================================================================
 DEMENTIA DATAHUB PUF DISCLOSURE AUDIT CERTIFICATE
================================================================
Date:            2026-07-10 03:22:45 EDT
File audited:    P:/G278/Common/AIM 1 Data System/Simplified Suppression/DDH_2022_publishable.csv
SHA-256:         1ff751f354f29167df02597632f9d9d80acaef9d5467ab3b80fc95460f9ec317

Publication scheme:
  Bottom code '<11' spans [0, 10] (zeros folded)
  11-14 -> 11; 15-99 -> nearest 10; 100-999 -> nearest 50;
  1,000-9,999 -> nearest 100; 10,000-99,999 -> nearest 500;
  100,000-999,999 -> nearest 1,000; >= 1,000,000 -> 4 significant digits.
  Tie convention: half-away-from-zero (REQUIRED for production)

Attacker model: iterated differencing over every additive relation
derivable from the published file (dimension margins as equalities,
state>=sum(counties) and cross-measure numerator<=denominator as
inequalities), propagated to a fixpoint. Reported candidate counts are
INTERVAL bounds under iterated differencing: every bound is achievable
by a real attacker and no derivation in this class is missed, but an
interval may overstate the true integer-feasible set. Near-threshold
cells are additionally checked for integer holes, so reported exact
pins are not an artifact of interval width.

Cells audited:                       12457628
Vendor-suppressed (size unknown):    7069905
  NOTE: missing values in this file denote vendor-side suppression of unknown magnitude, not the '<11' bottom code.
Repair-recoded ('<X') cells:         42413
Sum relations / pairwise bounds:     19787516 / 9207812
Propagation iterations to fixpoint:  15

Cells exactly resolvable to a value in 1..10:   0
Cells resolvable only to 0 (permitted by CMS):  286
Feasible sets within 1..10 of size < 2:         0
Feasible sets within 1..10 of size < 3:         6
Narrow sets retaining 0 (existence-deniable):   10755

Criterion applied: no protected cell may have a feasible set that is a subset of [1,10] with fewer than 2 candidate values. Feasible sets containing 0 preserve existence-deniability and are never prohibited identifications.
RESULT: PASS

Notes:
Hybrid file: NORC rounding applied to vendor-delivered tables that already contained vendor-side suppression; missing values mean 'suppressed, size unknown', not the '<11' bottom code. Interval-code ladder capped at '<1000'; cells requiring wider protection are suppressed (blank) rather than coded. ATC is blanked wherever PREV_CNT is not a displayed numeric count. Certificate issued against a closed-loop re-audit of the written file (display values parsed directly from the published CSV). CMS-literal standard met: zero cells exactly determinable. 6 residual cells retain exactly 2 candidate values (retained in the internal release record); globally over-determined cells induced by vendor-side suppression. Production target remains k = 3 under the in-VRDC pipeline. 42413 cells display '<X' interval codes. 5109 cells suppressed by disclosure repair.
================================================================
