Referral-letter de-identification removes patient and clinician identifiers from a referral so it can be reused outside direct care. Sending the original in full is not optional: NHS Act 2006 s.251B, inserted by the Health and Social Care (Safety and Quality) Act 2015, makes sharing information for an individual's own care a duty, and Caldicott Principle 7 says that duty weighs as heavily as protecting confidence. Secondary use is different, and Caldicott Principle 3 says use the minimum necessary. anonym.plus clears the identifiers on your device and keeps the clinical question intact.
When this applies
Referral letters move between practices through the NHS e-Referral Service. Each one carries the full patient identity, the sender's details, and the history. For a teaching file or an audit sample, clear those identifiers and keep the reason for referral.
How anonym.plus handles it
- Load the letter into anonym.plus on your device.
- The tool flags patient, sender, and addressee names plus contacts.
- It scans the header and signature block, not just the body.
- Swap or black out the confirmed identifiers.
- Save the clean letter on your device.
What you need to provide
- The letter (PDF, DOCX, or scan).
- An operator; Replace keeps the letter readable.
- Optional allow-list to keep your letterhead wording.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | J. Marek → [PATIENT] |
| Names | PERSON | Dr Lindqvist → [PROVIDER] |
| Contact | PHONE_NUMBER | 0113 496 0123 → [PHONE] |
| Location | LOCATION | Riverside Surgery, Leeds → [PRACTICE] |
| Dates | DATE_TIME | DOB 04/1971 → [DOB] |
| Record IDs | MEDICAL_RECORD_NUMBER | Ref# 7781 → [REF_ID] |
Compliance achieved
- Leaves the direct-care duty untouched: NHS Act 2006 s.251B requires the original to be shared for the patient's own care.
- Applies Caldicott Principle 3 — use the minimum necessary confidential information — to the secondary-use copy.
- Respects Caldicott Principle 7: the duty to share for individual care matters as much as the duty to protect confidentiality.
- Removes UK GDPR Art. 9(1) health identifiers, alongside the common-law duty of confidence that governs the original.
- Header, body, and signature block are all scanned, including letterhead on an NHS e-Referral Service printout.
- Runs offline with AES-256-GCM at rest — no cloud relay.
Anonymise referral letters offline — see plans & start free →
Limitations & cautions
Letterhead, fax footers, and logos can hold names. OCR helps, but check scanned letterheads carefully. A birth date reduced to a year is still an identifier once it is tied to the person. And never strip a letter that is on its way to the receiving clinician — s.251B requires that one to travel in full.
Frequently asked questions
Should I remove the sending doctor's name too?
For a teaching or research copy, usually yes: under UK GDPR a named clinician is an identifiable individual just as the patient is, and blinding the sender is often the point of the exercise. anonym.plus can flag patient and provider names together or separately.
Does de-identification conflict with the duty to share?
No, because the two apply to different copies. NHS Act 2006 s.251B and Caldicott Principle 7 concern the letter that goes to the clinician taking over care, which must be complete. Caldicott Principle 3 concerns everything else, where you use the minimum necessary — and often that means no identifiers at all.
Can I process a scanned letter?
Yes. Local OCR reads scanned pages, so identifiers printed in an image letter are caught along with those in the text layer. Check the low-confidence flags on faint or skewed scans before you export.