deidentified

Deidentified data refers to information that has been processed to prevent the identification of individuals. In practice, deidentified data is created by removing or masking information that could directly identify a person such as names, addresses, or social security numbers, and by reducing the risk that indirect identifiers such as dates of birth, ZIP codes, or unusual combinations could be used to reidentify someone.

Common techniques include removing or pseudonymizing identifiers, aggregating data, perturbing values, suppressing rare combinations, and applying data minimization and access controls. Some frameworks use differential privacy or formal risk assessments to further limit disclosure risk.

Regulatory context: In the United States, the Health Insurance Portability and Accountability Act (HIPAA) sets deidentification standards, with Safe Harbor requiring the removal of 18 identifiers, or Expert Determination by a qualified expert. In the European Union, data protection rules emphasize pseudonymization and data minimization under GDPR; deidentification practices are part of risk management, but not a stand-alone status.

Limitations and use: Deidentified data is commonly used for research, analytics, and data sharing while aiming to protect privacy. It is not guaranteed to be irreversible; depending on data and external information, reidentification could be possible. Organizations should perform risk assessments, document methodology, and implement safeguards such as access controls and audit trails.