Record de-identification is the removal of personal identifiers from a scheduling list. Booking rows are still health data when they show who attended which clinic, so UK GDPR Art. 9(1) applies. Art. 5(1)(e) limits how long you may keep them in identifiable form, and the Records Management Code of Practice for Health and Social Care 2021 sets the NHS retention periods that give that principle a number. anonym.plus runs offline and keeps the slot times and visit types that drive capacity analysis.
When this applies
A booking list names each patient and ties them to a slot, a phone number, and an email. No-show and utilisation studies need the timing pattern, not the people. Date-shifting keeps the pattern while the real appointment dates disappear.
How anonym.plus handles it
- Open the booking list in anonym.plus on your device.
- It finds patient names, numbers, emails, and identifiers.
- Slot times and visit types stay in place.
- Shift the dates while you keep the spacing intact.
- Save the clean schedule on your device.
What you need to provide
- The schedule (CSV, JSON, PDF, or EPR export).
- A date-shift option to keep slot spacing.
- Replace with a steady label map for joins.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | booked name → [PATIENT] |
| Contact | PHONE_NUMBER | reminder phone +44 → [PHONE] |
| Contact | EMAIL_ADDRESS | confirm email → [EMAIL] |
| Dates | DATE_TIME | slot 09:30 03 Jun → shifted [TIME] |
| NHS number | NHS_NUMBER | NHS 512 345 0099 → [NHS_NO] |
| Names | PERSON | provider column → [CLINICIAN] |
Compliance achieved
- Booking rows that show clinic attendance are special category data under UK GDPR Art. 9(1).
- Supports the storage limitation principle in UK GDPR Art. 5(1)(e) by cutting the identifiable copy early.
- Retention of the underlying record follows the Records Management Code of Practice for Health and Social Care 2021.
- A kept offset or alias map leaves the file pseudonymous under UK GDPR Art. 4(5), not anonymous.
- Works on exports from booking systems including the NHS e-Referral Service.
- Fully offline — booking detail stays on-site.
Anonymise appointment records offline — see plans & start free →
Limitations & cautions
Shifting dates keeps the spacing but breaks links to outside calendars unless you move those by the same offset. A rare visit type at a small clinic can still narrow identity once the obvious tags are gone.
Frequently asked questions
How does date-shift keep the schedule useful?
Every booking moves by one steady offset, so the gaps between slots survive. No-show and utilisation analysis still runs. Because the offset can reverse the shift, keeping it makes the file pseudonymous under Art. 4(5), so store it apart from the data.
How long may we hold identifiable booking records?
UK GDPR Art. 5(1)(e) says no longer than the purpose needs, and the Records Management Code of Practice for Health and Social Care 2021 turns that into specific NHS retention periods by record type. De-identifying the analytics copy lets you keep the operational value after the identifiable copy is disposed of.
Are clinician names removed?
They can be. A clinician's name is not the patient's personal data, but blinded capacity studies usually swap it so comparisons stay about the service rather than about individuals.