Guide to the De-Identification of Personal Health Information

The growing availability of health data has created unprecedented opportunities for research, public health, quality improvement, and data-driven innovation. At the same time, health information is among the most sensitive forms of personal data, and its use raises legal, ethical and regulatory challenges.

The growing availability of health data has created unprecedented opportunities for research, public health, quality improvement, and data-driven innovation. At the same time, health information is among the most sensitive forms of personal data, and its use raises legal, ethical and regulatory challenges. This book helps the reader understand, assess and mitigate privacy risks to facilitate responsible health data use and sharing. It presents a comprehensive, risk-based de-identification methodology. Rather than treating de-identification as a simple removal of identifiers, it conceptualizes it as a structured risk-management process that reduces the likelihood of re-identification to a very low level within a given data-sharing context. The methodology integrates legal, technical, and organizational perspectives and aligns with international standards and regulatory guidance. It is also based on more than two decades of performing risk assessments and de-identification of health data globally. Foundational chapters examine the life cycle of health data, data subject perspectives, and the legal frameworks governing the use and disclosure of personal health information across jurisdictions. Building on this context, the book develops a conceptual model of risk that incorporates adversaries, attack scenarios, and different forms of disclosure, including identity, attribute, and membership disclosure. It reviews transformation methods including emerging technologies such as synthetic data to effectively reduce data vulnerability, and algorithmic approaches that optimize the balance between privacy protection and analytical utility. A central contribution of the book is its detailed methodology for quantitatively measuring risk. It introduces formal models for threat modelling including adversary motives, capacity and background knowledge, along with statistical metrics for estimating vulnerability at a dataset level. Such a quantitative model supports standardized and repeatable risk assessments with transparent decision rules and risk thresholds that guide whether and how data should be transformed before release. Case studies, assessment instruments, and operational strategies support organizations in applying these techniques consistently and defensibly. Designed for a broad audience including data custodians, researchers, privacy professionals, regulators, and health data practitioners, this book provides both the conceptual foundations and practical tools needed to enable responsible secondary use of health data while preserving privacy and maintaining the value of data.