{"id":346,"date":"2026-11-11T18:30:00","date_gmt":"2026-11-11T13:00:00","guid":{"rendered":"https:\/\/www.graveiensai.com\/blog\/?p=346"},"modified":"2026-11-07T18:04:56","modified_gmt":"2026-11-07T12:34:56","slug":"medical-data-de-identification","status":"publish","type":"post","link":"https:\/\/www.graveiensai.com\/blog\/medical-data-de-identification\/","title":{"rendered":"Medical Data De-identification for AI: DICOM, Clinical Text and Compliance"},"content":{"rendered":"\n<p class=\"last-updated wp-block-paragraph\">Last updat\u00aded: Novem\u00adber 2026<\/p>\n\n\n\n<div class=\"wp-block-group takeaways\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<p class=\"wp-block-paragraph\"><strong>Key take\u00adaways<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Med\u00adical data de-iden\u00adti\u00adfi\u00adca\u00adtion removes or trans\u00adforms any\u00adthing that could iden\u00adti\u00adfy a patient, so imag\u00ading, notes and audio can be used to train AI with low\u00ader pri\u00adva\u00adcy risk.<\/li>\n\n\n<li>In the US, HIPAA offers two routes. Safe Har\u00adbor removes 18 iden\u00adti\u00adfi\u00ader types. Expert Deter\u00admi\u00adna\u00adtion needs a qual\u00adi\u00adfied expert to doc\u00adu\u00adment that risk is very small.<\/li>\n\n\n<li>In the EU, pseu\u00addo\u00adnymized data is still per\u00adson\u00adal data under the GDPR. Only tru\u00adly anony\u00admous data falls out\u00adside it.<\/li>\n\n\n<li>Head\u00ader scrub\u00adbing is not enough. Burned-in text, free-text notes, spo\u00adken names and dates cause many leaks.<\/li>\n\n\n<li>Good med\u00adical data de-iden\u00adti\u00adfi\u00adca\u00adtion is a repeat\u00adable process: inven\u00adto\u00adry, method choice, auto\u00admat\u00aded pass, human review, risk check and audit log.<\/li>\n<\/ul>\n<\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Health\u00adcare AI teams need real clin\u00adi\u00adcal data, but every scan, note and dic\u00adta\u00adtion can car\u00adry patient iden\u00adti\u00adty. Med\u00adical data de-iden\u00adti\u00adfi\u00adca\u00adtion is the step that makes that data safer to use for train\u00ading and eval\u00adu\u00ada\u00adtion. Get it wrong and a sin\u00adgle burned-in name on an ultra\u00adsound frame can stall a whole pro\u00adgram.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guide is for ML leads, data own\u00aders and pri\u00adva\u00adcy teams prepar\u00ading imag\u00ading, clin\u00adi\u00adcal text or speech data. You get the US and EU rules in plain terms, a six-step process and com\u00admon mis\u00adtakes. You also get the TRACED check\u00adlist for review\u00ading a dataset before release.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Plan\u00adning a med\u00adical dataset?<\/strong> <a href=\"https:\/\/www.graveiensai.com\/contact-us\">Book a 20-minute scop\u00ading call<\/a> and we will map your modal\u00adi\u00adties and review steps with you.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is medical data de-identification?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Med\u00adical data de-iden\u00adti\u00adfi\u00adca\u00adtion is the process of remov\u00ading or trans\u00adform\u00ading iden\u00adti\u00adfiers in health data so a per\u00adson can no longer be rea\u00adson\u00adably iden\u00adti\u00adfied. It cov\u00aders struc\u00adtured fields, DICOM head\u00aders, pix\u00adels, free-text notes and audio. Under HIPAA, prop\u00ader\u00adly de-iden\u00adti\u00adfied data is no longer pro\u00adtect\u00aded health infor\u00adma\u00adtion (PHI). The EU uses a stricter test for anony\u00admous data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>In short: med\u00adical data de-iden\u00adti\u00adfi\u00adca\u00adtion strips iden\u00adti\u00adty from patient records. The legal bar depends on where the data and patients are.<\/em><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>De-iden\u00adti\u00adfi\u00adca\u00adtion<\/strong> is the US term used in the HIPAA Pri\u00adva\u00adcy Rule. Data that meets one of its two meth\u00adods is no longer PHI.<\/li>\n\n\n<li><strong>Anonymiza\u00adtion<\/strong> is the EU con\u00adcept. Under GDPR Recital 26, data is anony\u00admous when the per\u00adson is not, or no longer, iden\u00adti\u00adfi\u00adable by any means rea\u00adson\u00adably like\u00adly to be used.<\/li>\n\n\n<li><strong>Pseu\u00addo\u00adnymiza\u00adtion<\/strong> replaces direct iden\u00adti\u00adfiers with codes, with the key kept sep\u00ada\u00adrate\u00adly. GDPR Arti\u00adcle 4(5) defines it, and Recital 26 says pseu\u00addo\u00adnymized data is still per\u00adson\u00adal data.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For AI work, the dif\u00adfer\u00adence mat\u00adters. A pseu\u00addo\u00adnymized dataset can keep patient links across vis\u00adits, which helps lon\u00adgi\u00adtu\u00addi\u00adnal mod\u00adels. But it stays inside GDPR scope.