The world is becoming more and more digitized. Large datasets of personal information are increasingly being used to guide decision-making across virtually all industries, including healthcare. In this context, clinical datasets improve clinical trial design and ultimately patient outcomes. However, clinical trial data transparency must not come at the expense of patient privacy. De-identification processes aim to remove information that could potentially lead to patient identification. It’s also important to ensure that sufficient data is available to guide decision-making. De-identification is a challenging process, and failures can lead to privacy breaches, legal consequences, loss of public trust, and suboptimal trial design. The rapid expansion and diversification of datasets mean that even well-meaning and experienced researchers can get things wrong.
Dedicated tools like Blur from Instem help researchers overcome challenges in de-identification and avoid common pitfalls that introduce risk. Here we discuss five common mistakes researchers make when approaching de-identification, and how they can overcome them.
1: Assuming That Removing Direct Identifiers Is Enough
Inexperienced researchers may assume that removing patients’ names is sufficient de-identification. However, quasi-identifiers such as a patient’s address, birthdate, gender, or illness, especially if rare, can enable their identification1. This is particularly risky in situations where the patient is already known to the adversary. Linkage attacks occur when an external dataset contains identifying information. Coupled with overlapping quasi-identifiers, this allows adversaries to match information from a de-identified dataset to a patient’s identity2.
Ensuring sufficient de-identification requires masking or removal of more data than many researchers assume. Therefore, teams must understand the difference between direct and indirect (quasi-) identifiers. It’s also important to be aware of the risks of residual quasi-identifiers in datasets. Tools for identifying and removing quasi-identifiers enable proactive risk mitigation while tools that enable risk assessments after data is processed can help researchers determine if their current methods are sufficient.
2: Over-De-Identifying the Data
As researchers become more aware of re-identification risks, they often overapply de-identification techniques. This can lead to the loss of crucial information that is less likely to cause identification but is essential for data usability in research3. For example, researchers studying the spread of an infectious disease need ZIP code data to identify geographic patterns. Removing this information to protect privacy could reduce data usability, preventing potentially life-saving insights.
Another example of losing data utility because of over-de-identification is when AGE is redacted in documents. This can remove valuable data that could have been reused for other purposes. The best way to deal with identifiers like AGE is to change it to an age range, instead of removing it completely
Addressing this pitfall can require the use of advanced statistical tools and a nuanced understanding of data use cases on the part of the researchers. Different methods to overcome this can include4:
- Generalization: Summarizing and broadening data to protect the identities of a small number of individuals with a shared data point, i.e., ZIP code, rare disease type.
- Differential privacy: Also known as data perturbation, a mathematical approach that adds statistical noise to a dataset, enabling patterns across multiple individuals to be described but mitigating the risk of individual identification.
- Pseudonymization: A de-identification method that replaces private identifiers with fake identifiers or pseudonyms
3: Ignoring Contextual Risks
Researchers may fall into the trap of assuming that a clinical dataset exists in isolation and doesn’t overlap with more readily accessible datasets. For example, bad actors may be able to link genomic sequencing data from clinical trial datasets to public genome databases or commercial genetic testing platforms. This often includes geographic information and even direct identifiers. The risk of identification is higher when specific identifiers are rare within a dataset, such as membership of an ethnic minority or a rare disease group.
These risks require researchers to develop a better understanding of the dataset environments, recipients, and use cases. Developing adversary models, with worst-case scenarios, i.e., the bad actor has maximal data access and computing power, can help anticipate and mitigate risk. Blur from Instem uses natural language processing to help researchers assess the scope of the data available in their dataset and establish contextual risk accordingly.
4: Relying on Static De-Identification
Data availability is not static, and neither is the technology that enables adversaries to interrogate databases. Generally, the amount of information available about an individual increases over time, as data is collected from doctor visits, purchases, travel, educational records, and social media activity. As this data accrues, the risk of linkage to clinical datasets increases.
De-identification strategies must be dynamic and continuously evaluated to remain effective. Continuous monitoring of the dataset environment is crucial for identifying emerging risks to individual patients. Researchers should also keep close track of database versions to maintain privacy. For example, ZIP codes may be present in version A but masked in version B. If both are available, the de-identification of version B is redundant, and patient privacy is at risk.
5: Not Testing or Validating De-Identification Techniques
Researchers often place too much trust in de-identification techniques, believing them to be robust and applicable across different situations and datasets. However, they must assess the suitability of their strategies across diverse circumstances rather than relying on a one-size-fits-all approach. Thorough testing of de-identification methods is crucial before implementation, and ongoing risk assessments of new or updated datasets are essential to ensure continued privacy protection. Central to this is the generation and maintenance of logs and audit trails that provide detailed information on de-identification procedures. Thorough documentation mitigates both patient identification and compliance risks1.
How Blur Helps Researchers Avoid De-Identification Mistakes
The Blur software package from Instem makes it simple for researchers to avoid these common mistakes with three core modules:
- Blur Data: Achieves efficient and comprehensive de-identification of patient data and ensures compliance with HIPAA, GDPR, and global regulatory bodies.
- Blur Risk: A simulation-based scoring system that enables researchers to assess and select the most appropriate de-identification strategy for the task at hand.
- Blur CSR: Uses natural language processing to anonymize clinical trial reports and ensure that all potential identifiers are addressed within text, tables, and embedded images.
Conclusion
De-identification of patient information is a complex and labor-intensive process that requires an understanding of database environments and evolving trends, while striking a balance between privacy and transparency. Mistakes can lead to the loss of patient privacy, regulatory failures, erosion of public trust, and reduced research credibility. Tools like Blur from Instem provide researchers with efficient and smart ways to overcome common pitfalls and significantly reduce risk in their de-identification processes. Robust risk simulations and natural language processing provide researchers with peace of mind, enabling them to tackle clinical trial submissions with confidence, while maximizing data usability.
Contact an Instem team member today to learn how Blur can enhance your de-identification strategies and remove risk from your clinical reporting.
Follow us on LinkedIn to keep up with the latest developments and industry trends.
References
1. Rights (OCR) O for C. Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. September 7, 2012. Accessed June 18, 2025. https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html
2. Borrero-Foncubierta A, Rodriguez-Garcia M, Muñoz A, Dodero JM. Protecting privacy in the age of big data: exploring data linking methods for quasi-identifier selection. Int J Inf Secur. 2025;24(1). doi:10.1007/s10207-024-00944-7
3. Commissioner O of the. The Importance of Clinical Trial Transparency and FDA Oversight. FDA. Published online April 12, 2023. Accessed June 18, 2025. https://www.fda.gov/news-events/fda-voices/importance-clinical-trial-transparency-and-fda-oversight
4. Dyda A, Purcell M, Curtis S, et al. Differential privacy for public health data: An innovative tool to optimize information sharing while protecting data confidentiality. Patterns (N Y). 2021;2(12):100366. doi:10.1016/j.patter.2021.100366
