Medical AI · De-identification & privacy
We build and evaluate de-identification workflows for clinical data: structured records, free-text notes and medical images. Each workflow is designed around the intended use and access model, measured for what it misses and what it removes, and can run inside the hospital’s own environment.
Terms that matter
The words are often used loosely. The difference decides which rules apply and how the data may be used.
This page goes deeper on the de-identification work in our Medical AI practice. De-identification alone is not a guarantee of anonymity.
Removing or transforming identifiers so records are not readily linked to a person. In the US, HIPAA describes two routes: Safe Harbor, which removes 18 listed types of identifier, and Expert Determination, where an expert judges the re-identification risk to be very small.
HHS de-identification guidance →Replacing identifiers with codes, while whoever holds the key can still link back. It allows longitudinal studies and follow-up. Under the GDPR, pseudonymised data is still personal data.
EDPB guidelines on pseudonymisation →Data that can no longer be linked to a person by means reasonably likely to be used. That is a high bar for rich clinical data, and it depends on context: what else is available, who has access and what they could link it to.
GDPR, Recital 26 →That depends on the use, the jurisdiction and the data owner’s approvals. We implement and measure the technical side. Legal classification and approvals stay with your privacy officer, legal counsel and ethics committee.
Structured records
In tables, direct identifiers are simple to drop. The risk sits in combinations of ordinary fields.
Names, ID numbers, addresses, phone numbers and record numbers. Dropped, or replaced with keyed pseudonyms so the same patient keeps the same code across tables when the study needs linkage.
Age, sex, postcode, dates and rare diagnoses can single out a person in combination. Generalising (age bands, coarser places) or suppressing rare combinations lowers that risk. k-anonymity is one way to measure it.
Sweeney, k-anonymity, 2002 →Exact dates identify. Shifting all of one patient’s dates by the same random offset keeps the intervals, so time to event, length of stay and the order of events stay usable.
A very rare condition, an extreme value or a small site can identify a patient on its own. We look for small groups and outliers, and agree with the data owner how to handle them.
Free text
Names, dates, places and relatives appear anywhere in notes, letters and reports, often misspelled or abbreviated. Finding them is a detection task, and it should be measured like one.
Patterns and dictionaries for ID numbers, dates and phone numbers; trained named-entity models for names and places. Combining both usually beats either alone. Shared tasks such as the 2014 i2b2/UTHealth challenge give useful benchmarks.
Stubbs et al., 2015 →A missed name is a disclosure. An over-removed word is a loss of usefulness. Systems are usually tuned to find as many identifiers as possible, then checked for how much clinical content they remove.
Philter, npj Digital Medicine 2020 →Replacing a found name with a realistic substitute, rather than a [NAME] tag, makes any missed identifier harder to spot among the substitutes. It also keeps the text natural for later analysis.
Hebrew and mixed Hebrew-English notes, local ID formats and address conventions need their own rules and test sets. Tools built for English notes do not cover them.
Images
Medical images carry identifiers in headers, private tags, burned-in text and sometimes in the anatomy itself.
The DICOM standard’s confidentiality profiles list which attributes to remove, replace or keep. Options allow dates or longitudinal links to be kept when the study needs them.
DICOM PS3.15, Annex E →Ultrasound, screen captures and scanned documents can have names or IDs written into the pixels. We detect and mask that text, then check a sample by eye.
A 3D head scan can be rendered into a recognisable face. Defacing removes facial features before images are shared.
De-identifying medical images →What we measure
A de-identification workflow is only as trustworthy as its evaluation. We measure it on a sample of your own data, annotated for identifiers.
The share of true identifiers caught, by type: names, IDs, dates, places. Each miss is reviewed by a person, because one missed ID number matters more than an average suggests.
How much clinical content was removed or changed by mistake: drug names taken for surnames, eponyms, doses taken for dates. This decides whether the data stays useful.
The size of the smallest groups sharing the same quasi-identifiers, how many records are unique, and how each generalisation step changes that.
Whether an analysis or model built on the de-identified data performs as it does on the original, compared inside the secure environment where possible.
No method guarantees anonymity. We report what was measured, the remaining risk and its assumptions, so the data owner can decide.
Inside the hospital
Often the safest option is not to move the data at all.
We can work inside your research environment, under your access controls, and take out only approved outputs. Hosting, access and contracts are agreed with the data owner before work starts.
De-identification models, and any language models in the workflow, can run on infrastructure you control, so raw notes are not sent to outside services.
Define what information may reach an LLM or multimodal service, where it may be processed and how access is controlled. De-identification lowers the risk; it is one control among several.
Federated learning, differential privacy and synthetic data can widen collaboration without pooling raw records. Each trades some usefulness for privacy, and that trade-off should be measured, not assumed.
How an engagement runs
What counts as an identifier, and what must be kept, depends on who will use the data and for what.
Agree the downstream use, who gets access and where processing runs. List direct and quasi-identifiers per table, note type and image source.
Rules and models for each data type, keyed pseudonyms where linkage is needed, date shifting, and header and pixel cleaning for images.
Annotate a representative sample, measure identifiers found, over-removal and residual risk, and review every miss with your team.
A report of methods, results, remaining risk and assumptions for your privacy officer and ethics committee, plus the pipeline running in your environment.
We are not legal or regulatory consultants. We implement and measure the technical controls; compliance decisions stay with the data owner.
Sources
Before we start
Not necessarily. De-identification lowers the chance of linking data to a person; it does not guarantee anonymity. Whether data counts as anonymous depends on the law that applies, the context and what else is available. We measure residual risk; the legal decision stays with the data owner.
We test it on a sample of your data annotated for identifiers: identifiers found by type, clinical content removed by mistake, and residual risk in tables. Every miss is reviewed by a person.
Hebrew and mixed Hebrew-English notes need their own rules, models and test sets. We build and evaluate them on an annotated sample of your own notes, since formats differ between institutions.
It can help, but it needs the same evaluation as any other method, and it must run where the data is allowed to go. Raw notes should not be sent to an outside service to have their identifiers removed. We compare LLM-based and conventional approaches on your annotated sample.
Not always, but often it should. We can work inside your environment under your access controls, or on extracts the data owner has approved. This is agreed before work starts.
No. We implement and measure the technical side of de-identification and document it. Legal and regulatory decisions belong to your privacy officer, legal counsel and ethics committee. We are not legal or regulatory consultants.
Keep exploring
Medical AI · Clinical Data De-identification
Tell us what data you hold, how it will be used and who needs access. We’ll tell you what a de-identification workflow would involve and what the first step would be.
Please don’t include confidential datasets, credentials or patient information.