Last updated: November 2026
Key takeaways
- Medical data de-identification removes or transforms anything that could identify a patient, so imaging, notes and audio can be used to train AI with lower privacy risk.
- In the US, HIPAA offers two routes. Safe Harbor removes 18 identifier types. Expert Determination needs a qualified expert to document that risk is very small.
- In the EU, pseudonymized data is still personal data under the GDPR. Only truly anonymous data falls outside it.
- Header scrubbing is not enough. Burned-in text, free-text notes, spoken names and dates cause many leaks.
- Good medical data de-identification is a repeatable process: inventory, method choice, automated pass, human review, risk check and audit log.
Healthcare AI teams need real clinical data, but every scan, note and dictation can carry patient identity. Medical data de-identification is the step that makes that data safer to use for training and evaluation. Get it wrong and a single burned-in name on an ultrasound frame can stall a whole program.
This guide is for ML leads, data owners and privacy teams preparing imaging, clinical text or speech data. You get the US and EU rules in plain terms, a six-step process and common mistakes. You also get the TRACED checklist for reviewing a dataset before release.
Planning a medical dataset? Book a 20-minute scoping call and we will map your modalities and review steps with you.
What is medical data de-identification?
Medical data de-identification is the process of removing or transforming identifiers in health data so a person can no longer be reasonably identified. It covers structured fields, DICOM headers, pixels, free-text notes and audio. Under HIPAA, properly de-identified data is no longer protected health information (PHI). The EU uses a stricter test for anonymous data.
In short: medical data de-identification strips identity from patient records. The legal bar depends on where the data and patients are.
- De-identification is the US term used in the HIPAA Privacy Rule. Data that meets one of its two methods is no longer PHI.
- Anonymization is the EU concept. Under GDPR Recital 26, data is anonymous when the person is not, or no longer, identifiable by any means reasonably likely to be used.
- Pseudonymization replaces direct identifiers with codes, with the key kept separately. GDPR Article 4(5) defines it, and Recital 26 says pseudonymized data is still personal data.
For AI work, the difference matters. A pseudonymized dataset can keep patient links across visits, which helps longitudinal models. But it stays inside GDPR scope.
No method gives zero risk. HHS Office for Civil Rights (OCR) guidance says properly de-identified data “retains some risk of identification,” though that risk is very small.
Where does patient identity hide in medical AI data?
Patient identity hides in four places in most healthcare AI datasets. These are DICOM header tags, text burned into image pixels, free-text clinical notes and recorded speech. Each needs its own detection method. A tool that cleans one layer often misses the others, so plan medical data de-identification coverage per modality first.
DICOM header tags
Every DICOM header can hold hundreds of attributes. Some are obvious, such as Patient’s Name (0010,0010) and Patient’s Birth Date (0010,0030). Others are subtle: institution names, operators, accession numbers, study descriptions and UIDs.
DICOM PS3.15 Annex E defines the Basic Application Level Confidentiality Profile. Its Table E.1–1 gives each attribute an action code. X means remove, Z means empty or dummy value, C means clean, K means keep and U means a consistent new UID.
The standard warns that the table alone may not be enough. Identity can sit in private attributes, retired attributes or structured report text. File meta information and the 128-byte preamble must be replaced too.
When done, set Patient Identity Removed (0012,0062) to YES. Record the method in De-identification Method Code Sequence (0012,0064) or as text.
Burned-in pixel text
Some modalities write patient details straight into the image. The DICOM Clean Pixel Data Option covers this. Its note says CT images do not normally contain burned-in annotation, whereas ultrasound images routinely do.
Two rules stand out. The stored pixel values must be changed (blacked out); an overlay or shutter on top is not enough. And Burned In Annotation (0028,0301) should be set to “NO” once cleaning is done.
OCR can find text, but judging whether it identifies someone is harder. The standard says this may need a human operator’s approval. A separate Clean Recognizable Visual Features Option covers features such as faces.
Clinical free text
Clinical notes, discharge summaries and reports are the hardest layer. Names, dates and record numbers appear in any order and format.
