Registry Data De-Identification with anonym.plus

Clear patient identifiers from the registry export while the outcomes stay.

Registry de-identification is the removal of all 18 HIPAA Safe Harbor IDs (45 CFR §164.514(b)) from the export. anonym.plus does this on your own device. The outcome fields stay, but no patient is named.

When this applies

A registry shares a cohort with a research partner. The export still holds patient names, full dates, and a record number per row.

How anonym.plus handles it

  1. Open the export (CSV, XLSX, or PDF) in anonym.plus on your device.
  2. The tool scans every row for names, dates, and record numbers.
  3. Local OCR reads a scanned intake page if you add one.
  4. Confirm the flagged identifiers across the columns.
  5. Swap names for codes, or black out whole columns.
  6. Save the clean export locally with no upload.

What you need to provide

PHI entity types detected

Categoryanonym.plus entity typeExample
NamesPERSONDiego Morales → [PATIENT_6]
DatesDATE_TIMEenrolled 15/01/2026 → [DATE]
Record numberMEDICAL_RECORD_NUMBERREG 90431 → [REG_ID]
AddressLOCATIONZIP 33101, Miami → [ADDRESS]
SSNUS_SSN402-66-1199 → [SSN]
ContactEMAIL_ADDRESSd.morales@example.com → [EMAIL]

Compliance achieved

Anonymize patient registries offline — see plans & start free →

Limitations & cautions

Safe Harbor also needs you to have no reason to think the rest could re-identify a patient. The tool removes the 18 ID types. A rare diagnosis in a small ZIP can still narrow the field. For that, use Expert Determination instead.

Frequently asked questions

What is a patient registry?

It is an organised collection of data on people with a shared condition or treatment, tracked over time. Sharing a cohort for research means stripping the 18 Safe Harbor IDs from the export first.

Does this need a BAA?

No. anonym.plus runs on your own device with no cloud step. No outside party sees the rows, so the tool itself needs no BAA.

Can the outcomes still be analysed?

Yes. Diagnoses, treatments, and outcome fields stay. Only the 18 direct identifiers are swapped or removed.