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">No method gives zero risk. HHS Office for Civ\u00adil Rights (OCR) guid\u00adance says prop\u00ader\u00adly de-iden\u00adti\u00adfied data \u201cretains some risk of iden\u00adti\u00adfi\u00adca\u00adtion,\u201d though that risk is very small.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Where does patient identity hide in medical AI data?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Patient iden\u00adti\u00adty hides in four places in most health\u00adcare AI datasets. These are DICOM head\u00ader tags, text burned into image pix\u00adels, free-text clin\u00adi\u00adcal notes and record\u00aded speech. Each needs its own detec\u00adtion method. A tool that cleans one lay\u00ader often miss\u00ades the oth\u00aders, so plan med\u00adical data de-iden\u00adti\u00adfi\u00adca\u00adtion cov\u00ader\u00adage per modal\u00adi\u00adty first.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"760\" src=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/phi-hiding-places-dicom-text-audio.webp\" alt=\"Diagram of four places PHI hides in medical AI data: DICOM header tags, burned-in pixel text, clinical free text and speech audio\" class=\"wp-image-342\" srcset=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/phi-hiding-places-dicom-text-audio.webp 1600w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/phi-hiding-places-dicom-text-audio-300x143.webp 300w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/phi-hiding-places-dicom-text-audio-1024x486.webp 1024w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/phi-hiding-places-dicom-text-audio-768x365.webp 768w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/phi-hiding-places-dicom-text-audio-1536x730.webp 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\"><figcaption class=\"wp-element-caption\">PHI can sit in meta\u00adda\u00adta, pix\u00adels, nar\u00adra\u00adtive text and audio. Each lay\u00ader needs its own check.<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">DICOM header tags<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Every DICOM head\u00ader can hold hun\u00addreds of attrib\u00adut\u00ades. Some are obvi\u00adous, such as Patien\u00adt\u2019s Name (0010,0010) and Patien\u00adt\u2019s Birth Date (0010,0030). Oth\u00aders are sub\u00adtle: insti\u00adtu\u00adtion names, oper\u00ada\u00adtors, acces\u00adsion num\u00adbers, study descrip\u00adtions and UIDs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DICOM PS3.15 Annex E defines the Basic Appli\u00adca\u00adtion Lev\u00adel Con\u00adfi\u00adden\u00adtial\u00adi\u00adty Pro\u00adfile. Its Table E.1\u20131 gives each attribute an action code. X means remove, Z means emp\u00adty or dum\u00admy val\u00adue, C means clean, K means keep and U means a con\u00adsis\u00adtent new UID.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The stan\u00addard warns that the table alone may not be enough. Iden\u00adti\u00adty can sit in pri\u00advate attrib\u00adut\u00ades, retired attrib\u00adut\u00ades or struc\u00adtured report text. File meta infor\u00adma\u00adtion and the 128-byte pre\u00adam\u00adble must be replaced too.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When done, set Patient Iden\u00adti\u00adty Removed (0012,0062) to YES. Record the method in De-iden\u00adti\u00adfi\u00adca\u00adtion Method Code Sequence (0012,0064) or as text.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Burned-in pixel text<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Some modal\u00adi\u00adties write patient details straight into the image. The DICOM Clean Pix\u00adel Data Option cov\u00aders this. Its note says CT images do not nor\u00admal\u00adly con\u00adtain burned-in anno\u00adta\u00adtion, where\u00adas ultra\u00adsound images rou\u00adtine\u00adly do.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two rules stand out. The stored pix\u00adel val\u00adues must be changed (blacked out); an over\u00adlay or shut\u00adter on top is not enough. And Burned In Anno\u00adta\u00adtion (0028,0301) should be set to \u201cNO\u201d once clean\u00ading is done.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">OCR can find text, but judg\u00ading whether it iden\u00adti\u00adfies some\u00adone is hard\u00ader. The stan\u00addard says this may need a human oper\u00ada\u00adtor\u2019s approval. A sep\u00ada\u00adrate Clean Rec\u00adog\u00adniz\u00adable Visu\u00adal Fea\u00adtures Option cov\u00aders fea\u00adtures such as faces.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Clinical free text<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Clin\u00adi\u00adcal notes, dis\u00adcharge sum\u00admaries and reports are the hard\u00adest lay\u00ader. Names, dates and record num\u00adbers appear in any order and for\u00admat.