The US National Institute of Standards and Technology (NIST) finalized SP 800-188 on September 14, 2023, defining de-identification as removing the association between identifying data and a data subject. The guide tells agencies to set privacy, access and usefulness objectives, survey direct and indirect identifiers, choose a sharing model, and validate both privacy protection and data utility.
The International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) published standard 27559:2022 as a framework for identifying and mitigating re-identification risks across the lifecycle of de-identified data, applicable to organizations of any size. These frameworks treat name removal as one possible transformation, not a completed risk assessment or a legal verdict that transfers across countries.
A health artificial intelligence (AI) project therefore needs three separate decisions: whether the data use is authorized, whether the disclosure risk is acceptable for the intended recipient, and whether the transformed data remain fit for the model's task. A separate APPI News analysis applies the same separation to authorization, data quality and clinical evidence for insurance claims.
Names are only the direct-identifier layer
The Organisation for Economic Co-operation and Development (OECD) defines de-identification as altering personal health data so the result cannot be readily associated with particular individuals, then states that de-identified data are not anonymous data. Its health-data recommendation, adopted on December 13, 2016, calls for review and approval procedures, security controls, monitoring and a defined legal basis for secondary use.
Direct identifiers point to a person on their own, while quasi-identifiers can identify someone when combined with other fields or outside information. A health record can lose a name and patient number yet remain linkable through an exact date, a small location, a rare sequence of events or text embedded in an image.
Pseudonymization replaces an identifier with a code so records can still be matched across time. The code, lookup table or repeatable transformation preserves a route back to the person, so the mapping and keys need separate protection and access control.
| Data layer | Health-data examples | Review question |
|---|---|---|
| Direct identifiers | Name, national or local identifier, phone number, email address and patient number | Were the fields removed, replaced or confined to a separately controlled system? |
| Quasi-identifiers | Exact dates, small locations, age, rare conditions and unusual visit sequences | Can the combination single out a record when joined with information available to the recipient? |
| Embedded identifiers | Free text, image labels, barcodes, filenames and document metadata | Did the survey cover every file type and derived field, rather than only database columns? |
| Linkage material | Lookup tables, encryption keys and stable pseudonyms | Who can use the mapping, where is it stored and how is that access recorded? |
The recipient and release model change the risk
NIST describes several sharing models: publishing a transformed file, producing synthetic data, providing a controlled query interface or keeping data in a non-public protected enclave. A review has to name the chosen model because a downloadable file, a named research team and an automated service do not present the same recipients or opportunities for linkage.
| Sharing model | Evidence the release record needs |
|---|---|
| Published extract | Fields released, expected outside data, re-identification test, version and withdrawal or correction plan |
| Protected enclave | Approved users, authentication, permitted tools, download controls, logs and output review |
| Query interface | Allowed queries, result limits, logging and tests for information accumulated across repeated requests |
| Synthetic dataset | Source provenance, generation method, privacy property, fidelity tests and limits on intended use |
ISO/IEC 27559 places re-identification risk inside the full lifecycle rather than at a single export step. New public records, a broader recipient group, another release from the same source or a changed analysis environment can make an earlier assessment stale.
Access controls and contracts do not erase identifiers, but they can reduce who receives the data and what those recipients can do with it. The release file should connect technical transformation to user approval, retention, logging, output review and an owner who can suspend access.
US health rules are an example, not a worldwide safe harbor
The US Department of Health and Human Services (HHS) describes two de-identification methods under the US Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule: Expert Determination and Safe Harbor. HHS also says properly applied methods leave a very small but nonzero identification risk and that Expert Determination has no universal numerical threshold.
Safe Harbor removes specified identifiers and requires the covered entity to lack actual knowledge that the remainder could identify a person, while Expert Determination evaluates risk for an anticipated recipient using reasonably available information. Those are rules for covered health information under US law; they do not establish that the same file is anonymous or lawfully usable in the European Union, Japan, Taiwan or another market.
APPI News could not find one published legal or numerical test that makes a health dataset anonymous in every country at the time of writing. A cross-border project must therefore record the applicable country, data controller, authorized purpose and transfer conditions instead of applying an unqualified “de-identified” label.
Personal uploads can reveal identifiers outside the report body
A health report can carry identifiers in its visible text, barcode, quick-response (QR) code, filename, document properties, scanned image or free-text notes. A field inventory that examines only the main table can therefore miss information sent with the file.
- The service's published terms determine retention, model-training use, staff access and deletion; changing the file does not change those terms.
