QI-dataset anonymisation is the removal of personal data from a quality extract. Using identifiable patient records for audit or improvement work without individual consent normally needs support under s.251 of the NHS Act 2006, given effect by the Health Service (Control of Patient Information) Regulations 2002 and approved case by case by the Confidentiality Advisory Group. anonym.plus runs on your own device and removes that need by making the extract properly anonymous instead. The measures stay usable, but the rows no longer name anyone.
When this applies
A quality team pulls thousands of rows to track an outcome over time. Rather than seek s.251 support for an identifiable dataset, you anonymise it on your own device before the analysis starts, since a truly anonymous extract needs no such approval.
How anonym.plus handles it
- Point anonym.plus at the extract on your server.
- It scans ID columns and any free-text note fields.
- Steady labels keep links across joined rows intact.
- Review the summary and tune the column rules.
- Swap each identifier, shifting dates to keep the gaps.
- Save the clean extract. Source rows stay local.
What you need to provide
- The extract (CSV, JSON, or a bundle of files).
- A column map for known ID fields.
- Replace with a steady label map to keep joins.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Patient | PERSON | patient_name → [PATIENT_n] |
| Staff | PERSON | attending → [CLINICIAN_n] |
| Record IDs | MEDICAL_RECORD_NUMBER | nhs_number column → [NHS_NUMBER_n] |
| Dates | DATE_TIME | event_date → shifted [DATE] |
| Location | LOCATION | unit address → [ADDRESS] |
| Free text | PERSON / LOCATION | inline names → labels |
Compliance achieved
- Avoids the need for s.251 NHS Act 2006 / Health Service (Control of Patient Information) Regulations 2002 support by making the extract properly anonymous instead of identifiable.
- Strips personal data under UK GDPR Art. 9 & DPA 2018.
- Runs offline, so no supplier contract is needed.
- Keeps row links steady, so the measures stay analysable.
Anonymise QI datasets offline — see plans & start free →
Limitations & cautions
A quality extract mixes tidy columns with messy notes. Column rules handle the first well, but note fields need the same care as any chart. Test a sample first, and check that date-shifting keeps the gaps your trend needs.
Frequently asked questions
Do I need Confidentiality Advisory Group approval for this?
Only if the dataset stays identifiable. Section 251 of the NHS Act 2006, given effect through the Health Service (Control of Patient Information) Regulations 2002, lets the Confidentiality Advisory Group approve use of identifiable records without consent for defined purposes, including some audit work. A dataset anonymised on your own device before analysis doesn't need that approval, because it's no longer confidential patient information.
Can rows stay linkable after the swap?
Yes. A steady label map swaps each identifier the same way, so rows for one person still join while no real identity is left in any column.
Why work locally rather than in the cloud?
Sending raw patient data to a cloud tool is itself a disclosure. Local work skips that exposure and any supplier-contract burden it brings, on top of the s.251 question above.