Health AI teams need more than names removed from patient data

The US National Institute of Standards and Technology (NIST) finalized SP 800-188 on September 14, 2023, defining de-identification as removing the association between identifying data and a data subject. The guide tells agencies to set privacy, access and usefulness objectives, survey direct and indirect identifiers, choose a sharing model, and validate both privacy protection and data utility.

The International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) published standard 27559:2022 as a framework for identifying and mitigating re-identification risks across the lifecycle of de-identified data, applicable to organizations of any size. These frameworks treat name removal as one possible transformation, not a completed risk assessment or a legal verdict that transfers across countries.

A health artificial intelligence (AI) project therefore needs three separate decisions: whether the data use is authorized, whether the disclosure risk is acceptable for the intended recipient, and whether the transformed data remain fit for the model's task. A separate APPI News analysis applies the same separation to authorization, data quality and clinical evidence for insurance claims.

Names are only the direct-identifier layer

The Organisation for Economic Co-operation and Development (OECD) defines de-identification as altering personal health data so the result cannot be readily associated with particular individuals, then states that de-identified data are not anonymous data. Its health-data recommendation, adopted on December 13, 2016, calls for review and approval procedures, security controls, monitoring and a defined legal basis for secondary use.

Direct identifiers point to a person on their own, while quasi-identifiers can identify someone when combined with other fields or outside information. A health record can lose a name and patient number yet remain linkable through an exact date, a small location, a rare sequence of events or text embedded in an image.

Pseudonymization replaces an identifier with a code so records can still be matched across time. The code, lookup table or repeatable transformation preserves a route back to the person, so the mapping and keys need separate protection and access control.

Data layer	Health-data examples	Review question
Direct identifiers	Name, national or local identifier, phone number, email address and patient number	Were the fields removed, replaced or confined to a separately controlled system?
Quasi-identifiers	Exact dates, small locations, age, rare conditions and unusual visit sequences	Can the combination single out a record when joined with information available to the recipient?
Embedded identifiers	Free text, image labels, barcodes, filenames and document metadata	Did the survey cover every file type and derived field, rather than only database columns?
Linkage material	Lookup tables, encryption keys and stable pseudonyms	Who can use the mapping, where is it stored and how is that access recorded?

The recipient and release model change the risk

NIST describes several sharing models: publishing a transformed file, producing synthetic data, providing a controlled query interface or keeping data in a non-public protected enclave. A review has to name the chosen model because a downloadable file, a named research team and an automated service do not present the same recipients or opportunities for linkage.

Sharing model	Evidence the release record needs
Published extract	Fields released, expected outside data, re-identification test, version and withdrawal or correction plan
Protected enclave	Approved users, authentication, permitted tools, download controls, logs and output review
Query interface	Allowed queries, result limits, logging and tests for information accumulated across repeated requests
Synthetic dataset	Source provenance, generation method, privacy property, fidelity tests and limits on intended use

ISO/IEC 27559 places re-identification risk inside the full lifecycle rather than at a single export step. New public records, a broader recipient group, another release from the same source or a changed analysis environment can make an earlier assessment stale.

Access controls and contracts do not erase identifiers, but they can reduce who receives the data and what those recipients can do with it. The release file should connect technical transformation to user approval, retention, logging, output review and an owner who can suspend access.

How this plays out outside Taiwan

A single “de-identified” label does not resolve whether health data can be used for AI in another country. The United States, European Union, United Kingdom, Singapore and Australia apply different tests, and some regulators assess the source dataset separately from the model trained on it. A cross-border project therefore needs to record the relevant country, each organization's legal role, the intended recipient and the release environment before it accepts a privacy assessment.

United States: HIPAA coverage comes before the method

The US Department of Health and Human Services says the US Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule covers health plans, health care clearinghouses and health care providers that conduct specified transactions electronically; those covered entities remain bound when they contract with business associates. HHS also says this rule does not give the department authority over other private businesses or public agencies. A company is not a HIPAA covered entity solely because its product handles medical information, so a project must establish each hospital's, vendor's and recipient's role before relying on a HIPAA method.

The US Department of Health and Human Services (HHS) describes two de-identification methods under the US Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule: Expert Determination and Safe Harbor. HHS also says properly applied methods leave a very small but nonzero identification risk and that Expert Determination has no universal numerical threshold.

Safe Harbor removes specified identifiers and requires the covered entity to lack actual knowledge that the remainder could identify a person, while Expert Determination evaluates risk for an anticipated recipient using reasonably available information. Those are rules for covered health information under US law; they do not establish that the same file is anonymous or lawfully usable in the European Union, Japan, Taiwan or another market.

