Healthcare: de-identifying medical records for teaching, research or second opinions

To de-identify a medical record, remove every detail that points to the patient: names, numbers, addresses, exact dates, faces, and clues hidden in free text. In the US, HIPAA lists 18 identifiers. In the EU, the GDPR has no list: you must judge whether anyone could still identify the patient. For a rare case, masking alone is not enough.

Why is a medical record harder to share than other documents?

Two layers of rules apply. First, data protection. In the EU, Article 9 of the GDPR bans processing health data unless an exception applies, such as explicit consent, care, or research with safeguards. Under Article 4(15), health data is personal data about physical or mental health that reveals a person's health status.

Second, medical secrecy, set by national law; Article 9(4) of the GDPR lets Member States add conditions for health data. In France, the Public Health Code protects all information about a patient; the Penal Code punishes a breach with up to one year in prison and a €15,000 fine, as the French medical council explains. In Germany, Section 203 of the Criminal Code allows up to one year or a fine.

What is the difference between HIPAA Safe Harbor and the GDPR?

HIPAA is US law. It binds US covered entities and their business associates. Its Privacy Rule (45 CFR 164.514) offers two routes. In Expert Determination, an expert documents that the risk of identification is very small. In Safe Harbor, you remove 18 listed identifiers and must have no actual knowledge that the rest identifies the person.

The GDPR test is about risk. In the UK, the ICO calls identifiability a spectrum and says the law does not require zero risk. The US health department (HHS) says the same of HIPAA: very small, not zero. Safe Harbor is a useful checklist in Europe, but passing it does not prove a record is anonymous.

Which 18 identifiers does Safe Harbor list?

1. Names
2. Places smaller than a State: street, city, county, ZIP code
3. Dates, except the year, and ages over 89
4. Telephone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate and license numbers
12. Vehicle identifiers and license plates
13. Device identifiers and serial numbers
14. Web addresses (URLs)
15. IP addresses
16. Biometric identifiers (finger and voice prints)
17. Full-face photos and comparable images
18. Any other unique number, characteristic or code

The list also covers relatives, employers and household members. Parts count too: HHS says initials, or the last four digits of a Social Security number, fail Safe Harbor. Take a fictional patient, Jane Example, the only lighthouse keeper on her coast. Her job alone gives her away.

Where do identifiers hide in letters, lab reports and imaging reports?

Mostly in free text. HHS explains that the rule makes no distinction between form fields and free text: a listed identifier must go wherever it sits. It warns that clinical narratives about history and lifestyle are rich in identifying context. Check these places.

• Header and footer: patient sticker, record number, ward, phone line.
• Opening line: Dear colleague, thank you for referring Mrs Example.
• People and life: GP, husband, employer, job, sports club.
• Lab reports: sample number, collection time, requesting doctor.
• Imaging reports: exam number, exam date, earlier exams quoted by date.
• Copy list: every recipient is a clue.

Safe Harbor keeps only the year, and HHS says this covers lab test dates. Europe has no fixed rule, but an admission date plus a town narrows the search fast. For teaching, keep the sequence, not the calendar: day 1, day 3, week 6. Give an age band, not a birth date.

What about scans, stamps, barcodes and handwritten notes?

A scan is a picture. Software must first read it with OCR, which reads print far better than handwriting. Do not count on it to find a margin note, a signature or a practice stamp: mask them by hand. Barcodes count too: HHS notes they are often unique to each patient.

Ultrasound images are a trap. The DICOM imaging standard notes that they routinely carry burned-in text, and that such pixels must be blacked out, not covered by a graphic. PDFs hide the same trap: a black box drawn over text can leave the text underneath, ready to copy.

How do you mask a medical document step by step?

1. Decide the purpose. A slide needs less than a research file.
2. Work on a copy. The original stays in the patient record.
3. Mask direct identifiers: names, addresses, numbers, barcodes, signatures, stamps, faces.
4. Generalise: dates become day numbers, age a band, a town a region, a job a sector.
5. Read the free text line by line for relatives, employers, places and events.
6. Export a flattened file. Search it for the surname and try to copy the text.
7. Let a colleague who does not know the patient read it. If they can guess, return to step 4.

Software speeds up step 3: detectors find names, dates and numbers faster than the eye. ONYRI Sanitize, for example, works inside the browser, so the file is not uploaded, and exports a flattened PDF with nothing under the masks. But it has no detector for medical terms and does not read handwriting automatically — mask handwriting by hand with the “Draw an area” tool. No tool knows that lighthouse keeper identifies Jane. Steps 4, 5 and 7 stay human work.

When is de-identification not enough?

When the case itself is the identifier. HHS gives the example of a rare clinical event reported in the media: removing the 18 identifiers does not help, because the facts alone reveal the patient. The same goes for very rare diseases, small communities and public figures.

Then you need governance. Ask the patient for explicit consent before a case report. For research, follow your ethics process: Article 89 of the GDPR requires safeguards, which may include pseudonymisation. For a formal second opinion, the second doctor needs the identity and joins the patient's care. Masking fits the informal question to a colleague.

Frequently asked questions

Sources & references