EPR export de-identification removes patient data from a bulk record extract, whether that is a CSV, a JSON feed, or a bundle of documents. The NHS Data Security and Protection Toolkit, built on the National Data Guardian's 10 Data Security Standards, is what an NHS organisation is assessed against for exactly this kind of flow, and UK GDPR Art. 32 requires security appropriate to the risk. anonym.plus de-identifies the extract on your own device, so the raw data never crosses an organisational boundary at all.
When this applies
Analytics and AI projects usually start with a bulk export of thousands of records. Using confidential patient information without consent needs NHS Act 2006 s.251 support under the Health Service (Control of Patient Information) Regulations 2002, granted through the HRA Confidentiality Advisory Group. A genuinely anonymous extract needs none of that.
How anonym.plus handles it
- Point anonym.plus at the export folder on your own server.
- It scans both identifier columns and free-text note fields.
- Steady labels keep links across joined rows intact.
- Review the summary and tune the column rules.
- Save the clean dataset on your device for later use.
What you need to provide
- The export as CSV, JSON, or a bundle of record files.
- A column map for known identifier fields.
- Replace with a steady label map to keep table joins.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | patient_name → [PATIENT_n] |
| Record IDs | MEDICAL_RECORD_NUMBER | mrn field → [MRN_n] |
| Dates | DATE_TIME | admit_date → shifted [DATE] |
| Contact | EMAIL_ADDRESS | contact_email → [EMAIL] |
| Location | LOCATION | address fields → [ADDRESS] |
| Free text | PERSON / LOCATION | inline names → labels |
Compliance achieved
- Keeps the extract inside the boundary the NHS Data Security and Protection Toolkit assesses, built on the National Data Guardian's 10 Data Security Standards.
- Supports UK GDPR Art. 32 security of processing by removing the cloud transfer entirely.
- Where the extract is a mandated national flow, the duty sits in Health and Social Care Act 2012 s.259.
- Confidential patient information used without consent needs NHS Act 2006 s.251 support under the Health Service (Control of Patient Information) Regulations 2002 (SI 2002/1438).
- A genuinely anonymous extract needs neither — UK GDPR Recital 26 puts it outside scope.
- Steady labels keep row joins intact, so the dataset stays analysable.
Anonymise EPR exports offline — see plans & start free →
Limitations & cautions
Bulk files mix tidy columns with messy free text. Column rules handle the first well; free-text fields need the same review as any clinical note. Test a sample before a full run, and check that date-shifting preserves the intervals your analysis depends on. Whether a s.251 approval is still needed is a governance judgement, not a tool output.
Frequently asked questions
Can records stay linkable after the swap?
Yes. A steady label map applies the same replacement to the same identifier everywhere, so rows belonging to one patient still join across tables while no real identity remains in the data. Keep in mind that if you retain the map itself, the dataset is pseudonymous under UK GDPR Art. 4(5), not anonymous.
Why work locally rather than in the cloud?
Sending raw patient data to a cloud tool is a disclosure in its own right, and it is exactly the kind of flow the NHS Data Security and Protection Toolkit and UK GDPR Art. 32 make you justify. Processing on your own device removes the transfer, so there is no third-party disclosure to assess.
Does anonymising the extract remove the need for s.251 approval?
It can, but that is a governance decision rather than a tool setting. NHS Act 2006 s.251 and the Health Service (Control of Patient Information) Regulations 2002 apply to confidential patient information. If the extract is genuinely anonymous under UK GDPR Recital 26, it is no longer personal data — so confirm that with your Caldicott Guardian before relying on it.