Export anonymisation is the removal of personal detail from a patient portal download. These bundles are often built for a UK GDPR Art. 15 subject access request, which Art. 12(3) says must normally be answered within one month. Where the pack contains health information, DPA 2018 Schedule 3, Part 2 sets the serious-harm test that limits what may be released. The NHS Data Security and Protection Toolkit governs how your organisation handles the file. anonym.plus anonymises it on your own device.
When this applies
A portal lets patients pull their records, messages, and results into one download. The same export routine feeds your analytics pipeline. Analytics does not need identity, so strip the file before it leaves the record system, not after it reaches a spreadsheet.
How anonym.plus handles it
- Point anonym.plus at the download folder on your server.
- It scans identifier columns and any free-text fields.
- Steady labels keep links across joined rows intact.
- Review the summary and tune the column rules.
- Save the clean dataset on your device for later.
What you need to provide
- The download as CSV, JSON, or a file bundle.
- A column map for known identifier fields.
- Replace with a steady label map to keep joins.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | account name → [PATIENT] |
| Contact | EMAIL_ADDRESS | portal email → [EMAIL] |
| Identifiers | USERNAME | login handle → [HANDLE] |
| Dates | DATE_TIME | login date → shifted [TIME] |
| Network | IP_ADDRESS | access IP → [IP] |
| NHS number | NHS_NUMBER | NHS 730 118 4402 → [NHS_NO] |
Compliance achieved
- Keeps the export off the cloud, which supports your NHS Data Security and Protection Toolkit submission.
- The Toolkit measures you against the National Data Guardian's ten data security standards.
- Leaves the identified original available for a UK GDPR Art. 15 request answered within the Art. 12(3) one-month deadline.
- Recognises the serious-harm limits on releasing health information in DPA 2018 Schedule 3, Part 2.
- Supports full anonymisation, taking the analytics copy outside scope by UK GDPR Recital 26.
- Keeps row links steady, so the file stays useful for analysis.
Anonymise patient portal exports offline — see plans & start free →
Limitations & cautions
A portal download mixes tidy columns with free-text notes and message bodies. The columns map cleanly. The free text needs the same review as any clinical note, so test a sample before you commit to a full run.
Frequently asked questions
Can I anonymise the copy I send in answer to a subject access request?
No. An Art. 15 request asks for that person's own information, so anonymising it would defeat the request. What you may redact is other people's data in the same pack, and health information caught by the serious-harm test in DPA 2018 Schedule 3. Anonymisation belongs to the analytics copy, not the disclosure copy.
Why work locally rather than in the cloud?
Uploading raw portal content to a third-party service is itself a disclosure, and the NHS Data Security and Protection Toolkit asks you to account for exactly that kind of flow. Working on the device removes the transfer, so there is no vendor to assess and no processor contract to negotiate.
Does it handle both fields and message bodies?
Yes. Structured columns and free-text message bodies in the bundle are both supported, with the same operator applied across the export.