Dataset anonymisation is the removal of personal identifiers from a remote-monitoring feed. The readings are special category data under UK GDPR Art. 9(1), and DPA 2018 Schedule 1, Part 1, paragraph 2 is the condition the service relies on. A health organisation deploying the monitoring system also has to meet DCB0160, the clinical risk management standard for the deployment and use of health IT, published under section 250 of the Health and Social Care Act 2012. anonym.plus runs offline and leaves the blood-pressure, glucose, and weight series intact.
When this applies
Home monitors stream readings tagged with the patient and the device serial. Population analysis or model training does not need either tag. The clinical safety case under DCB0160 does need the live feed to stay accurate, so anonymise a copy rather than the source.
How anonym.plus handles it
- Point anonym.plus at the export on your server.
- It scans identifier columns and any free-text notes.
- Hardware serials and patient keys both get flagged.
- Steady labels keep each person linked across rows.
- Review the summary, then save the clean set.
What you need to provide
- The export (CSV, JSON, or a record bundle).
- A column map for patient and device fields.
- Replace with a steady label map for joins.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | patient_name → [PATIENT_n] |
| Identifiers | ID | monitor serial 9F-2207 → [DEVICE] |
| Dates | DATE_TIME | reading_ts → shifted [TIME] |
| Network | IP_ADDRESS | gateway IP → [IP] |
| NHS number | NHS_NUMBER | NHS 512 999 0001 → [NHS_NO] |
| Location | LOCATION | home postcode → [PLACE] |
Compliance achieved
- Strips readings that are special category health data under UK GDPR Art. 9(1).
- Sits on the same DPA 2018 Schedule 1, Part 1, paragraph 2 condition the monitoring service already relies on.
- Leaves the live feed untouched for the clinical safety case required by DCB0160.
- DCB0160 is an information standard issued under section 250 of the Health and Social Care Act 2012.
- Keeping the export off the cloud supports your NHS Data Security and Protection Toolkit submission.
Anonymise remote monitoring datasets offline — see plans & start free →
Limitations & cautions
Hardware serials are unique and must go. A rare reading pattern at a known site can still narrow identity once the obvious tags are gone. Shift the timestamps, and apply the motivated-intruder test for small cohorts before you share anything.
Frequently asked questions
Is a monitor serial really an identifier?
Yes, once it maps to one patient. UK GDPR treats equipment identifiers as personal data whenever they can be tied back to an individual, and a home monitor is issued to one person. The tool flags the serial and swaps it like a name.
Does anonymising the export affect our DCB0160 safety case?
It should not, provided you work on a copy. DCB0160 covers the clinical risk of deploying and using the health IT system itself, which means the live feed clinicians act on has to stay complete and accurate. A de-identified analytics extract sits outside that flow.
Can rows stay linkable after the swap?
Yes. A steady label map gives each individual one alias, so their readings still join across the file. Keeping that map makes the output pseudonymous rather than anonymous, so store it separately and treat it as personal data.