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HHS OCR guid\u00adance is explic\u00adit. Safe Har\u00adbor makes no dis\u00adtinc\u00adtion between struc\u00adtured fields and free text. OCR\u2019s own exam\u00adple is a note say\u00ading the patient is the Exec\u00adu\u00adtive Vice Pres\u00adi\u00addent of the state uni\u00adver\u00adsi\u00adty. That detail must go, even though it is not a name.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Most teams pair clin\u00adi\u00adcal named enti\u00adty recog\u00adni\u00adtion (NER) with rules and human review. The mod\u00adel flags can\u00addi\u00addate PHI. Review\u00aders con\u00adfirm it and catch con\u00adtext clues, such as rare jobs or fam\u00adi\u00adly links.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Detect\u00aded PHI can be redact\u00aded with a tag such as [NAME] or replaced with real\u00adis\u00adtic sur\u00adro\u00adgates. Sur\u00adro\u00adgates read nat\u00adu\u00adral\u00adly, but one patien\u00adt\u2019s name must map to the same fake name through\u00adout a record.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Speech and dictation audio<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Dic\u00adta\u00adtion, tele\u00adhealth calls and ambi\u00adent scribe record\u00adings add two risks. One is spo\u00adken iden\u00adti\u00adfiers, such as a name or date of birth. The oth\u00ader is the voice itself. HIPAA\u2019s Safe Har\u00adbor list includes bio\u00admet\u00adric iden\u00adti\u00adfiers, \u201cinclud\u00ading fin\u00adger and voice prints.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A prac\u00adti\u00adcal approach is tran\u00adscript-first. Tran\u00adscribe, detect PHI in the text, map flagged spans to time\u00adstamps, then mute those seg\u00adments. Review\u00aders check flagged regions and spot-check the rest. Decide dur\u00ading scop\u00ading whether the voice itself needs trans\u00adfor\u00adma\u00adtion.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to de-identify medical data for AI: a six-step process<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To de-iden\u00adti\u00adfy med\u00adical data for AI, fol\u00adlow six steps. Inven\u00adto\u00adry every source and field, then choose a legal method. Run an auto\u00admat\u00aded pass and send flagged and sam\u00adpled items to human review. Test re-iden\u00adti\u00adfi\u00adca\u00adtion risk on the out\u00adput and keep an audit log. Repeat the cycle for each new batch or release.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"700\" src=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/de-identification-process-six-steps.webp\" alt=\"Six-step medical data de-identification process: inventory, choose method, automated pass, human review, risk check and audit log\" class=\"wp-image-343\" srcset=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/de-identification-process-six-steps.webp 1600w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/de-identification-process-six-steps-300x131.webp 300w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/de-identification-process-six-steps-1024x448.webp 1024w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/de-identification-process-six-steps-768x336.webp 768w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/de-identification-process-six-steps-1536x672.webp 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\"><figcaption class=\"wp-element-caption\">A repeat\u00adable six-step flow for imag\u00ading, text and audio datasets.<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">1. Inventory every source and field<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">List each modal\u00adi\u00adty, file type and source sys\u00adtem. For DICOM, sam\u00adple every scan\u00adner ven\u00addor, because pri\u00advate tags vary. For text and audio, list note types and record\u00ading setups.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Mark which fields your mod\u00adel tru\u00adly needs. Data min\u00adi\u00admiza\u00adtion is the cheap\u00adest pri\u00adva\u00adcy con\u00adtrol.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Choose the method before touching data<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Agree the method with your pri\u00adva\u00adcy or legal team: Safe Har\u00adbor, Expert Deter\u00admi\u00adna\u00adtion, GDPR anonymiza\u00adtion or pseu\u00addo\u00adnymiza\u00adtion. Safe Har\u00adbor, for exam\u00adple, removes all date ele\u00adments except the year, which can break time-series mod\u00adels.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Write a short med\u00adical data de-iden\u00adti\u00adfi\u00adca\u00adtion spec list\u00ading each field, the action applied and the rea\u00adson.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Run the automated pass<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Apply your head\u00ader pro\u00adfile to DICOM, OCR detec\u00adtion to pix\u00adels, NER plus rules to text and tran\u00adscript-based detec\u00adtion to audio. Keep UID and date-shift map\u00adpings con\u00adsis\u00adtent across a patien\u00adt\u2019s files.