De-identify your data to meet HIPAA, CCPA and GDPR
Privacy laws let you use, share or license data once people can no longer be identified, and each law sets its own test. We find and remove the personally identifiable information (PII) in your company data, test whether anyone could still be identified, and write down how it was done for your counsel.
Who it is for
- Selling or licensing data. Remove the PII from your email, tickets and records before a sample goes to an AI company, so the buyer never holds a customer’s name or phone number.
- Privacy, compliance or legal teams. When counsel, an auditor or a regulator asks how the data was de-identified, you hand over the record: what was removed, how it was tested and the risk left.
- Teams putting company data into AI tools. Before customer emails or tickets go into an AI assistant or a retrieval (RAG) system, we take the PII out, so it never reaches the model.
- Sharing or keeping data. Send records to a partner, researcher or software vendor, or keep history past your retention limit, with the names, numbers and addresses taken out.
A clinic's billing email, before and after we de-identify it
What changed, and why
- Names and email addresses become placeholders (Patient 4182), the same one every time, so the thread still reads.
- Dates are cut to the year, as HIPAA Safe Harbor requires. Ages over 89 become 90+.
- The street address goes. The ZIP code keeps its first three digits, which HIPAA allows only where that area holds more than 20,000 people.
- Phone, member and card numbers and the IP address are removed.
- The clinic and its staff are coded too (Clinic 3, Staff 31): a clinic name plus a date narrows down whose visit it was.
- The attachment’s file name (EOB_Lopez_Maria.pdf) and author field are stripped. Metadata is where names survive after the visible text is clean.
Data we clean: email, Slack and Teams chat, help desk tickets, CRM records, accounting exports, PDFs and documents, and call transcripts. Call audio and images stay out unless we agree otherwise.
What stays in the demo: the procedure, the amount, the problem and the fix, because that is what the email is about. Amounts are not on HIPAA’s list of 18 identifiers. An exact amount with an exact date and a street address could still single out one patient, which is why the date is cut to the year and the address to a three-digit ZIP code.
What counts as PII, and what we remove
Direct identifiers
Names, email addresses, phone numbers, street addresses, Social Security and tax numbers, account, member and card numbers, IP addresses, photos and voice recordings. Any one of them names or reaches a person.
Quasi-identifiers
ZIP code, birth date, sex, job title, a rare diagnosis or an unusual event. Harmless alone; together they can single someone out. Latanya Sweeney’s 2000 study found ZIP code, birth date and sex alone identify about 87% of Americans.
Sensitive data
Health information (PHI under HIPAA), financial details, biometrics, and data about children. These carry the strictest rules, and some stay out of a data set altogether.
Business identifiers
Your company name, domains, client list, project and invoice numbers, and staff names. They point back to your company and, through it, to its customers.
Where PII hides
Email signatures and headers, ticket notes, chat threads, PDF and scanned documents, tracked changes, file names and file metadata. Software finds most of it; people read the rest.
Which rules apply, and what we do for each
The law follows the data and where the people in it live, not where your company is. Many companies fall under more than one, so we clean to the strictest test that applies.
HIPAA (health data)
US Department of Health and Human Services, 45 CFR 164.514
De-identified means: Either remove 18 kinds of identifiers (Safe Harbor), or have a qualified expert find the risk of identifying anyone very small and put it in a signed report (Expert Determination).
What we do: We clean to Safe Harbor and record each identifier. For Expert Determination, we prepare the data and the file, and a qualified expert signs the report, not us.
CCPA and CPRA (California)
California Civil Code 1798.140, enforced by the California Privacy Protection Agency and the Attorney General
De-identified means: Data that cannot reasonably be linked to a person, plus three duties: reasonable safeguards, a public promise not to re-identify it, and the same promise in every contract that passes it on.
What we do: We clean and test the data, and draft the public promise and the contract clause for your counsel to check.
Other US state privacy laws
Virginia, Colorado, Connecticut, Texas, Oregon and other states with consumer privacy laws
De-identified means: Close to California: data that cannot reasonably be linked to a person, a public commitment, and contract terms for whoever receives it.
What we do: We map which states your customers and staff live in and apply each law that covers them.
