De-identification removes or alters details in health data so individuals cannot reasonably be identified. Under HIPAA that means Safe Harbor, stripping 18 identifier types, or an expert’s determination that re-identification risk is very small. AI helps de-identify records at scale, but stronger models also make re-identification easier, so the protection weakens over time.
In 2019, researchers at the Mayo Clinic took MRI scans of the heads of 84 volunteers and reconstructed their faces from the imaging data using ordinary software. Then they ran the reconstructions through commercial facial recognition software against photos of the same volunteers. For 70 of the 84, the software picked the right person as its top match. The study, by Christopher Schwarz and colleagues, appeared as a letter in the New England Journal of Medicine.
Nothing in those scans was a name, a date of birth or a record number. By the usual checklist, they were de-identified. The identifying information was the anatomy itself.
That is the problem with de-identification in the age of AI. The legal definitions were written as lists of fields to remove. The real risk depends on what someone can infer from what remains, and that depends on the tools available. Those tools are getting better every year. My argument is that “anonymized” is no longer a property of a dataset. It is a claim about a dataset, an adversary and a moment in time, and the claim expires.
This article is general information, not legal advice. It reflects US and EU rules as of May 2026.
How does HIPAA define de-identified health data?
HIPAA gives covered entities two routes to de-identify protected health information. Data that meets either is no longer PHI, and HIPAA’s privacy rules stop applying to it.
Safe Harbor requires removing 18 categories of identifiers about the individual and their relatives, employers and household members. They include names, geographic units smaller than a state (with a narrow exception for the first three digits of a ZIP code in populous areas), all elements of dates except the year, phone numbers, email addresses, record and account numbers, device identifiers, biometric identifiers, full-face photographs and “any other unique identifying number, characteristic, or code.” The covered entity must also have no actual knowledge that the remaining information could identify someone.
Expert Determination requires a qualified expert to apply statistical and scientific methods and conclude that the risk of identifying an individual is very small, given the data and the context in which it will be used, and to document how.
Safe Harbor is a checklist. Expert Determination is a judgment. The first is easy to apply and increasingly out of step with reality. The second is more robust, but only as good as the expert’s assumptions about what an attacker can do.
Can AI re-identify anonymized health data?
The evidence that supposedly anonymous data can be linked back to people predates modern AI. What AI changes is the cost and scale.
The classic result came from Latanya Sweeney, whose analysis of 1990 US census data, published in 2000, estimated that about 87 percent of Americans could be uniquely identified by just three facts: five-digit ZIP code, sex and full date of birth. Safe Harbor’s rules on dates and geography partly reflect that work.
Later work showed that removing obvious fields is not enough. In 2018, Liangyuan Na and colleagues reported in JAMA Network Open that machine learning could re-identify most adults in a national survey dataset using only de-identified physical activity data from wearable accelerometers, combined with basic demographics. In 2019, Luc Rocher, Julien Hendrickx and Yves-Alexandre de Montjoye showed in Nature Communications that 99.98 percent of Americans could be correctly re-identified in any dataset using 15 demographic attributes, and that releasing only a sample of a dataset does not protect against this.
Large language models add two new routes.
Inference. Models can deduce personal attributes from unstructured text. In research presented at ICLR in 2024, Robin Staab and colleagues showed that large language models could infer attributes such as location, age and income from ordinary online posts with high accuracy. Clinical notes are full of such clues: a rare occupation, a named local school, an unusual family history, the date of a notable accident. Safe Harbor’s list does not name them. A capable model can use them.
Memorization. Models can sometimes reproduce parts of their training data. In 2021, Nicholas Carlini and colleagues demonstrated that training data, including personal information, could be extracted from a large language model through targeted prompts. A model trained on clinical text, even de-identified text, can therefore become a new place where residual identifying details leak.
Is a model trained on patient data itself personal data?
This is where the law is shifting fastest. In Europe, the European Data Protection Board adopted an opinion in December 2024 on AI models and personal data. Its central point was that an AI model trained on personal data cannot automatically be considered anonymous. Whether it is depends on whether personal data can be extracted from it or obtained through queries with means reasonably likely to be used. That must be assessed case by case, and the burden sits with the organization claiming anonymity.
For health AI, this matters in both directions. A hospital that shares a model trained on its records may be sharing personal data without realizing it. And a developer who trained on “anonymized” data may find that the anonymity claim does not survive scrutiny of the model.
US law has not taken a comparable position. But the direction of travel is clear. Several state privacy laws define de-identified data in terms of reasonable measures, public commitments not to re-identify and contractual controls on recipients, not just fields removed.
A worked example: the same notes, two releases
Here is a hypothetical academic medical center that wants to share 200,000 clinical notes with an AI company building a documentation model.