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Store any re-iden\u00adti\u00adfi\u00adca\u00adtion keys sep\u00ada\u00adrate\u00adly, with strict access con\u00adtrols. GDPR Arti\u00adcle 4(5) makes that sep\u00ada\u00adra\u00adtion part of the def\u00adi\u00adn\u00adi\u00adtion of pseu\u00addo\u00adnymiza\u00adtion.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Human review of flagged and sampled items<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Automa\u00adtion does the vol\u00adume work; peo\u00adple han\u00addle judg\u00adment. Review every low-con\u00adfi\u00addence detec\u00adtion plus a ran\u00addom sam\u00adple of items marked clean. Clin\u00adi\u00adcians help with ambigu\u00adous terms, such as an eponym that looks like a name.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Check re-identification risk<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Look at the out\u00adput as an attack\u00ader would. Rare diag\u00adnoses, extreme ages, small hos\u00adpi\u00adtals or exact dates can make a record unique. Pub\u00adlic data, such as news reports, can enable link\u00adage.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For Expert Deter\u00admi\u00adna\u00adtion, this step is for\u00admal and doc\u00adu\u00adment\u00aded by the expert. For GDPR anonymiza\u00adtion, you assess all means rea\u00adson\u00adably like\u00adly to be used.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6. Keep an audit log<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Record the batch, method, tool ver\u00adsions, con\u00adfig\u00adu\u00adra\u00adtion, review\u00ader deci\u00adsions, excep\u00adtions and sign-off for each release. A good log answers one ques\u00adtion fast: what was done to this file, and who approved it?<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to check a dataset before release: the TRACED checklist<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before a med\u00adical dataset leaves your con\u00adtrol, check six lay\u00aders with the TRACED check\u00adlist. They are Tags, Ren\u00addered pix\u00adels, Audio, Clin\u00adi\u00adcal text, Expo\u00adsure risk and Doc\u00adu\u00admen\u00adta\u00adtion. Each let\u00adter cov\u00aders one place iden\u00adti\u00adty leaks. A release pass\u00ades only when every lay\u00ader has an own\u00ader, a test result and a signed deci\u00adsion.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>In short: TRACED turns med\u00adical data de-iden\u00adti\u00adfi\u00adca\u00adtion from a one-time script into a release gate.<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"800\" src=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/traced-de-identification-checklist.webp\" alt=\"TRACED checklist tiles for medical data de-identification: Tags, Rendered pixels, Audio, Clinical text, Exposure risk, Documentation\" class=\"wp-image-344\" srcset=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/traced-de-identification-checklist.webp 1600w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/traced-de-identification-checklist-300x150.webp 300w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/traced-de-identification-checklist-1024x512.webp 1024w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/traced-de-identification-checklist-768x384.webp 768w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/traced-de-identification-checklist-1536x768.webp 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\"><figcaption class=\"wp-element-caption\">The TRACED check\u00adlist: six lay\u00aders to ver\u00adi\u00adfy before a med\u00adical dataset is released.<\/figcaption><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>T \u2013 Tags.<\/strong> DICOM head\u00aders han\u00addled per pro\u00adfile, includ\u00ading pri\u00advate tags, sequences and pre\u00adam\u00adble. UIDs replaced con\u00adsis\u00adtent\u00adly.<\/li>\n\n\n<li><strong>R \u2013 Ren\u00addered pix\u00adels.<\/strong> Ultra\u00adsound, screen cap\u00adtures and scans checked. Stored pix\u00adel val\u00adues changed, not just cov\u00adered.<\/li>\n\n\n<li><strong>A \u2013 Audio.<\/strong> Spo\u00adken iden\u00adti\u00adfiers mut\u00aded at the right time\u00adstamps. Voice han\u00addling deci\u00adsion record\u00aded.<\/li>\n\n\n<li><strong>C \u2013 Clin\u00adi\u00adcal text.<\/strong> Names, dates, num\u00adbers and con\u00adtext clues removed or replaced con\u00adsis\u00adtent\u00adly.<\/li>\n\n\n<li><strong>E \u2013 Expo\u00adsure risk.<\/strong> Rare val\u00adues, extreme ages and exact dates reviewed. Link\u00adage risk con\u00adsid\u00adered.<\/li>\n\n\n<li><strong>D \u2013 Doc\u00adu\u00admen\u00adta\u00adtion.<\/strong> Method, find\u00adings and sign-off logged. Keys stored sep\u00ada\u00adrate\u00adly.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Want a sec\u00adond pair of eyes on a sam\u00adple batch?