HHS OCR guidance is explicit. Safe Harbor makes no distinction between structured fields and free text. OCR’s own example is a note saying the patient is the Executive Vice President of the state university. That detail must go, even though it is not a name.
Most teams pair clinical named entity recognition (NER) with rules and human review. The model flags candidate PHI. Reviewers confirm it and catch context clues, such as rare jobs or family links.
Detected PHI can be redacted with a tag such as [NAME] or replaced with realistic surrogates. Surrogates read naturally, but one patient’s name must map to the same fake name throughout a record.
Speech and dictation audio
Dictation, telehealth calls and ambient scribe recordings add two risks. One is spoken identifiers, such as a name or date of birth. The other is the voice itself. HIPAA’s Safe Harbor list includes biometric identifiers, “including finger and voice prints.”
A practical approach is transcript-first. Transcribe, detect PHI in the text, map flagged spans to timestamps, then mute those segments. Reviewers check flagged regions and spot-check the rest. Decide during scoping whether the voice itself needs transformation.
How to de-identify medical data for AI: a six-step process
To de-identify medical data for AI, follow six steps. Inventory every source and field, then choose a legal method. Run an automated pass and send flagged and sampled items to human review. Test re-identification risk on the output and keep an audit log. Repeat the cycle for each new batch or release.
1. Inventory every source and field
List each modality, file type and source system. For DICOM, sample every scanner vendor, because private tags vary. For text and audio, list note types and recording setups.
Mark which fields your model truly needs. Data minimization is the cheapest privacy control.
2. Choose the method before touching data
Agree the method with your privacy or legal team: Safe Harbor, Expert Determination, GDPR anonymization or pseudonymization. Safe Harbor, for example, removes all date elements except the year, which can break time-series models.
Write a short medical data de-identification spec listing each field, the action applied and the reason.
3. Run the automated pass
Apply your header profile to DICOM, OCR detection to pixels, NER plus rules to text and transcript-based detection to audio. Keep UID and date-shift mappings consistent across a patient’s files.
Store any re-identification keys separately, with strict access controls. GDPR Article 4(5) makes that separation part of the definition of pseudonymization.
4. Human review of flagged and sampled items
Automation does the volume work; people handle judgment. Review every low-confidence detection plus a random sample of items marked clean. Clinicians help with ambiguous terms, such as an eponym that looks like a name.
5. Check re-identification risk
Look at the output as an attacker would. Rare diagnoses, extreme ages, small hospitals or exact dates can make a record unique. Public data, such as news reports, can enable linkage.
For Expert Determination, this step is formal and documented by the expert. For GDPR anonymization, you assess all means reasonably likely to be used.
6. Keep an audit log
Record the batch, method, tool versions, configuration, reviewer decisions, exceptions and sign-off for each release. A good log answers one question fast: what was done to this file, and who approved it?
How to check a dataset before release: the TRACED checklist
Before a medical dataset leaves your control, check six layers with the TRACED checklist. They are Tags, Rendered pixels, Audio, Clinical text, Exposure risk and Documentation. Each letter covers one place identity leaks. A release passes only when every layer has an owner, a test result and a signed decision.
In short: TRACED turns medical data de-identification from a one-time script into a release gate.
- T – Tags. DICOM headers handled per profile, including private tags, sequences and preamble. UIDs replaced consistently.
- R – Rendered pixels. Ultrasound, screen captures and scans checked. Stored pixel values changed, not just covered.
- A – Audio. Spoken identifiers muted at the right timestamps. Voice handling decision recorded.
- C – Clinical text. Names, dates, numbers and context clues removed or replaced consistently.
- E – Exposure risk. Rare values, extreme ages and exact dates reviewed. Linkage risk considered.
- D – Documentation. Method, findings and sign-off logged. Keys stored separately.
Want a second pair of eyes on a sample batch? Scope a pilot billed only on approved files to test our review workflow.