- The minimum dataset depends on the stated task, and many tasks can be defined without transferring a complete original file.
- Visible fields, embedded text, metadata and stable codes need one inventory because their combinations can narrow a record to one person.
- An AI-generated summary can reproduce sensitive details from the input, so its storage and sharing path belongs in the same review.
These checks reduce the amount of information exposed, but they cannot turn a general-purpose AI service into an approved health-data environment. They also say nothing about whether the service's output is accurate, complete or suitable for a clinical decision.
Health AI projects need six linked records
A hospital or developer can organize the evidence into six linked records before health data enter an internal model, cloud application programming interface or research environment. This structure is an APPI News synthesis of the cited sources, not an ISO certification, a NIST test or a legal standard in any country.
- Purpose and authority. Name the task, data controller, applicable country, legal basis or approval, intended recipients, retention period and permitted outputs.
- Data inventory. Record structured fields, free text, images, filenames, metadata, derived values, provenance, collection period and known missingness.
- Transformation and key custody. Document every removed, generalized, suppressed or pseudonymized field, together with the location and owner of any lookup table or key.
- Access and release model. Identify users, systems, authentication, permitted operations, download rules, logs, subcontractors, processing locations and the response to unauthorized access.
- Privacy and utility tests. Test linkage against outside information available to the intended recipient, then compare the transformed data with the source for the measures the project needs.
- Change and incident control. Set review triggers for a new data release, recipient, outside dataset, model version or purpose, and assign authority to restrict access, investigate and correct prior releases.
Each record can fail independently. A lawful purpose does not lower re-identification risk, a low-risk release does not prove that the labels are accurate, and a useful dataset does not establish that a medical AI system performs safely in practice.
De-identification can change the data a model learns from
NIST's Privacy-Enhancing Technologies Testbed says de-identification mechanisms can distort data distributions by introducing artifacts and bias, and it evaluates privacy, fidelity and utility as separate properties. The page was updated on March 19, 2026 and describes more than 500 de-identified excerpts in its tabular-data benchmarking work.
Generalizing dates can alter time intervals, grouping locations can hide site effects, and suppressing rare combinations can remove cases that matter to a model evaluation. The project needs to compare distributions, missingness, labels and subgroup coverage before and after transformation rather than treating a successful privacy test as a quality check.
The International Medical Device Regulators Forum's January 27, 2025 principles call for representative clinical datasets, training and test data that remain appropriately independent, testing under clinically relevant conditions and monitoring after deployment. The principles cover AI-enabled medical devices and do not authorize a product or set legal rules for every health AI use.
APPI News's subgroup-testing analysis explains how an overall score can conceal performance differences across patients, sites and devices. A separate review of synthetic medical data covers provenance, independent testing, task-specific measures and monitoring.
A release decision needs limits and an update trigger
A defensible release record states what was tested, which outside information was considered, who was expected to receive the data and which dataset version passed. It also records unresolved outliers or vulnerable groups instead of converting one average risk estimate into a guarantee for every record.
The review needs a date and a trigger for reassessment because data availability, computing methods and recipients change. Releasing another extract from the same source can also expose information through the combination of versions even when each file appears limited on its own.
De-identification can lower disclosure risk while preserving useful information, but the result remains tied to a purpose, recipient and environment. For health AI, the evidence ends with separate findings on authorization, privacy, data utility and model performance, all linked to the same version and use case.
Frequently asked questions
Does removing names make health data anonymous?
No. Dates, locations, unusual conditions, event sequences, text and metadata can act as quasi-identifiers when combined with other information.
Is pseudonymized health data anonymous?
No. Pseudonymization preserves a code or another mapping that can reconnect records to a person, so the mapping and its access controls remain part of the risk review.
Can de-identified health data go straight into AI training?
No. The project still needs a valid basis for the use, a recipient-specific privacy assessment, a data-utility check and model testing that matches the intended population and setting.
Sources and further reading
- De-Identifying Government Datasets: Techniques and Governance（US National Institute of Standards and Technology）NIST SP 800-188, final, September 2023
- ISO/IEC 27559:2022: Privacy enhancing data de-identification framework（International Organization for Standardization）
- Recommendation of the Council on Health Data Governance（Organisation for Economic Co-operation and Development）
- Guidance Regarding Methods for De-identification of Protected Health Information（US Department of Health and Human Services）The methods apply under the US HIPAA Privacy Rule.
- PETs Testbed（US National Institute of Standards and Technology）
- Good machine learning practice for medical device development: Guiding principles（International Medical Device Regulators Forum）Final document, January 27, 2025