<\/strong> <a href=\"https:\/\/www.graveiensai.com\/contact-us\">Scope a pilot billed only on approved files<\/a> to test our review work\u00adflow.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Safe Harbor vs Expert Determination vs GDPR anonymization and pseudonymization<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For med\u00adical data de-iden\u00adti\u00adfi\u00adca\u00adtion, HIPAA Safe Har\u00adbor is a fixed list of 18 iden\u00adti\u00adfi\u00ader types to remove. Expert Deter\u00admi\u00adna\u00adtion is a doc\u00adu\u00adment\u00aded risk analy\u00adsis by a qual\u00adi\u00adfied expert. GDPR anonymiza\u00adtion takes data out of GDPR scope only if no one is rea\u00adson\u00adably iden\u00adti\u00adfi\u00adable. GDPR pseu\u00addo\u00adnymiza\u00adtion keeps a sep\u00ada\u00adrat\u00aded key, so the data remains per\u00adson\u00adal data.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"790\" src=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/hipaa-gdpr-de-identification-methods-compared.webp\" alt=\"Matrix comparing HIPAA Safe Harbor, Expert Determination, GDPR anonymization and GDPR pseudonymization on fixed identifier list, risk analysis, exact dates kept and whether data stays regulated\" class=\"wp-image-345\" srcset=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/hipaa-gdpr-de-identification-methods-compared.webp 1600w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/hipaa-gdpr-de-identification-methods-compared-300x148.webp 300w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/hipaa-gdpr-de-identification-methods-compared-1024x506.webp 1024w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/hipaa-gdpr-de-identification-methods-compared-768x379.webp 768w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/hipaa-gdpr-de-identification-methods-compared-1536x758.webp 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\"><figcaption class=\"wp-element-caption\">How the four com\u00admon approach\u00ades dif\u00adfer on rules, date detail and what the data is after\u00adward.<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr><th>Approach<\/th><th>What it requires<\/th><th>Dates and detail<\/th><th>Sta\u00adtus after\u00adward<\/th><\/tr>\n<\/thead>\n<tbody>\n<tr><td>HIPAA Safe Har\u00adbor<\/td><td>Remove 18 iden\u00adti\u00adfi\u00ader types for the patient, rel\u00ada\u00adtives, employ\u00aders and house\u00adhold mem\u00adbers, and have no actu\u00adal knowl\u00adedge that the rest could iden\u00adti\u00adfy any\u00adone<\/td><td>All date ele\u00adments except year removed; ages over 89 grouped as 90 or old\u00ader; ZIP codes cut to three dig\u00adits only where the area has more than 20,000 peo\u00adple<\/td><td>Not PHI under HIPAA<\/td><\/tr>\n<tr><td>HIPAA Expert Deter\u00admi\u00adna\u00adtion<\/td><td>A qual\u00adi\u00adfied expert applies sta\u00adtis\u00adti\u00adcal and sci\u00aden\u00adtif\u00adic meth\u00adods, finds the risk very small for the antic\u00adi\u00adpat\u00aded recip\u00adi\u00adent, and doc\u00adu\u00adments meth\u00adods and results<\/td><td>Can keep more detail, such as shift\u00aded dates, if the analy\u00adsis sup\u00adports it<\/td><td>Not PHI under HIPAA, with\u00adin the con\u00addi\u00adtions the expert sets<\/td><\/tr>\n<tr><td>GDPR anonymiza\u00adtion<\/td><td>No one iden\u00adti\u00adfi\u00adable by any means rea\u00adson\u00adably like\u00adly to be used, con\u00adsid\u00ader\u00ading cost, time and avail\u00adable tech\u00adnol\u00ado\u00adgy<\/td><td>Often needs aggre\u00adga\u00adtion or gen\u00ader\u00adal\u00adiza\u00adtion; detail kept only if it does not enable iden\u00adti\u00adfi\u00adca\u00adtion<\/td><td>Out\u00adside GDPR scope<\/td><\/tr>\n<tr><td>GDPR pseu\u00addo\u00adnymiza\u00adtion<\/td><td>Direct iden\u00adti\u00adfiers replaced; addi\u00adtion\u00adal infor\u00adma\u00adtion kept sep\u00ada\u00adrate\u00adly under tech\u00adni\u00adcal and organ\u00adi\u00adsa\u00adtion\u00adal mea\u00adsures<\/td><td>Can keep patient-lev\u00adel links and detail<\/td><td>Still per\u00adson\u00adal data; health data remains a spe\u00adcial cat\u00ade\u00adgo\u00adry<\/td><\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">One detail trips up many teams. OCR guid\u00adance says dates tied to test mea\u00adsures, such as lab report dates, are PHI. Under Safe Har\u00adbor, only the year may stay.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the EU, the Euro\u00adpean Data Pro\u00adtec\u00adtion Board (EDPB) released Guide\u00adlines 01\/2025 on pseu\u00addo\u00adnymiza\u00adtion for con\u00adsul\u00adta\u00adtion in Jan\u00adu\u00adary 2025. They explain how pseu\u00addo\u00adnymiza\u00adtion reduces risk. They do not make pseu\u00addo\u00adnymized data anony\u00admous.