De-identification and anonymization both strip identifying details from records, but set different bars. De-identification removes or masks identifiers under a named standard; anonymization goes further — rendering data so a person can no longer be identified by any reasonably likely means, which takes it outside privacy law. As of September 2026.
The two words get used as synonyms in healthcare, and the confusion has legal consequences. De-identification is a process with a defined outcome and a residual, bounded risk. Anonymization is a threshold: once truly met, the data stops being personal data at all. Almost everything called "anonymized" in practice is really de-identified, and the gap between the two is exactly where re-identification happens.
Why it matters in healthcare
Clinical datasets are dense with the very quantities that make people unique — dates, rare diagnoses, ZIP codes, admission timelines. The label you attach to a dataset decides what you may lawfully do with it. Treat de-identified data as anonymous and you may share, sell access to, or train on records that still carry obligations of consent, security, and subject rights. Getting the vocabulary right is the first control, before any technical safeguard.
How it works in practice
Under US law, the HIPAA Privacy Rule gives two routes. Safe Harbor requires removing 18 categories of identifiers of the individual and of their relatives, employers, or household members. Expert Determination asks a person with appropriate statistical knowledge to certify that the risk of re-identification is very small and to document how they reached that conclusion 1. Both produce de-identified data with low residual risk — a bounded risk, rather than a promise of anonymity.
Under EU law, the framing differs. GDPR says its principles do not apply to anonymous information — data rendered so the subject is no longer identifiable 2. But it defines pseudonymisation as processing so data can no longer be attributed to a person without separately-held additional information 2. The distinction is decisive: the European Data Protection Board's 2025 guidance states plainly that pseudonymised data, which could be attributed to a person using additional information, remain information on an identifiable person and are therefore personal 3. The guidance also frames a bounded pseudonymisation domain — the environment within which attribution is prevented — acknowledging that the protection holds only inside that boundary.
Where it appears today
Every health system that shares data for research, licenses records to a vendor, or trains a model on patient histories runs one of these processes first. NIST's foundational treatment defines de-identification as removing the association between data and identifiers, while warning that de-identified data can sometimes be re-identified 4. That warning has teeth. A generative-model study estimated that 99.98% of Americans could be correctly re-identified in any dataset using just 15 demographic attributes 5 — a result that reset how privacy regulators think about "incomplete" or sampled datasets.
Common misunderstandings
The costliest error is collapsing the two terms and assuming de-identified data carries no obligations. It usually does. A second error is treating anonymization as a fixed property of a file rather than a property of a file and its environment: the same table can be effectively anonymous inside a locked research enclave and re-identifiable the moment it is joined to an outside dataset. This is why the EDPB ties protection to a defined domain, and why HIPAA's Expert Determination weighs the data "reasonably available" to a would-be attacker. Anonymization is a claim about the world around the data, not the columns alone.
Related terms
When re-identification risk is too high to release real records at all, teams turn to synthetic patient data, which generates artificial records in place of masked ones. When the goal is to train across institutions without moving records anywhere, federated learning keeps the data local instead of de-identifying it for export. For the wider picture of where clinical AI has spread and what it runs on, see our AI in healthcare statistics.
We review this page yearly, and sooner when the EDPB finalises its pseudonymisation guidance, HHS updates its de-identification guidance, or a new study revises the re-identification risk estimates above.