APPI News could not find one published legal or numerical test that makes a health dataset anonymous in every country at the time of writing. A cross-border project must therefore record the applicable country, data controller, authorized purpose and transfer conditions instead of applying an unqualified “de-identified” label.

European Union: the dataset and model face separate tests

The European Commission says data that can be used to re-identify a person remain personal data under the European Union's General Data Protection Regulation (GDPR), even when the data have been de-identified, encrypted or pseudonymized. Only data rendered anonymous so that a person is no longer identifiable fall outside that definition. The Commission also classifies health data as a special category that an organization may process only when an applicable condition is met, so pseudonymization is a safeguard rather than permission to train a model.

The rule can reach beyond an organization's physical location. The Commission says the GDPR applies to processing tied to an establishment in the European Union and to a company outside the bloc that offers goods or services to, or monitors the behavior of, people in the European Union. A developer receiving pseudonymized records abroad therefore needs a documented scope and legal-basis analysis, not an assumption that removing the key also removes the project from EU law.

The model itself creates another question. The European Data Protection Board said on December 18, 2024 that AI-model anonymity requires a case-by-case assessment and that both identification of training subjects and extraction of their personal data through queries should be very unlikely. Removing direct identifiers from training rows does not by itself demonstrate that the resulting model meets that test.

The European Health Data Space (EHDS) will create a more specific route for secondary use, but it is not a general access channel today. The European Commission says the EHDS Regulation entered into force on March 26, 2025, while secondary-use rules for most data categories, including electronic health records, start applying in March 2029. Under the scheduled system, a health data access body will issue permits, processing will occur in secure environments, personal data cannot be downloaded, and pseudonymized data will be available only when anonymous data are insufficient for the approved purpose.

United Kingdom: key custody and release context remain central

The United Kingdom's Information Commissioner's Office (ICO) says pseudonymized information remains personal data for an organization that holds the additional information needed to reconnect it to a person. The additional information must be kept separately and secured with technical and organizational measures. The ICO says data shared without that information may be anonymous in a recipient's hands, but that outcome depends on what the recipient and others can reasonably use to identify someone.

The ICO's anonymization guidance calls for identification risk to be sufficiently remote and assessed against the release model, available outside information and methods reasonably likely to be used. It recommends a motivated-intruder test and regular reassessment rather than a field-removal checklist alone. The live page says the guidance is under review following changes made by the United Kingdom's Data (Use and Access) Act, so a 2026 project needs to check the current page and applicable law when it records its decision.

The United Kingdom also regulates attempts to reverse the process. The ICO says Section 171 of the United Kingdom's Data Protection Act 2018 creates offenses for knowingly or recklessly re-identifying de-identified personal data without the responsible controller's consent and for processing data re-identified through that offense, subject to statutory defenses. A release agreement and key-access record should therefore identify who may reconnect records and for which approved purpose.

Singapore: the AI guidance names the privacy trade-off

Singapore's Personal Data Protection Commission (PDPC) said in guidelines issued on March 1, 2024 that the country's Personal Data Protection Act applies when organizations use personal data to develop, test, monitor or deploy AI recommendation and decision systems. The guidelines say organizations can generally use personal data with meaningful consent or may rely on defined business-improvement or research exceptions when their criteria are met. They also classify third-party developers of bespoke systems as data intermediaries with protection and retention obligations when those providers process customer data.

The PDPC encourages organizations to anonymize training data as far as possible and says anonymized data are outside Singapore's Personal Data Protection Act, while warning that re-identification and disclosure risks still need legal, technical and process controls. Its test asks whether there is a serious possibility of re-identification, considering reversibility, intended recipients, information available to a motivated person and controls inside the AI system. Where anonymization would impair model accuracy, repeatability or reproducibility, the guidance says the organization should document why it chose personal data instead and place that decision at an appropriately senior level.

Australia: the release environment is part of the result

The Office of the Australian Information Commissioner (OAIC) says information is de-identified under Australia's Privacy Act 1988 when re-identification risk is very low in the relevant release context, meaning there is no reasonable likelihood of re-identification. Its two-step approach removes direct identifiers and then alters quasi-identifiers, adds controls to the access environment, or does both. The OAIC recommends specialist expertise for rich datasets, public or wide release and multi-entity sharing, and its page says it is being updated to reflect amendments made in 2024.

Australia's regulator also addresses model training directly. The OAIC's guidance for generative-AI developers says de-identifying personal information is itself a secondary use and that collecting identifiable data with plans to de-identify it later remains a collection of personal information. Its health example says a model that analyzes brain scans may need scans and associated reports, while the developer should consider removing patient details from metadata and annotations.

