De-Identification Handbook
2.0.0-comment - ballot

De-Identification Handbook, published by IHE IT Infrastructure Technical Committee. This guide is not an authorized publication; it is the continuous build for version 2.0.0-comment built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/IHE/ITI.DeIdHandbook/ and changes regularly. See the Directory of published versions

## De-Identification Handbook Home

Official URL: https://profiles.ihe.net/ITI/DeId/ImplementationGuide/ihe.iti.deid | Version: 2.0.0-comment
Active as of 2026-06-09 | Computable Name: IHE_ITI_DeId

This handbook explains the PROCESS for removing individually identifiable information from healthcare data. This includes de-identification, pseudonymization, re-linking, design considerations, techniques, and risks. The intended audience is IHE Profile editors and healthcare information technology implementers needing a guide for designing and implementing de-identification systems.

Significant Changes, Open and Closed Issues

### Organization of This Guide

This guide is organized into the following sections:

1. Introduction to This Handbook
2. Glossary
3. Concepts
   - Navigating the Complexity of Privacy Concepts
   - Identifiability
   - De-Identification, Pseudonymization, and Anonymization Explained
   - Overall De-Identification Approach
   - Re-identification
   - Threats & Attacks
4. Data Types
5. Techniques
   - Classification of de-identification techniques
   - De-Identifying Identifiers
   - De-Identifying Sensitive Attributes
   - Privacy Models
6. Process
   - Overview of process
   - Analyze the context
   - Data assessment
   - Determine de-identification goals
   - Assess re-identification risk
   - Risk mitigation
   - Implementation
   - Governance
7. De-Identification and Pseudonymization for IHE Profile Editors
8. Security Considerations
   - Design of De-Identification Algorithm
   - Execution of De-Identification on Data
   - ATNA and Other Logging Considerations
9. Exemplar
   - FHIR Examples
   - DICOM Examples
   - HL7 2 Examples
   - Family Planning
   - IPS EHDS2
10. Other
    - Download and Analysis
    - Significant Changes and Issues
11. References

See also the Table of Contents and the index of Artifacts defined as part of this implementation guide.

### Conformance Expectations

IHE uses the normative words: "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" according to standards conventions.

#### Must Support

The use of `mustSupport` in StructureDefinition profiles is equivalent to the IHE use of R2 as defined in Appendix Z.

`mustSupport` only has a meaning on items that are minimal cardinality of zero (0), and applies only to the source actor populating the data. The source actor shall populate the elements marked with MustSupport, if the concept is supported by the actor, a value exists, and security and consent rules permit. The consuming actors should handle these elements being populated or being absent/empty. Note that sometimes mustSupport will appear on elements with a minimal cardinality greater than zero (0), this is due to inheritance from a less constrained profile.