Metadata Anonymization Checker.

Data Anonymization Fundamentals

Research data sharing accelerates scientific progress but introduces privacy risks when datasets contain personally identifiable information (PII). Effective anonymization must balance two goals:

• Privacy protection -- ensuring no individual can be re-identified from the released data
• Data utility -- preserving enough information for meaningful analysis

The most common approach in biomedical research is HIPAA de-identification using the Safe Harbor method, which requires removal of 18 specific identifier categories. However, removal alone may be insufficient when combinations of seemingly anonymous variables (quasi-identifiers like age + ZIP + gender) can be linked to external datasets.

Key anonymization techniques include:

• Suppression -- removing the identifier entirely (e.g., deleting a name column)
• Generalization -- reducing precision (e.g., exact age to age range, ZIP code to state)
• Pseudonymization -- replacing identifiers with consistent codes (e.g., patient ID)
• Perturbation -- adding noise to continuous values while preserving distributions
• k-Anonymity -- ensuring every record is indistinguishable from at least k-1 others

The 18 HIPAA Safe Harbor Identifiers

The HIPAA Safe Harbor method (45 CFR 164.514(b)(2)) requires removal of these 18 identifier categories:

1. Names 2. Geographic data smaller than state (street address, city, ZIP code) 3. Dates (except year) directly related to an individual 4. Phone numbers 5. Fax numbers 6. Email addresses 7. Social Security numbers 8. Medical record numbers 9. Health plan beneficiary numbers 10. Account numbers 11. Certificate/license numbers 12. Vehicle identifiers and serial numbers 13. Device identifiers and serial numbers 14. Web URLs 15. IP addresses 16. Biometric identifiers 17. Full-face photographs and comparable images 18. Any other unique identifying number, characteristic, or code

After removing these identifiers, the covered entity must have no actual knowledge that the remaining information could be used alone or in combination to identify an individual.