De-identified data has been stripped of any information that can be directly or indirectly used to identify an individual.
The process of de-identification typically involves:
- Removing direct identifiers (such as name or address), and
- Removing or altering other identifying information (indirect or quasi-identifiers, such as date of birth, gender, or profession).
Common de-identification methods include:
- Pseudonymization is the main technique for masking personal identifiers from data records to make individuals unidentified. It involves replacing real names with temporary IDs.
- K-anonymization is a data generalization technique implemented once direct identifiers have been masked. The process reduces re-identification risks by hiding individuals in groups and suppressing indirect identifiers for groups smaller than a predetermined number – k.
The concept of de-identified data is important for businesses that must comply with data privacy regulations, such as CCPA and CPRA, or GDPR. However, de-identified data is particularly crucial in healthcare, as it is expressly governed under HIPAA.
HIPAA names two appropriate methods of de-identifying data:
- The Expert Determination method involves a person with proper knowledge and experience applying statistical or scientific principles to determine the minimal risk of using or combining the information to identify an individual.
- The Safe Harbor method includes removing all 18 types of HIPAA identifiers. Additionally, the covered entity must attest that the information couldn’t be used alone or combined to identify an individual.
The HIPAA Privacy Rule no longer protects de-identified health information created following these methods because it does not fall within the protected health information (PHI) definition.
Learn more about data de-identification:
The most important benefits of data pseudonymization and anonymization under GDPR
