The difference between anonymization and de-identification

Anonymization is the process where identifying information is completely removed from a data set, making re-identification impossible. De-identification, however, removes identifying features but may allow for the possibility of re-identification if certain controls are in place.

What is anonymization?

Anonymization is the process of removing all personally identifiable information (PII) from a dataset. Anonymization ensures that the individuals used for the data cannot be re-identified, even with advanced techniques or additional data. In other words, this process is designed to make the data truly anonymous.

Key features of anonymization

• Irreversibility: Once data is anonymized, it is impossible to re-identify the individuals used in the data. 
• Complete removal of identifiers: All direct and indirect identifiers, such as names, addresses, phone numbers, and even unique patterns like browsing history, are removed or transformed.
• Compliance with privacy regulations: Anonymized data is often exempt from certain privacy laws because it is no longer considered personal data.

Example

Consider a dataset containing patient information from a hospital. If this data is anonymized, all information that could identify a specific patient—such as name, date of birth, medical record number, or specific treatment details—would be removed or altered so that re-identification is impossible.

See also: HIPAA Compliant Email: The Definitive Guide

What is de-identification?

Conversely, de-identification involves modifying personal data so that the individuals in the dataset are not readily identifiable. Unlike anonymization, de-identification does not guarantee that re-identification is impossible. Instead, it reduces the risk of re-identification to an acceptable level, often through techniques like data masking, pseudonymization, or data aggregation. 

According to the Department of Health and Human Services, HIPAA’s Privacy Rule allows covered entities or business associates to create non-identifiable information by following the de-identification standard and implementation specifications.

Key features of de-identification

• Reversibility: While de-identified data does not immediately identify individuals, it may still be possible to re-identify them if certain controls or additional data are available.
• Retention of some identifiers: De-identified data might still retain certain elements, such as pseudonyms or generalized demographic information, which can make re-identification feasible under specific circumstances.
• Regulatory considerations: De-identified data is still considered personal data under many privacy laws, meaning that organizations must protect it from unauthorized access or misuse.

Example

If the same hospital dataset is de-identified, patient names and medical record numbers might be replaced with pseudonyms, and specific treatment dates might be generalized to a broader time range. While the data is less identifiable, someone with access to additional information or sophisticated techniques might still be able to re-identify individual patients.

Related: How to de-identify protected health information for privacy

Why the distinction matters

The distinction between anonymization and de-identification is not just academic; it has practical implications for data privacy and security. Anonymized data, due to its irreversible nature, can often be used more freely, as it poses little risk to individual privacy. However, de-identified data, because it retains some level of identifiability, must be handled with more caution and may still be subject to privacy regulations.

Organizations must carefully choose between anonymization and de-identification based on their specific needs and the level of privacy protection required. When the goal is maximizing data utility while minimizing risk, making de-identification the preferred choice. In other cases, where the highest level of privacy protection is necessary, anonymization may be the only acceptable option.

HIPAA and De-Identification

Under the HIPAA Privacy Rule, healthcare organizations may de-identify information, as long as it follows proper protocol. 

De-identification is considered complete when it has been determined so by a qualified expert or if the data has been removed of “specified individual identifiers as well as absence of actual knowledge by the covered entity that the remaining information could be used alone or in combination with other information to identify the individual.”

In these instances, the Privacy Rule does not restrict the use or disclosure of the data, as it is no longer considered Protected Health Information. 

However, the HHS notes that there are still some risks of the data being re-identified, so healthcare organizations should exercise caution and diligence. 

FAQs

What are some challenges in achieving true anonymization?

Challenges in achieving true anonymization include:

• Data complexity: Complex datasets with multiple variables can be difficult to anonymize.
• Data linkage: Even when identifiers are removed, combining anonymized datasets with other data sources can sometimes lead to re-identification.
• Advanced re-identification techniques: As data science advances, new methods for re-identifying anonymized data are continually being developed, raising the bar for what constitutes true anonymization.

Can anonymization or de-identification be applied to all types of data?

Anonymization and de-identification can be applied to many types of data, including structured data (like databases) and unstructured data (like text documents). However, the effectiveness of these processes depends on the nature of the data. For instance, anonymizing free text data or images can be more challenging due to the complexity of identifying and removing all potential identifiers.