Medical AI · Foundations · Lesson 4 of 6

Privacy and de-identification: HIPAA, GDPR and India's DPDP Act

Reviewed by Dr. Ram Kumar G, MBBS, MD (Internal Medicine), MPH (USA), on 2026-10-18 · Last updated 2026-10-18

Beginner
Clinical focus
About 30 minutes
Includes exercise

Before this lesson: Healthcare data types: records, images, signals, notes and omics

In short

Removing names is not enough to make health data anonymous: combinations of ordinary details such as age, sex and postcode can identify most people. Privacy laws treat this differently. HIPAA sets two routes to de-identification, the GDPR still treats pseudonymised data as personal data for anyone who can re-identify it, and India's DPDP Act applies to digital personal data with a research exemption that operates from May 2027. Good practice combines technical methods with legal agreements and limited access.

You will learn to

Explain the difference between identifiable, pseudonymised, de-identified and anonymous data
Describe how HIPAA, the GDPR and India's DPDP Act treat health data used for AI
Measure re-identification risk with k-anonymity and reduce it by generalising quasi-identifiers
Choose appropriate safeguards, from data agreements to federated learning, for an AI project

Why removing names is not enough

Direct identifiers, such as names, record numbers and phone numbers, are the obvious risk. The harder problem is quasi-identifiers: details that are harmless alone but identifying in combination. Latanya Sweeney estimated in 2000 that 87% of the US population could be uniquely identified by just ZIP code, sex and date of birth. A 2019 study estimated that 99.98% of Americans could be correctly re-identified in any dataset using 15 demographic attributes (Rocher et al., Nature Communications).

Health data adds more: rare diagnoses, exact dates of admission, free-text notes and images can all point to one person. Medical images can carry identifiers in their DICOM headers, and facial features can sometimes be reconstructed from head CT or MRI scans.

Terms vary between laws; these are the common meanings.
Term	Meaning	Example
Identifiable	Directly linked to a person	Name, hospital number and HbA1c results
Pseudonymised	Identifiers replaced with a code; someone holds the key	Patient 'A7F3' with HbA1c results; the hospital keeps the lookup table
De-identified	Identifiers removed or transformed to a legal or technical standard	HIPAA Safe Harbor dataset with ages over 89 grouped and dates reduced to years
Anonymous	No one can reasonably identify anyone, by any means likely to be used	Aggregate statistics with small cells suppressed

How the main laws treat health data

AI projects often cross borders, so it helps to know how the main regimes differ. The summaries below are for orientation, as of October 2026; they are not legal advice.

Law	Health data	De-identification or exemption route	Notes
HIPAA (United States)	Protected health information (PHI) held by covered entities and their business associates	Safe Harbor: remove 18 listed identifiers. Expert Determination: a qualified expert certifies very small re-identification risk	Does not cover health apps or companies outside its scope, which other US laws may cover
GDPR (European Union, EEA)	'Special category' data under Article 9, with stricter conditions for processing	Truly anonymous data falls outside the GDPR. Pseudonymised data remains personal data for whoever can re-identify it	Research has specific conditions and safeguards (Article 89)
DPDP Act 2023 (India)	Applies to digital personal data; health data has no separate category in the Act	Section 17(2)(b) exempts research, archiving and statistical processing that is not used for decisions about specific individuals and follows prescribed standards (Rule 16, applying from 13 May 2027)	The DPDP Rules were notified in November 2025 and come into force in phases until May 2027

The EU position is moving

In EDPS v SRB (C-413/23 P, 4 September 2025), the Court of Justice of the EU held that pseudonymised data need not be personal data for a recipient who cannot reasonably re-identify the people in it, while it remains personal data for the original controller.
As of October 2026, a proposal to write this 'relative' approach into the GDPR was still in the legislative process, and the EDPB's 2025 pseudonymisation guidelines had not been finalised. Check the current position before relying on either.

Measuring risk with k-anonymity

A dataset is k-anonymous if every combination of quasi-identifiers is shared by at least k people. If k is 1, someone is unique, and anyone who knows those details about them can find their record. The code below builds a synthetic table of 1,000 patients and checks it.

python

import numpy as np
import pandas as pd

rng = np.random.default_rng(11)
n = 1000
df = pd.DataFrame({
    "age": rng.integers(18, 90, size=n),
    "sex": rng.choice(["F", "M"], size=n),
    "postcode": rng.choice([f"5000{i:02d}" for i in range(40)], size=n),
    "diagnosis": rng.choice(["T2DM", "Hypertension", "CKD", "None"], size=n),
})
quasi_identifiers = ["age", "sex", "postcode"]

def k_anonymity(data, cols):
    sizes = data.groupby(cols).size()
    return sizes.min(), (sizes == 1).sum()

k, unique = k_anonymity(df, quasi_identifiers)
print(f"Raw data:     k = {k}, people unique on age+sex+postcode = {unique}")

# Raw data:     k = 1, people unique on age+sex+postcode = 840

Check k-anonymity on age, sex and postcode in a synthetic dataset.

With exact age, sex and one of 40 postcodes, 840 of the 1,000 synthetic patients are unique, even though no names are present.

Reducing risk: generalisation and date shifting

Generalising quasi-identifiers, for example ages into bands and postcodes into larger areas, makes groups bigger. The trade-off is lost detail: here the whole postcode collapses into one area, which would remove any geographic analysis.

python

generalised = df.assign(
    age=(df.age // 10 * 10).astype(str) + "s",   # 47 -> "40s"
    postcode=df.postcode.str[:4] + "**",          # 500017 -> "5000**"
)
k, unique = k_anonymity(generalised, quasi_identifiers)
print(f"Generalised:  k = {k}, people unique on age+sex+postcode = {unique}")
print(generalised.head(3))

# Generalised:  k = 14, people unique on age+sex+postcode = 0
#    age sex postcode     diagnosis
# 0  20s   F   5000**  Hypertension
# 1  20s   F   5000**           CKD
# 2  70s   F   5000**           CKD

Continuing from the previous block: generalise age and postcode, then re-check.

