By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Data De-identification
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Data de-identification is the process of altering health data so that they no longer identify a person. The HIMSS Dictionary describes it as a standard approach that changes sensitive information in electronic health records so that unauthorized readers cannot tell whose it is, and lists two types: a statistical method that disconnects the record from the individual, and deletion of the 18 most common identifiers, such as names, locations, dates, telephone numbers, Social Security numbers, and medical record numbers.
Under HIPAA the legal test is in 45 CFR 164.514. Health information that does not identify an individual, and for which there is no reasonable basis to believe it can be used to identify one, is not individually identifiable health information. A covered entity may conclude that data meet this test in either of two ways.
The expert determination method requires a person with appropriate knowledge of statistical and scientific principles to determine that the risk is very small that the information could be used, alone or with other reasonably available information, by an anticipated recipient to identify someone, and to document the methods and results. The Safe Harbor method requires removal of 18 types of identifiers of the individual and of relatives, employers, or household members, and that the covered entity has no actual knowledge that the remaining information could identify someone.
| Safe Harbor Identifier Group | Examples and Special Rules |
|---|---|
| Names and contact details | Names, telephone and fax numbers, email addresses |
| Geography | Everything smaller than a state, with limited use of the first three ZIP digits |
| Dates | All date elements except year; ages over 89 grouped as 90 or older |
| Account and record numbers | SSN, medical record, health plan, account, license numbers |
| Device and online identifiers | Device serial numbers, URLs, IP addresses |
| Biometric and image identifiers | Fingerprints, voiceprints, full-face photographs |
| Any other unique code or characteristic | Catch-all category |
⚠️ Exam Alert: De-identified data are no longer PHI under HIPAA; a limited data set still contains some identifiers and requires a data use agreement. Safe Harbor removes listed identifiers; expert determination relies on a statistical risk analysis. A covered entity may assign a re-identification code only if it is not derived from patient information (45 CFR 164.514(c)).
🌐 Why It Matters: Real-World Healthcare IT Context
De-identification lets organizations use clinical data for research, quality work, analytics, and product development without the permissions that PHI would require. It is also easy to overestimate. Removing a list of fields does not always remove the risk, particularly when data contain free text, rare conditions, or can be combined with other datasets.
Free text is a good example. A 2025 review in AI and Ethics examined the risk of re-identification from de-identified clinical free text. It considered the accuracy of automated de-identification, past methods used to re-identify health data and how well they worked, additional protections such as secure data environments, the harms that could follow, and public views. The authors concluded that when text is de-identified and held in secure data environments, the risk of re-identification is very low, and argued that more health research should be enabled through such access. An older Veterans Affairs study illustrates the measurement approach: in 2014, researchers de-identified discharge summaries from 86 patients and asked physicians from the relevant ward whether they recognized the patients. In 4.65 percent of documents, physicians thought they did, based on specific clinical details, but after verification none was correctly re-identified.
Context changes the picture. A 2020 study in the Orphanet Journal of Rare Diseases mined publicly available information for 80 patients in eight rare disease support forums and estimated how many people share each patient’s combination of marital status, three-digit ZIP code, age, sex, and condition. By their estimates, nearly 75 percent of the patients could be at high risk of re-identification in datasets de-identified under Safe Harbor, because the rare condition combined with ordinary details made them unique. The study illustrates a limit of rule-based methods: a dataset can follow the rule and still carry risk for unusual patients.
Practice varies. A 2025 interview study in Applied Clinical Informatics with 24 informatics leaders from 22 US health care organizations found widely varying policies for sharing clinical data beyond treatment, payment, and operations. Most commonly, organizations relied on HIPAA de-identification to protect privacy, but respondents described little transparency to the public, little patient control, and concern about use of data by EHR vendors. The authors recommended updating HIPAA, adding re-identification and onward sharing restrictions to data-sharing contracts, and offering more transparency and opt-out options.
