Sharing health data for research and secondary use

Why health data needs special handling

Under the UK GDPR and the EU GDPR, health and genetic data are special category data. Article 9(2)(j) allows processing for scientific research when it is subject to the safeguards in Article 89: data minimisation and, where the purpose allows, pseudonymisation. In the UK, the Data Protection Act 2018 adds a research condition in Schedule 1, Part 1, paragraph 4, which also requires the processing to be in the public interest. NHS data is additionally subject to the common law duty of confidentiality and, for many uses, the national data opt-out.

In the United States, the HIPAA Privacy Rule governs protected health information (PHI) held by covered entities and their business associates. Research can use PHI with patient authorisation, with a waiver from an IRB or privacy board, as a limited data set under a data use agreement, or once the data has been de-identified under 45 CFR 164.514.

HIPAA de-identification: Safe Harbor and Expert Determination

HHS guidance describes two methods. Safe Harbor (164.514(b)(2)) requires removing 18 types of identifiers of the patient and of relatives, employers or household members, and having no actual knowledge that the remaining information could identify the person. Expert Determination (164.514(b)(1)) requires a qualified expert to determine, and document, that the risk of re-identification is very small for the anticipated recipient.

• Names, and geographic subdivisions smaller than a state; only the first three ZIP code digits may remain where the area holds more than 20,000 people.
• All elements of dates (except year) directly related to the patient, and ages over 89.
• Telephone and fax numbers, email addresses, URLs and IP addresses.
• Social Security, medical record, health plan, account, licence, vehicle and device numbers.
• Biometric identifiers, full-face photographs and any other unique identifying number, characteristic or code.

Pseudonymisation or anonymisation in the UK and EU

Pseudonymised data is still personal data: someone holds the key that links it back to the patient. Anonymous information, under recital 26 and the ICO's anonymisation guidance, is information where identification is no longer reasonably likely, judged among other things by the motivated intruder test. Only effective anonymisation takes data outside data protection law.

Anonymising clinical data is harder than it looks. An admission date, a partial postcode and a rare diagnosis can be enough to single someone out, which is why many projects choose well-governed pseudonymisation over a promise of anonymity they cannot defend.

The free-text problem

Structured datasets are pseudonymised by replacing the patient identifier. Documents are different: discharge letters, clinic notes, pathology reports and scanned PDFs scatter patient and relative names, hospital numbers, clinicians, addresses and dates across the text. This is where manual processes usually fail.

The European Health Data Space

For organisations working in the EU, Regulation (EU) 2025/327 on the European Health Data Space sets up a framework for secondary use of electronic health data for research, innovation and policy, through health data access bodies in each Member State. It applies in stages over the coming years and favours anonymised data, with pseudonymised data made available in secure processing environments when needed.

Where Anonimatum fits

Anonimatum processes clinical documents in PDF (including scanned files, with OCR), Word, Excel and images using its own AI on servers in the European Union, without sending text to external language model APIs. It detects names, addresses, dates and amounts, and custom patterns can capture local identifiers such as medical record numbers.

• Pseudonymisation replaces each value consistently across a batch and stores an encrypted map that the key-holding team can keep.
• Spreadsheets can be handled column by column: keep, redact, replace or pseudonymise each variable.
• Every detection can be reviewed before release, and batch processing handles large extracts.
• Anonimatum is not certified under HIPAA or any US scheme; its developer, Politeia Soft, holds Spain's ENS certification (category MEDIUM), which covers Anonimatum.

For day-to-day records work, see also anonymising medical records.