These regimes produce a practical procurement test. A hospital or developer needs the country and legal basis governing collection, the identity and role of every recipient, the fields and file types transformed, custody of any key, outside data considered in re-identification testing, and evidence that model queries cannot expose training subjects. An assessment may support one controlled release without supporting a public dataset, another recipient or deployment of the resulting model.

Personal uploads can reveal identifiers outside the report body

A health report can carry identifiers in its visible text, barcode, quick-response (QR) code, filename, document properties, scanned image or free-text notes. A field inventory that examines only the main table can therefore miss information sent with the file.

• The service's published terms determine retention, model-training use, staff access and deletion; changing the file does not change those terms.
• The minimum dataset depends on the stated task, and many tasks can be defined without transferring a complete original file.
• Visible fields, embedded text, metadata and stable codes need one inventory because their combinations can narrow a record to one person.
• An AI-generated summary can reproduce sensitive details from the input, so its storage and sharing path belongs in the same review.

These checks reduce the amount of information exposed, but they cannot turn a general-purpose AI service into an approved health-data environment. They also say nothing about whether the service's output is accurate, complete or suitable for a clinical decision.

Health AI projects need six linked records

A hospital or developer can organize the evidence into six linked records before health data enter an internal model, cloud application programming interface or research environment. This structure is an APPI News synthesis of the cited sources, not an ISO certification, a NIST test or a legal standard in any country.

1. Purpose and authority. Name the task, data controller, applicable country, legal basis or approval, intended recipients, retention period and permitted outputs.
2. Data inventory. Record structured fields, free text, images, filenames, metadata, derived values, provenance, collection period and known missingness.
3. Transformation and key custody. Document every removed, generalized, suppressed or pseudonymized field, together with the location and owner of any lookup table or key.
4. Access and release model. Identify users, systems, authentication, permitted operations, download rules, logs, subcontractors, processing locations and the response to unauthorized access.
5. Privacy and utility tests. Test linkage against outside information available to the intended recipient, then compare the transformed data with the source for the measures the project needs.
6. Change and incident control. Set review triggers for a new data release, recipient, outside dataset, model version or purpose, and assign authority to restrict access, investigate and correct prior releases.

Each record can fail independently. A lawful purpose does not lower re-identification risk, a low-risk release does not prove that the labels are accurate, and a useful dataset does not establish that a medical AI system performs safely in practice.

De-identification can change the data a model learns from

NIST's Privacy-Enhancing Technologies Testbed says de-identification mechanisms can distort data distributions by introducing artifacts and bias, and it evaluates privacy, fidelity and utility as separate properties. The page was updated on March 19, 2026 and describes more than 500 de-identified excerpts in its tabular-data benchmarking work.

Generalizing dates can alter time intervals, grouping locations can hide site effects, and suppressing rare combinations can remove cases that matter to a model evaluation. The project needs to compare distributions, missingness, labels and subgroup coverage before and after transformation rather than treating a successful privacy test as a quality check.

The International Medical Device Regulators Forum's January 2025 principles call for representative clinical datasets, training and test data that remain appropriately independent, testing under clinically relevant conditions and monitoring after deployment. The principles cover AI-enabled medical devices and do not authorize a product or set legal rules for every health AI use.

APPI News's subgroup-testing analysis explains how an overall score can conceal performance differences across patients, sites and devices. A separate review of synthetic medical data covers provenance, independent testing, task-specific measures and monitoring.

A release decision needs limits and an update trigger

A defensible release record states what was tested, which outside information was considered, who was expected to receive the data and which dataset version passed. It also records unresolved outliers or vulnerable groups instead of converting one average risk estimate into a guarantee for every record.

The review needs a date and a trigger for reassessment because data availability, computing methods and recipients change. Releasing another extract from the same source can also expose information through the combination of versions even when each file appears limited on its own.

De-identification can lower disclosure risk while preserving useful information, but the result remains tied to a purpose, recipient and environment. For health AI, the evidence ends with separate findings on authorization, privacy, data utility and model performance, all linked to the same version and use case.

Frequently asked questions

Does removing names make health data anonymous?
No. Dates, locations, unusual conditions, event sequences, text and metadata can act as quasi-identifiers when combined with other information.

Is pseudonymized health data anonymous?
No. Pseudonymization preserves a code or another mapping that can reconnect records to a person, so the mapping and its access controls remain part of the risk review.

Can de-identified health data go straight into AI training?
No. The project still needs a valid basis for the use, a recipient-specific privacy assessment, a data-utility check and model testing that matches the intended population and setting.