Re-identification risk is the chance that data labeled as de-identified, anonymized, or otherwise privacy-preserving can still be linked back to a real person. In cyber security and privacy engineering, this matters because removing names is not enough: combinations of details such as dates, locations, diagnoses, rare events, or writing style can act like fingerprints.
In health-data pipelines, this risk appears when records are collected, cleaned, annotated, shared, or used to train models. Attackers may try linkage attacks by comparing a dataset with outside information to recover identities. Defenders reduce the risk with data minimization, stronger anonymization, access controls, output filtering, and formal re-identification testing. For clinical AI, the key question is not only whether direct identifiers were stripped, but whether the remaining data can still point back to a patient in practice.