De-identification

De-identification is a general research-data-management and research-ethics concept — it is not, on its own, a single legal test or a single technique. What counts as “de-identified” depends on which regulatory or institutional framework is asking the question, and every framework converges on the same underlying problem: assessing how likely it is that a specific individual could be re-identified from the data as released, either alone or in combination with other information a realistic recipient could reasonably obtain.

Two frameworks account for most of the concrete de-identification rules a research administrator will actually apply. CASRAI covers each in full on its own page — this entry is the umbrella concept that sits above both.

HIPAA: two defined de-identification methods

In the United States, HIPAA's Privacy Rule is unusual among privacy regimes in that it defines de-identification as a formal legal category with two named methods at 45 CFR §164.514(a)-(b): Safe Harbor, which removes all eighteen enumerated identifier categories listed at §164.514(b)(2) (names, geographic subdivisions smaller than a state, all elements of dates except year, and so on) with no actual knowledge that the remaining information could identify someone; and Expert Determination, where a qualified statistician applies generally accepted statistical and scientific methods to conclude the risk of re-identification is very small, and documents that analysis. Data meeting either standard is no longer protected health information (PHI) and falls outside the Privacy Rule entirely. A related but narrower category — the Limited Data Set under §164.514(e) — keeps some indirect identifiers (dates, city/state) but still requires a signed Data Use Agreement restricting re-identification attempts; it is disclosable without authorization, but it is not itself de-identified data. See CASRAI's HIPAA Privacy Rule entry for the general framework, and HIPAA in Clinical Research for how de-identification fits alongside authorization and IRB/Privacy Board waivers specifically for research use of PHI.

GDPR: anonymisation, not de-identification, is the exit from scope

The GDPR does not use “de-identification” as a defined legal term at all, and conflating it with either of the GDPR's own two concepts is a common and consequential mistake. Article 4(5) defines pseudonymisation as processing personal data so it can no longer be attributed to a data subject without additional information, provided that additional information is kept separately and protected — but pseudonymised data explicitly remains personal data under GDPR (Recital 26), because the individual could still be re-identified if the separately-held key were obtained. Only genuine anonymisation — rendering the data subject “not or no longer identifiable” by any means reasonably likely to be used, accounting for cost, time, and available technology — takes data outside the GDPR's scope entirely. Article 89(1) names pseudonymisation as an accepted safeguard specifically for scientific research processing, and expresses a preference for full anonymisation over pseudonymisation wherever the research purpose can still be achieved without full identifiers. See CASRAI's GDPR entry and Privacy by design entry for how these safeguards fit into a controller's broader Article 25/89 obligations.

Re-identification risk: the concept underneath every framework

Underneath both frameworks sits the same statistical-disclosure-control problem. Removing direct identifiers (name, national ID number, email address) is rarely sufficient on its own: indirect or quasi-identifiers — date of birth, postal code, occupation, a rare diagnosis, a small sample size — can combine to re-identify someone even after every direct identifier is stripped, particularly when the dataset can be linked against other, publicly available data. GDPR's Recital 26 “all means reasonably likely to be used” test and HIPAA's Expert Determination “very small risk” standard are two regulatory expressions of this same underlying assessment, not two different problems. NIST Special Publication 800-188, De-Identifying Government Datasets: Techniques and Governance (September 2023), is the most complete framework-agnostic technical treatment of the underlying disclosure-risk assessment, applicable regardless of which regulatory regime governs a given dataset. CASRAI's Five Safes framework entry describes how “Safe Data” — appropriate minimisation and de-identification — functions as one control alongside safe people, projects, settings, and outputs in trusted research environments.

Why it matters in research data management

De-identification decisions typically surface at several concrete points in a research data lifecycle: describing the planned approach in a data management plan's sensitive-data handling section, determining whether a dataset still counts as human-subjects data requiring IRB/REC review or falls under a Common Rule exemption, negotiating a data sharing or data processing agreement with a collaborator, and deciding what a repository deposit can safely include. Where the residual re-identification risk of any de-identification approach remains too high for the intended sharing, synthetic data is an increasingly common alternative to releasing a marginally de-identified real dataset. None of these determinations substitute for the underlying legal analysis — informed consent under the Common Rule and a HIPAA or GDPR de-identification/anonymisation determination remain separate questions that can diverge. De-identification reduces privacy risk; it does not, by itself, resolve every applicable regulatory requirement.

References

• HHS Office for Civil Rights, HIPAA De-identification Guidance (Safe Harbor and Expert Determination methods), 45 CFR §164.514 — hhs.gov/hipaa/for-professionals/special-topics/de-identification
• GDPR Regulation (EU) 2016/679, Article 4(5) (pseudonymisation), Article 89(1) (research safeguards), Recital 26 (anonymous information) — gdpr-info.eu
• NIST Special Publication 800-188, De-Identifying Government Datasets: Techniques and Governance (September 2023) — csrc.nist.gov/pubs/sp/800/188/final