Short answer: De-identification removes or changes information so that health data can no longer be linked to a person. In the US, the HIPAA Privacy Rule accepts two methods: Safe Harbor, removing 18 kinds of identifiers, and Expert Determination, where an expert shows the risk of re-identification is very small. In the EU, the GDPR distinguishes pseudonymised data, which is still personal data because a key can link it back, from anonymous data, which falls outside the GDPR only if people can no longer be identified by any reasonably likely means.
Why the difference matters
Replacing names with a code is pseudonymisation, not anonymisation: under the GDPR the rules on health data (Article 9) still apply. Even without names, combinations such as birth date, postcode and a rare condition can single someone out, especially in small groups. Recognised techniques include aggregation with minimum group sizes, generalisation (age bands instead of birth dates), suppression of rare values and, for statistics, noise.
Practical rules
- Decide the purpose first and collect only what it needs.
- Publish aggregates, not rows, and set a minimum group size.
- Treat pseudonymised datasets as personal data: legal basis, security, access control.
- Re-check the risk when datasets are combined.
In Anpheros
When Anpheros publishes population figures from what people record in the app, it does so only as anonymous counts for groups of at least 20 people, by country, never by person, and only with a separate consent. See the privacy policy and, for developers, GDPR for health data developers.
Related pages
- FHIR Bulk Data export ($export) explained
- Patient matching and the master patient index
- GDPR Article 9 for health data
- HIPAA vs GDPR for health data
- DPIA for a health app
- Secondary use of health data
- OMOP CDM explained
Sources
Frequently asked questions
Is pseudonymised data anonymous under the GDPR?
No. Pseudonymised data is still personal data, because it can be linked back with additional information.
What is HIPAA Safe Harbor?
A de-identification method that removes 18 specified identifiers and requires no actual knowledge that the rest could identify a person.
Why do small groups matter?
Because rare combinations of attributes can identify a person even without a name. Minimum group sizes reduce that risk.
Can anonymous data be used freely?
Under the GDPR truly anonymous data is outside its scope, but the bar is high and must be reassessed when data is combined.
Try it free in the sandbox
Your first FHIR call in 5 minutes. An HL7 FHIR R4 API with the patient's consent built in: try it in the sandbox, then connect your own app or clinic system.
Free · 30 synthetic patients · no card
Anpheros builds a medical record that the patient controls and can share with any clinic, on an HL7 FHIR R4 platform, based in the EU. These guides help you understand and organise your health; they do not replace your doctor.
About Anpheros →
AnpherosThe more you log, the clearer your record
Your health history in one place, under your control.
Free · Works in your browser · No card
