Encouraging the Use of, and Rethinking Protections for De-Identified (and “Anonymized”) Health Data

This paper advocates for stronger standards for de-identification of health data. Patient data sets have a broad variety of useful applications but must be stringently de-identified in order to maintain patient privacy and overall trust in the health care system. However, technological innovations make it increasingly difficult to protect de-identified data against re-identification. This paper argues in favor of strengthening the current de-identification standard, setting different levels of anonymization for different uses of data, requiring greater accountability for re-identification, and enforcing existing policies that are designed to place limits on the amount of data that can be collected and retained.