Release one: Safe Harbor only. The center runs a de-identification tool that removes names, dates, addresses, record numbers and phone numbers, replacing them with realistic surrogates. The tool is good, and itself uses AI to find identifiers in free text. A spot check finds a small share of identifiers missed, mostly unusual names and misspelled dates. The notes still contain lines such as “patient is the only pediatric cardiac surgeon in the county” and “injured in the grain elevator collapse last spring.” The files go to the company under a standard data use agreement.
Every field on the checklist is gone. The patient behind the grain elevator note is still findable by anyone who reads the local news.
Release two: managed risk. The center uses the same tool, then commissions an expert determination that considers the notes’ free-text content and the capabilities of current language models. The expert recommends generalizing rare occupations and events, removing notes from very small subpopulations and, most importantly, not sending the data anywhere. Instead, the company trains its model inside a secure environment controlled by the center, with no ability to export raw notes. The contract bans re-identification attempts, requires testing the trained model for memorized text before it leaves the environment and gives the center audit rights.
Release two is slower and more expensive. It is also the only one whose privacy claim is likely to hold up in five years.
What is the strongest argument against treating de-identification as broken?
The strongest argument is that the risk is overstated and the cost of overreacting is high. Most published re-identification studies are demonstrations by skilled researchers with specific auxiliary data, not evidence of routine attacks. Recipients of de-identified data are usually bound by contracts forbidding re-identification. Meanwhile, de-identified data drives research, public health surveillance, drug safety work and the training of useful AI. Treat every dataset as identifiable, and much of that stops, or retreats into a few institutions with the money for secure enclaves.
This is a serious point. Privacy absolutism has costs that fall on patients too: slower research, worse models trained on narrower data, and fewer insights from the records patients already generated.
But it argues for proportion, not complacency. The right response is to match controls to risk: open release for low-risk aggregated data, controlled access for richer data, and secure environments where the data never leaves for the richest data, such as free-text notes and images. Europe’s European Health Data Space Regulation, in force since March 2025, builds secondary use of health data around secure processing environments for exactly this reason. The error is not sharing data. It is believing that a checklist applied once makes data safe forever. We made a related point in who owns patient data is the wrong question: what matters is who can do what with the data, under what controls.
What this means for hospitals, developers and policymakers
For hospitals, stop treating de-identification as a one-time technical step. For free text and images, prefer expert determination over Safe Harbor alone, and ask the expert to consider language model capabilities explicitly. Where possible, bring the model to the data rather than sending data out. Put re-identification bans, memorization testing and audit rights in every data-sharing contract. As we noted in your health app isn’t covered by HIPAA, health data often ends up outside HIPAA’s reach entirely once it leaves the covered entity.
For developers, test trained models for memorization of training data before release, especially models trained on clinical text. Do not market a model as “trained on anonymized data” without being able to show how anonymity was assessed. Treat the model itself as potentially containing personal data.
For policymakers, update definitions to reflect inference, not just fields. Require periodic reassessment of de-identification for datasets that remain in use. Fund secure research environments so that smaller institutions are not forced to choose between sharing raw data and not sharing at all. And treat re-identification of health data as an offense in its own right, with real penalties. The security side of this problem, covered in hospital cyberattacks are a patient-safety problem, makes clear how much of today’s “de-identified” data may already sit in stolen archives.
Frequently asked questions
What are the 18 HIPAA identifiers?
They are names; geographic subdivisions smaller than a state; all date elements except the year; phone and fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate and license numbers; vehicle identifiers; device identifiers; web URLs; IP addresses; biometric identifiers; full-face photographs; and any other unique identifying number, characteristic or code. Safe Harbor requires removing all of them.
Is de-identified data still covered by HIPAA?
No. Once health information is de-identified under Safe Harbor or Expert Determination, it is no longer protected health information and HIPAA’s privacy rules no longer apply. That is why re-identification risk matters: if data is later linked back to individuals, the protections that were supposed to apply may be missing. Other laws, contracts and state privacy statutes may still apply.
Can AI tools de-identify clinical notes automatically?
Yes, and they are widely used. Natural language processing tools can find and remove or replace identifiers in free text at scale, often more consistently than manual review. But no tool catches everything, and removing listed identifiers does not remove indirect clues such as rare occupations or events. Automated de-identification should be combined with testing, expert review and controls on who receives the data.
Can medical images be re-identified?
Yes. Beyond identifiers in image headers, some images contain identifying anatomy. A 2019 study in the New England Journal of Medicine reconstructed faces from head MRI scans and matched 70 of 84 volunteers to their photos with commercial facial recognition. De-facing software can reduce this risk for head imaging, but images should be treated as potentially identifiable.
The takeaway
De-identification was designed for a world where identifying someone meant finding their name. In a world of capable AI, identity leaks through anatomy, writing style, rare events and the models themselves. That does not mean health data should stop flowing. It means “anonymized” should be treated as a claim with an expiry date, backed by controls on who can use the data and how, rather than a stamp applied once and forgotten.
Should organizations that share de-identified health data be required to reassess re-identification risk every few years? Tell us what you think.
