{
  "specification_version": "3.4.0",
  "source_document_revision": "AHj4eMT9yK21YUzFwGGh-vnHaxeOM8sbBtiC8OSfCm71Y1VYtWxOuiy2SG3GJI-8WRSfEwjhtEaCMBLoCWf40ZnyE823r9u8RkNjxBh2Qg",
  "table": "Administrative restrictions (section III.C.6)",
  "columns": [
    "Candidate combination",
    "P(collision)",
    "Secondary risk category",
    "Why the risk is not fully captured by P(collision)"
  ],
  "rows": [
    {
      "Candidate combination": "Member ID + Payer namespace alone",
      "P(collision)": "1e-6",
      "Secondary risk category": "Above threshold",
      "Why the risk is not fully captured by P(collision)": "Does not meet the 2e-12 threshold and is excluded on that basis, independent of any administrative review."
    },
    {
      "Candidate combination": "Subscriber ID + Group Number + Payer namespace",
      "P(collision)": "~1e-8",
      "Secondary risk category": "Data independence risk; recyclability risk",
      "Why the risk is not fully captured by P(collision)": "Group number is an employer-level field, not an individual-level field; it provides no incremental individual discrimination and may be shared by hundreds or thousands of members. Group number would transfer to a new member receiving a recycled subscriber ID and therefore provides no recyclability mitigation."
    }
  ]
}