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are build\u00ading a high-risk AI sys\u00adtem under the EU AI Act, Arti\u00adcle 10 data-gov\u00ader\u00adnance rules also apply. See our guide to <a href=\"https:\/\/www.graveiensai.com\/blog\/eu-ai-act-training-data-requirements\/\">EU AI Act train\u00ading data require\u00adments<\/a>. Teams with Indi\u00adan data sources should also read our explain\u00ader on <a href=\"https:\/\/www.graveiensai.com\/blog\/dpdp-act-ai-training-data\/\">the DPDP Act and AI train\u00ading data<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How much effort does medical data de-identification take?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Med\u00adical data de-iden\u00adti\u00adfi\u00adca\u00adtion effort depends on modal\u00adi\u00adty mix, the share of burned-in and free text, your legal method and how much detail the mod\u00adel needs. Head\u00ader-only imag\u00ading work is the light\u00adest. Free-text notes, ultra\u00adsound frames and mul\u00adti-speak\u00ader audio need far more human review per item, which dri\u00adves most of the cost.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The main dri\u00advers are:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Source vari\u00adety.<\/strong> More scan\u00adner ven\u00addors, note tem\u00adplates and record\u00ading setups mean more rules to test.<\/li>\n\n\n<li><strong>Unstruc\u00adtured share.<\/strong> Nar\u00adra\u00adtive notes and dic\u00adta\u00adtion need NER plus human review.<\/li>\n\n\n<li><strong>Burned-in text rate.<\/strong> Ultra\u00adsound and screen cap\u00adtures need pix\u00adel checks.<\/li>\n\n\n<li><strong>Util\u00adi\u00adty needs.<\/strong> Keep\u00ading shift\u00aded dates or patient links adds map\u00adping work and often an Expert Deter\u00admi\u00adna\u00adtion.<\/li>\n\n\n<li><strong>Review depth.<\/strong> Sam\u00adple size, dou\u00adble review and clin\u00adi\u00adcian adju\u00addi\u00adca\u00adtion scale effort.<\/li>\n\n\n<li><strong>Lan\u00adguages.<\/strong> Mul\u00adti\u00adlin\u00adgual notes and speech need flu\u00adent review\u00aders.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Common medical data de-identification mistakes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><em>In short: most leaks come from the lay\u00aders teams assume are clean.<\/em><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Trusting the header scrub<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Clean\u00ading DICOM tags while ignor\u00ading pix\u00adels is the clas\u00adsic fail\u00adure. Ultra\u00adsound frames and scanned forms often show names right in the image. Cov\u00ader\u00ading them with an over\u00adlay is not enough; change the pix\u00adels.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Mishandling dates<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Dates hide in head\u00aders, reports, file\u00adnames, fold\u00ader names, notes and lab val\u00adues. Teams shift dates in one place and leave orig\u00adi\u00adnals in anoth\u00ader. Apply one rule every\u00adwhere, pix\u00adels includ\u00aded.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Free-text leaks<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Mod\u00adels miss con\u00adtext clues. \u201cThe patien\u00adt\u2019s daugh\u00adter, a nurse on Ward 4\u201d can iden\u00adti\u00adfy some\u00adone in a small hos\u00adpi\u00adtal. Sam\u00adpled human review is the safe\u00adguard.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Ignoring private tags and sequences<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ven\u00addors store data in pri\u00advate attrib\u00adut\u00ades and nest\u00aded sequences. Remove pri\u00advate tags unless you have con\u00adfirmed they are safe.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Forgetting linkage risk<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A rare dis\u00adease, an exact date and a small town can make a record unique. Assess link\u00adage against what the recip\u00adi\u00adent could rea\u00adson\u00adably hold.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Graveiens AI approaches medical data de-identification<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Graveiens AI sup\u00adports med\u00adical data de-iden\u00adti\u00adfi\u00adca\u00adtion across all three data types in this guide. Our <a href=\"https:\/\/www.graveiensai.com\/healthcare\">health\u00adcare AI data ser\u00advices<\/a> span med\u00adical imag\u00ading with DICOM work\u00adflows and clin\u00adi\u00adcal text, includ\u00ading clin\u00adi\u00adcal NER and de-iden\u00adti\u00adfi\u00adca\u00adtion. They also cov\u00ader med\u00adical speech, includ\u00ading clin\u00adi\u00adcal tran\u00adscrip\u00adtion.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Clin\u00adi\u00adcians val\u00adi\u00addate items that need med\u00adical judg\u00adment. Our pri\u00adva\u00adcy and com\u00adpli\u00adance prac\u00adtices cov\u00ader de-iden\u00adti\u00adfi\u00adca\u00adtion, con\u00adsent and audit trails, access con\u00adtrols and secure han\u00addling.