De-identification

The prescriptive HIPAA de-identification standard requiring the removal of 18 specific identifiers from medical data. This rule-based approach mandates stripping all direct identifiers including names, geographic subdivisions smaller than a state, all date elements (except year) related to an individual, telephone numbers, fax numbers, email addresses, social security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate/license numbers, vehicle identifiers and serial numbers, device identifiers and serial numbers, URLs, IP addresses, biometric identifiers, full-face photographs, and any other unique identifying number, characteristic, or code.

• Key identifiers stripped: Names, SSNs, medical record numbers, IP addresses
• Date handling: Only year-level precision retained; full dates removed
• Geographic constraint: No address data below state level for populations under 20,000
• Verification requirement: The covered entity must have no actual knowledge that remaining information could identify the individual

A statistical de-identification pathway where a qualified expert applies generally accepted statistical and scientific principles to render the risk of re-identification very small. Unlike Safe Harbor's checklist approach, this method permits retaining useful data elements—such as full dates or fine-grained geographic information—provided the expert documents that the risk is sufficiently mitigated. The expert must assess both singling-out risk (ability to isolate an individual's records), linkability risk (ability to link records across datasets), and inference risk (ability to deduce unknown attributes).

• Expert qualifications: Formal training in statistical disclosure control and health data privacy
• Risk threshold: "Very small" as defined by current scientific consensus
• Documentation: Full methodology and justification must be recorded for compliance audits
• Advantage: Preserves more analytical utility than Safe Harbor for research datasets

The specialized process of stripping PHI from Digital Imaging and Communications in Medicine (DICOM) metadata fields embedded in medical images. DICOM files contain hundreds of header tags, many of which can inadvertently store patient identifiers. De-identification requires parsing and cleansing tags such as PatientName (0010,0010), PatientID (0010,0020), PatientBirthDate (0010,0030), InstitutionName (0008,0080), and StudyDate (0008,0020). The DICOM standard defines confidentiality profiles that specify which tags must be removed, replaced, or retained.

• Critical tags: PatientName, PatientID, AccessionNumber, StudyInstanceUID
• UID handling: Unique identifiers must be consistently remapped to prevent re-linkage
• Pixel data risks: Burned-in annotations and ultrasound overlays may contain PHI in image pixels
• Tooling: DICOM PS 3.15 Annex E defines the standard confidentiality mechanisms

A formal privacy model ensuring that each released record is indistinguishable from at least k-1 other records with respect to quasi-identifiers—attributes like age, gender, and ZIP code that can be linked to external datasets. Achieving k-anonymity requires generalization (replacing specific values with broader categories) and suppression (removing outlier records). For medical imaging AI, k-anonymity is applied to structured metadata accompanying scans, not the pixel data itself.

• Quasi-identifiers: Attributes not directly identifying but linkable to external data
• Generalization hierarchies: ZIP code 94105 → 9410* → 941** → 94***
• Limitation: Does not protect against homogeneity attacks where all k records share a sensitive attribute
• Extensions: l-diversity and t-closeness address k-anonymity's known vulnerabilities

The process of replacing direct identifiers with artificial pseudonyms or tokens while maintaining a mapping table that allows re-identification under controlled conditions. Unlike full anonymization, pseudonymized data remains personal data under GDPR because the mapping key exists. In federated medical imaging workflows, pseudonymization is applied locally at each hospital before data enters the training pipeline, with the mapping key retained securely at the originating institution.

• Token generation: Cryptographically random identifiers with no mathematical relationship to original values
• Key management: Mapping tables stored in isolated, access-controlled environments
• Regulatory status: Considered personal data under GDPR; not a complete de-identification solution
• Use case: Enables longitudinal tracking of patient records across training rounds without exposing identity

A mathematical framework that injects calibrated noise into aggregate statistics or model outputs to provide a provable guarantee that any individual's presence in the dataset cannot be inferred. Governed by the privacy loss parameter epsilon (ε), lower values enforce stronger privacy. In de-identification pipelines, differential privacy can be applied during feature extraction or model training to ensure that released models do not memorize individual patient scans.

• Epsilon budget: Total privacy loss allocated across all queries or training rounds
• Noise mechanisms: Laplace or Gaussian distributions calibrated to query sensitivity
• Composability: Sequential queries consume the privacy budget cumulatively
• Trade-off: Lower epsilon values degrade model accuracy; requires careful calibration for diagnostic performance

De-identification is not a binary state but a probabilistic guarantee. Re-identification risk quantifies the likelihood that a malicious actor could link de-identified records back to a specific individual using auxiliary information. Key metrics include:

• k-anonymity: Ensures each record is indistinguishable from at least k-1 other records.
• Prosecutor Risk: The probability that a specific known individual is present in the dataset.
• Journalist Risk: The probability that any record in the dataset can be re-identified.

These terms are often conflated but have critical legal distinctions. Pseudonymization replaces direct identifiers with artificial identifiers (pseudonyms) but retains the theoretical possibility of re-linking via a separately held key. Under GDPR, pseudonymized data is still considered personal data. Anonymization is an irreversible process that permanently breaks the link to the individual, rendering the data no longer subject to privacy regulations. True anonymization is technically challenging to guarantee in high-dimensional medical datasets.