De-identified Data for a Research Collaboration
A hospital's analytics team is asked to share an extract with an external university for a study on readmission risk. The extract contains admission and discharge dates, date of birth, full postal code, sex, primary diagnosis codes, and a free-text 'discharge comments' field. The team plans to remove name, health record number, and address line, and to label the file 'de-identified.' The university will store it on a shared drive accessible to 30 researchers, including graduate students, for five years. The hospital's policy requires that de-identification follow a documented standard and that re-identification risk be assessed before release. The dataset covers a rural catchment where some postal codes contain fewer than 50 residents.
1. Is the proposed extract truly de-identified? Assess the re-identification risk.
Read the worked answer
No - the proposed extract is not de-identified under any reasonable standard. Removing direct identifiers is necessary but not sufficient.
Quasi-identifiers present:
- Full postal code in areas with fewer than 50 residents - this alone can make an individual unique or nearly so.
- Date of birth + admission/discharge dates - precise dates combined with age and geography are highly identifying.
- Free-text discharge comments - the highest-risk field. Free text routinely contains names of relatives, occupations, rare events, or 'the patient's son, a local GP' - none of which a structured-field scrub would catch.
The 'mosaic effect': even where no single field identifies a person, the combination can. A rural postal code plus a rare diagnosis plus an admission date may point to one person in the community.
The shared-drive, 30-user, five-year arrangement compounds the risk: wide access, long retention, and no apparent data-use agreement or access controls.
Conclusion: labelling the file 'de-identified' does not make it so. The team needs a documented risk assessment and stronger controls before release.
2. Recommend a concrete plan to make the sharing acceptable, addressing both the data and the governance.
Read the worked answer
Data minimisation and transformation:
- Replace full postal code with a coarser geography (e.g. 3-digit postcode or region) or suppress small-area codes.
- Convert dates to intervals (days since admission) or aggregate to month/year, preserving the analytic variable without exact dates.
- Remove or rigorously de-identify the free-text field. Options: drop it; run it through a validated de-identification tool plus manual review; or replace with structured categories. Free text should not be released on the assumption that a tool caught everything.
- Consider releasing only the minimum variables the study needs; justify each field.
Governance:
- A data-sharing agreement specifying permitted use, prohibition on re-identification attempts, security requirements, and breach notification.
- Access controls: named users, role-based permissions, audit logging - not an open shared drive for 30 people including students.
- Retention limit with a destruction schedule, rather than an open-ended five years.
- Review by the privacy officer / research ethics board before release.
- Document the de-identification standard applied and the residual-risk assessment, so the decision is auditable.
If the study genuinely needs the free text, consider a safe-harbour or expert-determination approach with a statistician's documented risk estimate, or keep the analysis inside the hospital's environment and release only aggregate results.