GDPR and UK GDPR (Europe, UK)
EU and UK data protection authorities, Recital 26
De-identified means: Only anonymous data falls outside the law. Pseudonymised data, where names are swapped for codes and someone keeps the key, is still personal data.
What we do: We destroy the key, then test for other routes back to a person, such as linked records and rare combinations, before calling the data anonymous.
Canada (PIPEDA, Quebec Law 25)
Office of the Privacy Commissioner of Canada; Quebec’s Commission d’accès à l’information
De-identified means: Quebec requires anonymisation to be irreversible by generally accepted best practices; federal law asks whether a person can be identified.
What we do: We clean to the irreversible standard and record the method for your privacy officer.
Federal Trade Commission (all US companies)
FTC Act, Section 5
De-identified means: Calling data anonymous when it is not can be a deceptive practice.
What we do: Our record lists each step, so anything you tell a customer or buyer about the data matches what was done.
Frameworks we work from: NIST SP 800-188 (de-identifying data sets, including the risk to businesses as well as people) and ISO/IEC 27559 (re-identification risk). General information, not legal advice: your counsel confirms what applies.
How it works
- 1.Map the data and the rules. We list your systems, how many years each holds, whose PII is in them and where those people live. That decides which laws apply and what stays out, such as staff files or call audio.
- 2.Export to a locked workspace. Your team exports a copy to an isolated workspace that only the people cleaning it can reach, and every access is logged. Raw copies are deleted on a date we write down.
- 3.Remove the PII. Names become consistent placeholders (pseudonyms) and the key is destroyed. Dates are shifted or cut to the year; places and numbers are generalised or suppressed, as the law requires. Software flags most of the PII, and people read the free text, because names and phone numbers turn up in email bodies, signatures and ticket notes where no field labels them.
- 4.Test it. Someone who did not clean the data tries to re-identify people and your company, the way a motivated intruder would. They check fields that identify in combination (quasi-identifiers) and count how many records share each combination (k-anonymity). Anything that fails goes back to step 3.
- 5.Hand it over. You get the cleaned data and your compliance record.
Your compliance record
- A sample of the cleaned data before the full run
- Which laws were applied, and why
- Every kind of identifier found, and whether it was removed, coded or cut back
- The test results and the risk left, in plain words
- When the raw copies and the placeholder key were destroyed
What it costs
De-identification is priced per project. Once we know which systems your data comes from and how much of it there is, we send you a quote with the price and a time estimate. You pay for the work whether or not you ever sell or license the data.
If you also want to license the data to AI companies, that is a separate service, and the AI lab pays our broker fee, only after the deal closes. See how licensing your data works.
Questions about de-identification
Is PII removal the same as de-identification?
Not quite. PII removal takes out the details that name or reach a person. De-identification also deals with combinations that could single someone out, then tests the result and records it. HIPAA, CCPA and GDPR all set the bar at de-identification.
Why not just black out the names?
Blacked-out text loses its meaning: you can no longer tell who said what, or that two tickets came from the same customer. Consistent placeholders keep that, while the person stays unknown.
Is hashing or masking enough?
No. A hashed email or phone number can often be matched back, and the FTC has said hashing does not make data anonymous. Masking a few fields also misses names written inside messages.
Can you stop staff pasting personal data into AI tools?
Not as they type: we clean data sets, we do not filter what people enter into an AI tool. We can de-identify the data your team plans to use with AI before it goes in.
Who can sign a HIPAA Expert Determination?
Anyone with proven knowledge of and experience with accepted statistical methods for de-identification, usually a statistician, epidemiologist or similar. HIPAA requires no degree, license or certificate, but it does require a written report with the method, the risk found and the conditions it holds under.
How often does de-identification need redoing?
HIPAA sets no expiry. Redo it when the data changes, the recipient changes, or new public data appears that could be matched against it. Many companies review once a year.
What happens to call recordings?
A voice can identify someone, so audio usually stays out. Cleaned transcripts can go.
How long does it take?
It depends on the systems more than the size. Tables, such as accounting or ticket fields, go quickly. Years of email and chat take longer, because people read the text. The quote includes a time estimate.
Do you need access to our systems?
Usually not. Your team exports the data with our guidance and we work on the copy. Where an export is hard, we agree read-only access for a set time.
Didn't find your question? Ask us directly.