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For speech, our <a href=\"https:\/\/www.graveiensai.com\/transcription\">clin\u00adi\u00adcal tran\u00adscrip\u00adtion and dic\u00adta\u00adtion ser\u00advices<\/a> fit the tran\u00adscript-first approach described above. For dataset checks before release, our <a href=\"https:\/\/www.graveiensai.com\/data-validation\">data val\u00adi\u00adda\u00adtion and QA reviews<\/a> can fol\u00adlow your TRACED-style release sheet. Graveiens AI is ISO 9001 cer\u00adti\u00adfied, and we work in 25+ lan\u00adguages.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When we col\u00adlect new speech data, we use an explic\u00adit-con\u00adsent work\u00adflow: par\u00adtic\u00adi\u00adpant onboard\u00ading, record\u00ading man\u00adage\u00adment, meta\u00adda\u00adta tag\u00adging, then QA. Pilots are billed only on approved files. For tool\u00ading, for\u00admats, legal method or any\u00adthing else, we scope this with you.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>This arti\u00adcle is gen\u00ader\u00adal infor\u00adma\u00adtion, not legal advice. Con\u00adfirm your de-iden\u00adti\u00adfi\u00adca\u00adtion method with qual\u00adi\u00adfied pri\u00adva\u00adcy coun\u00adsel.<\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently asked questions<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1794600000\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What are the 18 HIPAA identifiers?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>They are names, small geo\u00adgraph\u00adic units, date ele\u00adments except year, phone and fax num\u00adbers, email address\u00ades, Social Secu\u00adri\u00adty num\u00adbers, med\u00adical record num\u00adbers, health plan num\u00adbers, account num\u00adbers, cer\u00adtifi\u00adcate or license num\u00adbers, vehi\u00adcle and device iden\u00adti\u00adfiers, URLs, IP address\u00ades, bio\u00admet\u00adric iden\u00adti\u00adfiers, full-face pho\u00adtos and any oth\u00ader unique code. Safe Har\u00adbor removes them for the patient, rel\u00ada\u00adtives, employ\u00aders and house\u00adhold mem\u00adbers.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1794600001\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is de-identified data the same as anonymized data?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Not exact\u00adly. De-iden\u00adti\u00adfied is the HIPAA term: data meet\u00ading Safe Har\u00adbor or Expert Deter\u00admi\u00adna\u00adtion is no longer PHI. Anonymized is the GDPR con\u00adcept, with a broad\u00ader test: no one is iden\u00adti\u00adfi\u00adable by any means rea\u00adson\u00adably like\u00adly to be used. A dataset can meet HIPAA and still fall short of EU anonymi\u00adty.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1794600002\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is pseudonymized data still personal data under GDPR?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes. GDPR Recital 26 states that pseu\u00addo\u00adnymized data, which could be attrib\u00aduted to a per\u00adson using addi\u00adtion\u00adal infor\u00adma\u00adtion, should be treat\u00aded as infor\u00adma\u00adtion on an iden\u00adti\u00adfi\u00adable per\u00adson. Pseu\u00addo\u00adnymiza\u00adtion reduces risk and sup\u00adports safe\u00adguards, but health data processed this way remains spe\u00adcial-cat\u00ade\u00adgo\u00adry per\u00adson\u00adal data with all relat\u00aded duties.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1794600003\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can AI tools de-identify clinical notes on their own?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Auto\u00admat\u00aded NER tools han\u00addle the vol\u00adume, but they miss con\u00adtext clues such as rare jobs, fam\u00adi\u00adly links or local places. HHS OCR guid\u00adance says any rec\u00adog\u00adniz\u00adable iden\u00adti\u00adfi\u00ader in free text must be removed. Most teams pair automa\u00adtion with human review of flagged spans and a ran\u00addom sam\u00adple of items marked clean.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1794600004\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Do I need to remove dates from DICOM files?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Under HIPAA Safe Har\u00adbor, yes: all date ele\u00adments except the year must go, includ\u00ading burned-in dates. Expert Deter\u00admi\u00adna\u00adtion may allow shift\u00aded or par\u00adtial dates if the risk analy\u00adsis sup\u00adports it. The DICOM con\u00adfi\u00adden\u00adtial\u00adi\u00adty pro\u00adfile han\u00addles date attrib\u00adut\u00ades through action codes, with options for stud\u00adies that need tim\u00ading.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1794600005\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is a patient\u2019s voice considered PHI?