deid

Deid, short for de-identification, is the process of removing or masking personal information from data to prevent the identification of individuals. It is used to enable data sharing and secondary use of data while reducing privacy risks. De-identification applies across domains such as healthcare, social science, and public data, and covers both direct identifiers (names, addresses, social security numbers) and indirect identifiers (age, location, dates, or unique combinations) that could enable re-identification.

Methods and approaches include anonymization, pseudonymization, and more formal privacy frameworks. Anonymization permanently removes identifiers and makes re-identification impractical; pseudonymization replaces identifiers with pseudonyms or codes. Privacy techniques such as k-anonymity, l-diversity, and t-closeness aim to reduce re-identification risk in released datasets. Differential privacy adds calibrated noise to outputs to protect individuals. In healthcare, de-identification aligns with regulations like HIPAA, which offers a safe harbor method (removal of 18 identifiers) or an expert determination approach.

Applications include sharing medical records for research, epidemiology, and public health surveillance, as well as releasing datasets for machine learning. In medical imaging and electronic health records, de-identification also involves removing metadata and redacting identifying information in documents and images.

Challenges include residual risk of re-identification through data linkage, data utility loss from masking, and the need for governance and auditing. Ethical considerations emphasize consent, transparency, and appropriate use of de-identified data, as well as ongoing evaluation of privacy protections in light of evolving data-linkage techniques.