Safe Harbor vs Expert Determination vs GDPR anonymization and pseudonymization
For medical data de-identification, HIPAA Safe Harbor is a fixed list of 18 identifier types to remove. Expert Determination is a documented risk analysis by a qualified expert. GDPR anonymization takes data out of GDPR scope only if no one is reasonably identifiable. GDPR pseudonymization keeps a separated key, so the data remains personal data.
| Approach | What it requires | Dates and detail | Status afterward |
|---|---|---|---|
| HIPAA Safe Harbor | Remove 18 identifier types for the patient, relatives, employers and household members, and have no actual knowledge that the rest could identify anyone | All date elements except year removed; ages over 89 grouped as 90 or older; ZIP codes cut to three digits only where the area has more than 20,000 people | Not PHI under HIPAA |
| HIPAA Expert Determination | A qualified expert applies statistical and scientific methods, finds the risk very small for the anticipated recipient, and documents methods and results | Can keep more detail, such as shifted dates, if the analysis supports it | Not PHI under HIPAA, within the conditions the expert sets |
| GDPR anonymization | No one identifiable by any means reasonably likely to be used, considering cost, time and available technology | Often needs aggregation or generalization; detail kept only if it does not enable identification | Outside GDPR scope |
| GDPR pseudonymization | Direct identifiers replaced; additional information kept separately under technical and organisational measures | Can keep patient-level links and detail | Still personal data; health data remains a special category |
One detail trips up many teams. OCR guidance says dates tied to test measures, such as lab report dates, are PHI. Under Safe Harbor, only the year may stay.
In the EU, the European Data Protection Board (EDPB) released Guidelines 01/2025 on pseudonymization for consultation in January 2025. They explain how pseudonymization reduces risk. They do not make pseudonymized data anonymous.
If you are building a high-risk AI system under the EU AI Act, Article 10 data-governance rules also apply. See our guide to EU AI Act training data requirements. Teams with Indian data sources should also read our explainer on the DPDP Act and AI training data.
How much effort does medical data de-identification take?
Medical data de-identification effort depends on modality mix, the share of burned-in and free text, your legal method and how much detail the model needs. Header-only imaging work is the lightest. Free-text notes, ultrasound frames and multi-speaker audio need far more human review per item, which drives most of the cost.
The main drivers are:
- Source variety. More scanner vendors, note templates and recording setups mean more rules to test.
- Unstructured share. Narrative notes and dictation need NER plus human review.
- Burned-in text rate. Ultrasound and screen captures need pixel checks.
- Utility needs. Keeping shifted dates or patient links adds mapping work and often an Expert Determination.
- Review depth. Sample size, double review and clinician adjudication scale effort.
- Languages. Multilingual notes and speech need fluent reviewers.
Common medical data de-identification mistakes
In short: most leaks come from the layers teams assume are clean.
Trusting the header scrub
Cleaning DICOM tags while ignoring pixels is the classic failure. Ultrasound frames and scanned forms often show names right in the image. Covering them with an overlay is not enough; change the pixels.
Mishandling dates
Dates hide in headers, reports, filenames, folder names, notes and lab values. Teams shift dates in one place and leave originals in another. Apply one rule everywhere, pixels included.
Free-text leaks
Models miss context clues. “The patient’s daughter, a nurse on Ward 4” can identify someone in a small hospital. Sampled human review is the safeguard.
Ignoring private tags and sequences
Vendors store data in private attributes and nested sequences. Remove private tags unless you have confirmed they are safe.
Forgetting linkage risk
A rare disease, an exact date and a small town can make a record unique. Assess linkage against what the recipient could reasonably hold.
How Graveiens AI approaches medical data de-identification
Graveiens AI supports medical data de-identification across all three data types in this guide. Our healthcare AI data services span medical imaging with DICOM workflows and clinical text, including clinical NER and de-identification. They also cover medical speech, including clinical transcription.
Clinicians validate items that need medical judgment. Our privacy and compliance practices cover de-identification, consent and audit trails, access controls and secure handling.
