Structured Data De-identification

Unlike unstructured text, structured data de-identification operates on known column schemas where the semantic meaning of each field is predefined. The system applies field-specific rules: direct identifiers like patient_name and medical_record_number are removed or tokenized, while quasi-identifiers like date_of_birth and zip_code undergo statistical transformation. This schema awareness allows for precise, auditable transformations that preserve relational integrity across tables.

Structured de-identification employs formal mathematical guarantees beyond simple redaction:

• k-Anonymity: Ensures each record is indistinguishable from at least k-1 others
• l-Diversity: Extends k-anonymity by requiring diversity in sensitive attribute values
• t-Closeness: Constrains the distribution of sensitive attributes to mirror the overall population
• Differential Privacy: Injects calibrated noise into query results to provably mask individual presence These models transform quasi-identifiers through generalization and suppression techniques.

A core technique for preserving temporal relationships while obscuring actual calendar dates. The algorithm applies a consistent random offset to all date fields—date_of_birth, admission_date, discharge_date—within a patient record. This maintains the ability to calculate length of stay, time between procedures, and age at diagnosis without exposing the true dates. The shift value is derived from a cryptographic seed to ensure deterministic, repeatable transformations across data refreshes.

When replacing direct identifiers like Medical Record Numbers or patient names with pseudonyms, the system must maintain referential integrity across all tables in the database. A single patient appearing in encounters, lab_results, and medications tables receives the same pseudonym everywhere. This is achieved through deterministic hashing with a secret salt or a secure lookup table, enabling longitudinal analysis and cohort building without exposing the original identity.

To ensure de-identified data fits into existing downstream schemas and applications, transformations preserve the original data type and format:

• Names become same-length strings of random characters
• ZIP codes retain 5-digit structure but are generalized to 3-digit prefixes
• Dates remain valid ISO 8601 format after shifting
• Phone numbers maintain (XXX) XXX-XXXX structure with invalid digits This eliminates the need for schema migrations or application rewrites when consuming de-identified data.

Before releasing any de-identified structured dataset, a formal risk assessment quantifies the probability of linkage attacks. The process evaluates:

• Uniqueness: How many records share the same quasi-identifier combination
• Prosecutor risk: The chance an attacker can match a known individual to a specific record
• Journalist risk: The probability any record in the dataset can be re-identified
• Marketer risk: The proportion of records that can be linked to an external dataset Results guide the aggressiveness of generalization and suppression thresholds.

A de-identification technique that systematically offsets all date fields in a patient record by a consistent, random interval. This preserves the temporal relationships between events—such as the sequence of diagnoses and procedures—while obscuring the actual calendar dates. In structured data, this is applied uniformly across all date columns, ensuring longitudinal analysis remains valid without revealing the true timeline.

A cryptographic method that encrypts sensitive structured fields while preserving their original length and character format. This allows de-identified data to fit seamlessly into existing database schemas without requiring structural changes. For example, a 9-digit Social Security number is encrypted into another 9-digit string, maintaining referential integrity and application compatibility.

A method ensuring that every instance of a specific real-world entity is replaced with the same pseudonym across all records and tables. This is critical for preserving longitudinal data integrity in structured databases. For example, a patient ID is replaced with a persistent surrogate key, allowing all of that patient's encounters to be linked for cohort analysis without revealing their identity.

A privacy attack where an adversary cross-references a de-identified structured dataset with publicly available external datasets to re-identify individuals. By matching shared quasi-identifiers like gender, ZIP code, and birth date, an attacker can uniquely pinpoint a record. This risk is why simply removing direct identifiers from columns is insufficient; quasi-identifiers must also be generalized or suppressed.