Updated 2 min read

Can "anonymized" health data still identify you?

“Don’t worry, the data is anonymized.” Anyone who shares health data has heard this. The mechanism behind it is weaker than it sounds.

How de-identification is supposed to work

Under HIPAA, the central mechanism for enabling research on health records is stripping identifiers: remove the name, address and other direct identifiers, and the record can be shared as “de-identified” without the patient’s authorisation. The assumption is that without identifiers, the record no longer points back to a person.

Why it fails

A systematic review of re-identification attacks on health data found that records stripped of identifiers can still be re-identified when quasi-identifiers are combined. A birth date here, a postcode there, a rare diagnosis, an admission date: none of these is a name, but together they can narrow a “de-identified” record down to one person.

Protected health information breaches have affected over 176 million patients in the United States. Once a de-identified dataset leaks, anyone holding other data about you can attempt the combination.

The trade-off

The standard response to re-identification risk is to strip more: coarser dates, broader regions, fewer fields. But every field removed also removes scientific value, and the dominant institutional response (tightening access controls further) has compounded the research access problem rather than fixing its structural cause. De-identification asks one mechanism to deliver privacy and research value at the same time, and it delivers neither fully.

There is another way to make health data usable for research: don’t pretend it isn’t personal. Keep the record whole, under the person’s control, and let research happen through explicit, revocable consent, with every access logged.

Health Data Safe is built this way: data stays under the patient’s control on open-source infrastructure, a researcher’s access requires a time-limited, purpose-specific consent record, and every access event is logged with the accessor’s identity and scope. Nothing is stripped from the record, so it keeps its full scientific value; the protection comes from governance.

See How it works for the mechanics, or read how this compares to the laws protecting health data in Europe.