A defensible program therefore treats de-identification as risk management and not a checkbox. Organizations decide which method to use for each dataset, document expert determinations, and test for residual risk, especially when releasing small cells, rare conditions, detailed dates, or free text. They restrict recipients by contract, prohibit attempts to re-identify, and control the environment in which data are used. For images and notes, automated tools help but need validation. Governance groups review requests and keep a record of what was shared with whom.
Common de-identification problems:
- Assuming that deleting listed fields guarantees anonymity
- Free text and images with identifiers missed by automated tools
- Rare conditions that make records unique despite compliant fields
- Combining released datasets in ways that restore identity
- Re-identification codes derived from patient information
- Little transparency to patients about secondary use
What supports sound de-identification:
- A documented method for each dataset, including expert determination when risk is high
- Validation of automated tools on local data
- Contracts that bar re-identification and limit onward sharing
- Secure environments for sensitive research data
- Data governance review of requests and releases
- Transparency to patients about how data are used
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses document the details that de-identification must handle, and they take part in the research and quality projects that use de-identified data.
At the Bedside
Free-text notes contain names of family members, workplaces, and events that identify a patient. Nurses write notes for care, and also know that other people may read them later. Concise, factual documentation without unnecessary identifying detail is good practice. When sharing case examples for teaching, nurses remove identifying details and check the organization’s policy.
In Clinical Workflow
Nurse researchers and quality leads often receive de-identified extracts and need to know what was removed, such as dates that limit the analysis of timing. They ask who approved the dataset and whether it can be linked to other sources. Nurse managers help ensure that presentations and posters do not contain details that could identify patients, such as rare diagnoses on a small unit.
Nurse informaticists work with data governance groups to review requests, understand which fields hold free text, and advise on how documentation practices affect downstream use.
In EHR Implementation (Go-Live Perspective)
An Epic Go-Live creates new data structures that feed analytics and research warehouses. At-the-elbow support analysts see where staff enter patient details in free-text boxes where structured fields exist, which matters later when data are extracted and de-identified.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
De-identification appears in privacy, research, and analytics questions:
| CAHIMS Domain | How De-identification Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA Privacy Rule, research regulation, ethics |
| Clinical Informatics | Secondary use of data, natural language processing, research data |
| Healthcare Information & Systems Management | Data warehouses, extraction, masking, access control |
| Management & Leadership | Data governance, data use agreements, risk management |
Key Terms to Know Alongside Data De-identification
- Safe Harbor Method — HIPAA method that removes 18 listed identifiers
- Expert Determination — HIPAA method based on a documented statistical risk analysis
- Limited Data Set — data with some identifiers removed that may be shared under a data use agreement
- Re-identification — linking de-identified data back to an individual
- Data Use Agreement — contract that sets conditions for use of a limited data set
- Pseudonymization — replacing identifiers with codes while keeping a way to link records
HIMSS Organizational Position
HIMSS supports privacy and security in health information through its public policy work, Healthcare Cybersecurity Community, and research. Members can find related resources through the HIMSS Healthcare Cybersecurity Community page.
🔗 Explore Further: External References
- eCFR — 45 CFR 164.514, Other Requirements Relating to Uses and Disclosures of Protected Health Information https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514
- Ford et al. (2025), AI and Ethics — What Is the Patient Re-identification Risk From Using De-identified Clinical Free Text Data for Health Research? https://pubmed.ncbi.nlm.nih.gov/40978336/
- Meystre et al. (2014), Studies in Health Technology and Informatics — Can Physicians Recognize Their Own Patients in De-identified Notes? https://pubmed.ncbi.nlm.nih.gov/25160293/
- Gow et al. (2020), Orphanet Journal of Rare Diseases — Participation in Patient Support Forums May Put Rare Disease Patient Data at Risk of Re-identification https://pubmed.ncbi.nlm.nih.gov/32867839/
- Jackson et al. (2025), Applied Clinical Informatics — Ethical Dimensions of Clinical Data Sharing by U.S. Health Care Organizations for Purposes Beyond Direct Patient Care: Interviews With Health Care Leaders https://pubmed.ncbi.nlm.nih.gov/39362293/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply