 · 021 · *83✗✓✓Suppressed · k
40-79 · 020 · *86✗✓✓Suppressed · k
0-39 · 024 · *75✗✓✓Suppressed · k
40-79 · 024 · *65✗✓✓Suppressed · k
80-119 · 020 · *42✗✓✓Suppressed · k
0-39 · 021 · *33✗✓✓Suppressed · k
80-119 · 024 · *11✗✗✓Suppressed · k/l
20-29 · 021 · *257✓✓✓Released
60-69 · 021 · *165✓✓✓Released
40-49 · 021 · *166✓✓✓Released
30-39 · 021 · *154✓✓✓Released
70-79 · 021 · *115✓✓✓Released
50-59 · 021 · *116✓✓✓Released

Each row is an equivalence class after generalization — note how age widens into decade bins, zip truncates to three digits, and sex redacts to *. k-anonymity, l-diversity (distinct diagnoses), and t-closeness are computed in your browser for every class; nothing calls a backend.

Why this is more than a toy

This is a faithful, dependency-free copy of CuRE's re-identification-risk methodology — the same equivalence-class formation, k-anonymity, distinct l-diversity, and 1-D Earth Mover's Distance t-closeness (Li, Li & Venkatasubramanian 2007), driven by the identical fixed-point generalize-then-suppress loop. In the product that methodology is owned by CuRE Calculate and rendered by Curtain for a privacy officer to gate a release against 45 CFR §164.514 Expert Determination; here it runs entirely client-side on synthetic records. Every k, ℓ, and t figure is recomputed in your browser — no backend.

Request a demo

See CuRE Curtain in action

Every research ecosystem is unique. Let's discuss how CuRE can be configured for your needs.

Get in Touch