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Voice can be. HIPAA Safe Har\u00adbor lists bio\u00admet\u00adric iden\u00adti\u00adfiers, includ\u00ading voice prints, among the 18 iden\u00adti\u00adfi\u00ader types. Spo\u00adken names, dates and num\u00adbers in dic\u00adta\u00adtion are also iden\u00adti\u00adfiers. Whether you must trans\u00adform the voice itself depends on your method and use, so set\u00adtle it with your pri\u00adva\u00adcy team dur\u00ading scop\u00ading.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<div class=\"wp-block-group cta-box\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<p class=\"wp-block-paragraph\"><strong>Prepar\u00ading imag\u00ading, clin\u00adi\u00adcal text or dic\u00adta\u00adtion data for AI?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tell us your modal\u00adi\u00adties, vol\u00adumes and tar\u00adget med\u00adical data de-iden\u00adti\u00adfi\u00adca\u00adtion method. We will help you plan detec\u00adtion, human review and audit steps, then prove it on a small batch.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.graveiensai.com\/contact-us\">Book a 20-minute scop\u00ading call<\/a> or <a href=\"https:\/\/www.graveiensai.com\/contact-us\">scope a pilot billed only on approved files<\/a>.<\/p>\n<\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/special-topics\/de-identification\/index.html\" rel=\"noopener\" target=\"_blank\">U.S. Depart\u00adment of Health and Human Ser\u00advices, Office for Civ\u00adil Rights \u2013 Guid\u00adance Regard\u00ading Meth\u00adods for De-iden\u00adti\u00adfi\u00adca\u00adtion of Pro\u00adtect\u00aded Health Infor\u00adma\u00adtion in Accor\u00addance with the HIPAA Pri\u00adva\u00adcy Rule<\/a><\/li>\n\n\n<li><a href=\"https:\/\/dicom.nema.org\/medical\/dicom\/current\/output\/chtml\/part15\/chapter_E.html\" rel=\"noopener\" target=\"_blank\">DICOM Stan\u00addard PS3.15, Annex E \u2013 Attribute Con\u00adfi\u00adden\u00adtial\u00adi\u00adty Pro\u00adfiles (Basic Appli\u00adca\u00adtion Lev\u00adel Con\u00adfi\u00adden\u00adtial\u00adi\u00adty Pro\u00adfile)<\/a><\/li>\n\n\n<li><a href=\"https:\/\/dicom.nema.org\/medical\/dicom\/current\/output\/chtml\/part15\/sect_E.3.html\" rel=\"noopener\" target=\"_blank\">DICOM Stan\u00addard PS3.15, Sec\u00adtion E.3 \u2013 Basic Appli\u00adca\u00adtion Lev\u00adel Con\u00adfi\u00adden\u00adtial\u00adi\u00adty Options (Clean Pix\u00adel Data Option)<\/a><\/li>\n\n\n<li><a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2016\/679\/oj\" rel=\"noopener\" target=\"_blank\">Reg\u00adu\u00adla\u00adtion (EU) 2016\/679 (Gen\u00ader\u00adal Data Pro\u00adtec\u00adtion Reg\u00adu\u00adla\u00adtion) \u2013 Recital 26, Arti\u00adcle 4(5) and Arti\u00adcle 9<\/a><\/li>\n\n\n<li><a href=\"https:\/\/www.edpb.europa.eu\/public-consultations\/guidelines-012025-on-pseudonymisation_en\" rel=\"noopener\" target=\"_blank\">Euro\u00adpean Data Pro\u00adtec\u00adtion Board \u2013 Guide\u00adlines 01\/2025 on Pseu\u00addo\u00adnymiza\u00adtion<\/a><\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">About the author<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Graveiens AI Edi\u00adto\u00adr\u00adi\u00adal Team.<\/strong> The Graveiens AI Edi\u00adto\u00adr\u00adi\u00adal Team writes prac\u00adti\u00adcal guides on col\u00adlect\u00ading, anno\u00adtat\u00ading and val\u00adi\u00addat\u00ading train\u00ading data for AI. Our writ\u00aders work along\u00adside the deliv\u00adery teams who run data col\u00adlec\u00adtion, anno\u00adta\u00adtion and qual\u00adi\u00adty review pro\u00adgrams.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Med\u00adical data de-iden\u00adti\u00adfi\u00adca\u00adtion for AI: HIPAA vs GDPR meth\u00adods, DICOM tags, burned-in text, notes and audio, plus the TRACED check\u00adlist. Plan your pilot.<\/p>\n","protected":false},"author":1,"featured_media":341,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[1],"tags":[50,52,25,49,51],"class_list":["post-346","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-de-identification","tag-dicom","tag-gdpr","tag-healthcare-ai","tag-hipaa"],"_links":{"self":[{"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/posts\/346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/comments?post=346"}],"version-history":[{"count":1,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/posts\/346\/revisions"}],"predecessor-version":[{"id":354,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/posts\/346\/revisions\/354"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/media\/341"}],"wp:attachment":[{"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/media?parent=346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/categories?post=346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/tags?post=346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}