The smallest group now has 14 people. k-anonymity does not protect everything: if all 14 people in a group had the same diagnosis, knowing someone was in that group would reveal their diagnosis. Extensions such as l-diversity address this.

Shifting dates without losing time intervals

Exact dates are identifying, but models often need the time between events. A common approach shifts all of a patient's dates by the same random offset, so intervals are preserved while the real calendar dates are hidden.

python

import numpy as np
import pandas as pd

rng = np.random.default_rng(3)
visits = pd.DataFrame({
    "patient_id": ["p1", "p1", "p2", "p2"],
    "visit_date": pd.to_datetime(["2026-01-10", "2026-03-02", "2026-02-15", "2026-02-20"]),
})
shifts = {pid: pd.Timedelta(days=int(rng.integers(-180, 181)))
          for pid in visits.patient_id.unique()}
visits["shifted_date"] = visits.visit_date + visits.patient_id.map(shifts)
visits["days_since_first"] = (visits.groupby("patient_id").shifted_date
                              .transform(lambda d: (d - d.min()).dt.days))
print(visits)

#   patient_id visit_date shifted_date  days_since_first
# 0         p1 2026-01-10   2026-05-02                 0
# 1         p1 2026-03-02   2026-06-22                51
# 2         p2 2026-02-15   2025-09-18                 0
# 3         p2 2026-02-20   2025-09-23                 5

One random shift per patient, applied to every one of their dates.

The gaps between each patient's visits (51 and 5 days) are unchanged, but the calendar dates no longer match real events.
Date shifting breaks seasonal patterns, such as monsoon or winter effects, and does not by itself meet HIPAA Safe Harbor, which requires removing all date elements except the year.

Safeguards beyond the dataset

Technical de-identification is one layer. Most real projects combine it with organisational and technical controls, chosen according to the risk.

Safeguard	What it does	Limits
Data use agreements	Legally bind recipients not to re-identify or share data	Depend on trust and enforcement
Trusted research environments	Analysts work inside a controlled system; only approved outputs leave	Slower workflows; need investment
Federated learning	Models train where the data sits; only model updates are shared	Updates can still leak information; complex to run
Differential privacy	Adds calibrated noise so outputs reveal little about any one person	Reduces accuracy, especially for small groups
Synthetic data	Generates artificial records that mimic real patterns	Can leak information if generated from real data carelessly; may miss rare patterns

Generative AI and patient data

Pasting notes or records into a public AI chatbot sends them to a third party. Never do this with identifiable patient information.
Free text is hard to de-identify reliably. Use only tools your organisation has approved for clinical data, under a proper agreement.

Exercise

Measure and reduce re-identification risk in a synthetic patient table, and see what each step costs in analytical detail.

Data: Synthetic patients generated in the notebook (no real patient data) (Generated in the notebook)

Generate the 1,000-patient table and compute k-anonymity for age + sex + postcode.
Try three generalisation schemes (5-year bands, 10-year bands, 3-digit postcodes) and record k and the number of unique people for each.
For your preferred scheme, check l-diversity: does any group have only one diagnosis?
Apply per-patient date shifting to a synthetic visit table and confirm intervals are preserved.
Write a short note: which safeguards beyond de-identification would you add before sharing this data with an external AI developer?

The runnable notebook and worked solution will be published soon. You can work through the steps with the code on this page in the meantime.

Key takeaways

Quasi-identifiers such as age, sex and postcode can identify most people even without names.
HIPAA, the GDPR and India's DPDP Act define and treat de-identified health data differently.
k-anonymity measures one kind of risk; generalisation lowers it at the cost of detail.
Combine technical de-identification with agreements, controlled access and approved tools.

Terms used: De-identification, Differential privacy, Federated learning, k-anonymity, PHI (protected health information), Pseudonymisation

FAQ

Is pseudonymised data anonymous?

No. Under the GDPR, pseudonymised data is still personal data for anyone who can re-identify it, such as the organisation holding the key. The 2025 EDPS v SRB judgment found it may not be personal data for a recipient who cannot reasonably re-identify it.

What are the 18 HIPAA identifiers?

They include names, geographic units smaller than a state, all date elements except the year, phone and fax numbers, email addresses, record and account numbers, device identifiers, biometric identifiers, full-face photographs and any other unique identifying code. The full list is in 45 CFR 164.514(b)(2).

Does India's DPDP Act allow health data to be used for AI research?

Section 17(2)(b) exempts processing for research, archiving or statistical purposes where the data are not used to make decisions about specific individuals and the processing follows the standards in the DPDP Rules. That rule applies from 13 May 2027.

Is synthetic data always safe to share?

Not automatically. Synthetic data generated from real records can reproduce rare real cases if the generator is not designed and tested for privacy. Simulated data, such as Synthea's, carries no such risk because no real records are used.

Can I use a public chatbot to de-identify clinical notes?

No. That would send identifiable information to a third party before it is de-identified. Use approved de-identification tools within your organisation's systems.

Sources

Educational content only. This material teaches methods; it is not clinical advice. Code, models and examples here are not validated medical devices and must not be used to make decisions about real patients without proper clinical validation, governance and any required regulatory approval. Examples use synthetic or openly licensed de-identified data only. Never paste identifiable patient information into public AI tools. Mentions of models, tools or vendors are for identification, not endorsement.