EPR Export De-Identification with anonym.plus

Clean bulk EPR exports — columns and free text — without leaving your network.

In simple terms, PII redaction is the on-device process of finding and masking personally identifiable information in a document before it is shared.

EPR export de-identification removes patient data from a bulk record extract, whether that is a CSV, a JSON feed, or a bundle of documents. The NHS Data Security and Protection Toolkit, built on the National Data Guardian's 10 Data Security Standards, is what an NHS organisation is assessed against for exactly this kind of flow, and UK GDPR Art. 32 requires security appropriate to the risk. anonym.plus de-identifies the extract on your own device, so the raw data never crosses an organisational boundary at all.

When this applies

Analytics and AI projects usually start with a bulk export of thousands of records. Using confidential patient information without consent needs NHS Act 2006 s.251 support under the Health Service (Control of Patient Information) Regulations 2002, granted through the HRA Confidentiality Advisory Group. A genuinely anonymous extract needs none of that.

How anonym.plus handles it

  1. Point anonym.plus at the export folder on your own server.
  2. It scans both identifier columns and free-text note fields.
  3. Steady labels keep links across joined rows intact.
  4. Review the summary and tune the column rules.
  5. Save the clean dataset on your device for later use.

What you need to provide

Patient data entity types detected

Categoryanonym.plus entity typeExample
NamesPERSONpatient_name → [PATIENT_n]
Record IDsMEDICAL_RECORD_NUMBERmrn field → [MRN_n]
DatesDATE_TIMEadmit_date → shifted [DATE]
ContactEMAIL_ADDRESScontact_email → [EMAIL]
LocationLOCATIONaddress fields → [ADDRESS]
Free textPERSON / LOCATIONinline names → labels

Compliance achieved

Anonymise EPR exports offline — see plans & start free →

Limitations & cautions

Bulk files mix tidy columns with messy free text. Column rules handle the first well; free-text fields need the same review as any clinical note. Test a sample before a full run, and check that date-shifting preserves the intervals your analysis depends on. Whether a s.251 approval is still needed is a governance judgement, not a tool output.

Frequently asked questions

Can records stay linkable after the swap?

Yes. A steady label map applies the same replacement to the same identifier everywhere, so rows belonging to one patient still join across tables while no real identity remains in the data. Keep in mind that if you retain the map itself, the dataset is pseudonymous under UK GDPR Art. 4(5), not anonymous.

Why work locally rather than in the cloud?

Sending raw patient data to a cloud tool is a disclosure in its own right, and it is exactly the kind of flow the NHS Data Security and Protection Toolkit and UK GDPR Art. 32 make you justify. Processing on your own device removes the transfer, so there is no third-party disclosure to assess.

Does anonymising the extract remove the need for s.251 approval?

It can, but that is a governance decision rather than a tool setting. NHS Act 2006 s.251 and the Health Service (Control of Patient Information) Regulations 2002 apply to confidential patient information. If the extract is genuinely anonymous under UK GDPR Recital 26, it is no longer personal data — so confirm that with your Caldicott Guardian before relying on it.