For speech, our clinical transcription and dictation services fit the transcript-first approach described above. For dataset checks before release, our data validation and QA reviews can follow your TRACED-style release sheet. Graveiens AI is ISO 9001 certified, and we work in 25+ languages.
When we collect new speech data, we use an explicit-consent workflow: participant onboarding, recording management, metadata tagging, then QA. Pilots are billed only on approved files. For tooling, formats, legal method or anything else, we scope this with you.
This article is general information, not legal advice. Confirm your de-identification method with qualified privacy counsel.
Frequently asked questions
What are the 18 HIPAA identifiers?
They are names, small geographic units, date elements except year, phone and fax numbers, email addresses, Social Security numbers, medical record numbers, health plan numbers, account numbers, certificate or license numbers, vehicle and device identifiers, URLs, IP addresses, biometric identifiers, full-face photos and any other unique code. Safe Harbor removes them for the patient, relatives, employers and household members.
Is de-identified data the same as anonymized data?
Not exactly. De-identified is the HIPAA term: data meeting Safe Harbor or Expert Determination is no longer PHI. Anonymized is the GDPR concept, with a broader test: no one is identifiable by any means reasonably likely to be used. A dataset can meet HIPAA and still fall short of EU anonymity.
Is pseudonymized data still personal data under GDPR?
Yes. GDPR Recital 26 states that pseudonymized data, which could be attributed to a person using additional information, should be treated as information on an identifiable person. Pseudonymization reduces risk and supports safeguards, but health data processed this way remains special-category personal data with all related duties.
Can AI tools de-identify clinical notes on their own?
Automated NER tools handle the volume, but they miss context clues such as rare jobs, family links or local places. HHS OCR guidance says any recognizable identifier in free text must be removed. Most teams pair automation with human review of flagged spans and a random sample of items marked clean.
Do I need to remove dates from DICOM files?
Under HIPAA Safe Harbor, yes: all date elements except the year must go, including burned-in dates. Expert Determination may allow shifted or partial dates if the risk analysis supports it. The DICOM confidentiality profile handles date attributes through action codes, with options for studies that need timing.
Is a patient’s voice considered PHI?
Voice can be. HIPAA Safe Harbor lists biometric identifiers, including voice prints, among the 18 identifier types. Spoken names, dates and numbers in dictation are also identifiers. Whether you must transform the voice itself depends on your method and use, so settle it with your privacy team during scoping.
Preparing imaging, clinical text or dictation data for AI?
Tell us your modalities, volumes and target medical data de-identification method. We will help you plan detection, human review and audit steps, then prove it on a small batch.
Book a 20-minute scoping call or scope a pilot billed only on approved files.
Sources
- U.S. Department of Health and Human Services, Office for Civil Rights – Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule
- DICOM Standard PS3.15, Annex E – Attribute Confidentiality Profiles (Basic Application Level Confidentiality Profile)
- DICOM Standard PS3.15, Section E.3 – Basic Application Level Confidentiality Options (Clean Pixel Data Option)
- Regulation (EU) 2016/679 (General Data Protection Regulation) – Recital 26, Article 4(5) and Article 9
- European Data Protection Board – Guidelines 01/2025 on Pseudonymization
About the author
Graveiens AI Editorial Team. The Graveiens AI Editorial Team writes practical guides on collecting, annotating and validating training data for AI. Our writers work alongside the delivery teams who run data collection, annotation and quality review programs.
Jitendra Choubay is the CEO & Founder of Graveiens AI, leading a human-in-the-loop data services team that helps AI builders with data collection, annotation, consent-backed voice data, transcription and LLM fine-tuning. He writes on building better, ethically sourced AI training data.
Get the next Graveiens AI article
Expert notes on AI data, annotation, LLMs and eLearning — no spam, unsubscribe anytime.
Need AI Development? Data Annotation? eLearning?
Talk to Graveiens AI about data collection, annotation, voice data, RLHF/SFT, LLM evaluation and AI training data — invoiced only on approved work.
Contact Graveiens AI
