Pharmacy-claims de-identification is the removal of patient and member IDs from a claims extract. Reimbursement runs through NHSBSA Prescription Services under the NHS (Pharmaceutical and Local Pharmaceutical Services) Regulations 2013, but an analytics copy needs no names. anonym.plus does this locally and keeps the fill and cost fields intact.
When this applies
A claims extract ties many fills to one named member with a plan number. For spend or adherence analytics, the rows must still join per person — which a steady alias gives you without a real identity anywhere in the file.
How anonym.plus handles it
- Point anonym.plus at the extract on your device.
- It scans ID columns and any free-text notes.
- Member names, plan numbers, and dates get flagged.
- Confirm the flags; the medicine and cost stay as non-IDs.
- Swap IDs with a steady map to keep row joins.
- Save the clean dataset; the source stays on your machine.
What you need to provide
- The extract as CSV, JSON, or a bundle of files.
- A column map for member and plan ID fields.
- Replace with a steady map to keep table joins.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | member_name → [MEMBER_n] |
| Identifiers | NATIONAL_ID | plan no. → [PLAN_ID] |
| Dates | DATE_TIME | fill_date → shifted [DATE] |
| Record IDs | MEDICAL_RECORD_NUMBER | claim no. → [CLAIM_ID] |
| Location | LOCATION | postcode → [POSTCODE] |
| Identifiers | NHS_NUMBER | NHS no. → [NHS_NUMBER] |
Compliance achieved
- Reimbursement claims flow to NHSBSA Prescription Services under the NHS (Pharmaceutical and Local Pharmaceutical Services) Regulations 2013; the analytics copy you keep needs no member names.
- Strips special-category data under UK GDPR Art. 9(1) while applying data minimisation under Art. 5(1)(c).
- Truncating a full postcode answers the small-population risk the ICO anonymisation guidance singles out for geography.
- DPA 2018 s.171 criminalises re-identifying the released extract, which is part of the assurance you record before you share it.
Anonymise pharmacy claims offline — see plans & start free →
Limitations & cautions
A full postcode can identify a very small area, so truncate it where the ICO motivated-intruder test requires. The medicine and cost stay. Test a sample before a full run, and check that date-shift keeps the gaps your analysis needs. A steady alias map is pseudonymisation, not anonymisation, while you hold the key.
Frequently asked questions
Can claims stay linkable after the swap?
Yes. A steady label map swaps each ID the same way, so rows for one member still join while no real identity is left in the file.
Are the medicine and cost fields kept?
Yes. They are not member identifiers, so they stay. Only the personal ID types are removed.
Why work locally rather than in the cloud?
Sending raw claims to a cloud tool is itself a disclosure with breach risk, and it pulls a processor into scope under UK GDPR Art. 28. Local work skips both.