De-Identification Profile
0.0.1-current - ci-build

De-Identification Profile, published by IHE IT Infrastructure Technical Committee. This guide is not an authorized publication; it is the continuous build for version 0.0.1-current built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/IHE/ITI.DeIdHandbook/ and changes regularly. See the Directory of published versions

## References

1. ISO 25237. (2017). Health informatics — Pseudonymization (ISO 25237:2017; Number ISO 25237:2017). International Organization for Standardization. https://www.iso.org/standard/63553.html
2. ISO/IEC 20889. (2018). Privacy enhancing data de-identification terminology and classification of techniques (Standard ISO/IEC 20889:2018(E); Number ISO/IEC 20889:2018(E)). International Organization for Standardization. https://www.iso.org/standard/69373.html
3. GDPR. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council. European Parliament and Council of the European Union. https://data.europa.eu/eli/reg/2016/679/oj
4. PIPL. (2021). Personal Information Protection Law of the People’s Republic of China. National People’s Congress of the People’s Republic of China (NPC). http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559.htm
5. NIST 800-188. (2023). De-identifying Government Datasets (Special Publication No. 800-188; Numbers 800-188). National Institute of Standards and Technology. https://doi.org/10.6028/nist.sp.800-188
6. European Data Protection Board. (2025). Guidelines 01/2025 on Pseudonymisation. https://www.edpb.europa.eu/system/files/2025-01/edpb_guidelines_202501_pseudonymisation_en.pdf
7. Information Commissioner’s Office. (2025). Pseudonymisation. Information Commissioner’s Office. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/#pseudonymiseddatastillpersonal
8. Office for Civil Rights. (2025). Methods for De-identification of PHI. HHS.gov. https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html#rationale
9. Hintze, M. (2017). Viewing the GDPR through a de-identification lens: a tool for compliance, clarification, and consistency. International Data Privacy Law, 8(1), 86–101. https://doi.org/10.1093/IDPL/IPX020
10. U.S. Congress. (1996). Health Insurance Portability and Accountability Act of 1996. Public Law 104-191. https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf
11. GB/T 42460. (2023). Information security technology - Guide for evaluating the effectiveness of personal information de-identification (Standard GB/T 42460—2023; Number GB/T 42460—2023). State Administration for Market Regulation Standardization Administration of China. https://www.iso.org/standard/69373.html
12. University of Manchester. (2024). Anonymisation decision-making framework: European practitioners’ guide (2nd ed.). University of Manchester. https://ukanon.net/wp-content/uploads/2024/01/adf-2nd-edition-european-practitioners-guide-final-version-cover-2024-version-2.pdf
13. National Electrical Manufacturers Association. (2025). DICOM Part 15, Annex E: Security and System Management Profiles — Attribute Confidentiality Profiles (PS3.15 Annex E; Number PS3.15 Annex E). National Electrical Manufacturers Association. https://dicom.nema.org/medical/dicom/current/output/chtml/part15/chapter_E.html
14. ISO/IEC 27559. (2022). Information security, cybersecurity and privacy protection — Privacy enhancing data de-identification framework (ISO/IEC 27559:2022; Number ISO/IEC 27559:2022). International Organization for Standardization. https://www.iso.org/standard/71677.html
15. ISO/TS 22220. (2011). Health informatics — Identification of subjects of care (ISO/TS 22220:2011; Number ISO/TS 22220:2011). International Organization for Standardization. https://www.iso.org/standard/44439.html
16. Article 29 Data Protection Working Party. (2014, April 10). Opinion 05/2014 on anonymisation techniques (WP216). European Commission. https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp216_en.pdf
17. HP. Efficient signature schemes supporting redaction, pseudonymization, and data deidentification. HP. HPL-2007-191
18. Schneier, Bruce. Commentary on the Importance of a Systemic Approach to Security. Bruce Schneier. Essay-028
19. UK Redaction Toolkit. A United Kingdom government document describing a toolkit for removing content prior publication for various legal reasons. REDACTION GUIDELINES FOR THE EDITING OF EXEMPT INFORMATION FROM PAPER AND ELECTRONIC DOCUMENTS PRIOR TO RELEASE
20. DICOM. DICOM current publication
21. DICOM Part 15 Annex E. Discusses clinical trials, double-blinding, traceability (relinking) to original content, preserving data needed for the trial. DICOM Part 15, Annex E current publication
22. Moehrke. De-Identification is Highly Contextual. (2009) De-Identification is highly contextual
23. HITSP. HITSP Biosurveillance Use Case Presentation. Lists summary of units of data exchange and values that should be pseudonymized. HITSP Biosurveillance Use Case presentation
24. NIH Biosurveillance Test Case Scenarios. Presentation by David Dobbs on the Biosurveillance Use Case and Minimum Data Elements
25. NHN Biosurveillance Test Scenarios. NHN Testing Work Group document *Biosurveillance Test Case Scenarios. 2008-10-03.xls* file, draft.
26. Dresden Anonymity. A proposed vocabulary for pseudonymization and related concepts. Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management – A onsolidated Proposal for Terminology* (Version v0.31 Feb. 15, 2008)
27. MIT Reidentification. Shows that a large percentage of people can be re-identified with Date-of-Birth, Current ZIP Code, and Sex. Reidentification of Individuals in Chicago's Homicide Database A Technical and Legal Study
28. IHE International. (2025). IHE radiology technical framework, volume 1: Integration profiles (Rev. 23.0). https://www.ihe.net/uploadedFiles/Documents/Radiology/IHE_RAD_TF_Vol1.pdf
29. O'Keefe, C., Otorepec, S., Elliot, M., Mackey, E., & O'Hara, K. (2017). The de-identification decision-making framework. CSIRO Data61. https://doi.org/10.4225/08/59c169433efd4
30. Information and Privacy Commissioner of Ontario. (2016). De-identification guidelines for structured data. https://www.ipc.on.ca/sites/default/files/legacy/2016/08/Deidentification-Guidelines-for-Structured-Data.pdf