Who This Is For
Patient data anonymization needs differ across a health system. anonym.plus is built for the people who have to move PHI without moving risk:
- HIPAA privacy & compliance officers — need to prove Safe Harbor de-identification (45 CFR §164.514(b)(2)) was applied to every field, without onboarding a new cloud vendor or negotiating a Business Associate Agreement.
- Clinical research coordinators & IRB liaisons — need de-identified datasets ready for multicenter studies, plus a way to re-identify specific records later if the IRB approves follow-up contact.
- Health system CISOs & IT security leads — need to close the "someone pasted a patient chart into a public AI chatbot" risk without adding another SaaS integration or API key to the environment.
- Health IT analysts — need to prepare EHR exports for external audits, grant reporting, or academic partners without creating a new PHI transmission event.
The Challenge
A hospital research department needs to share patient outcome datasets with external academic partners for a multicenter clinical study. The datasets contain names, dates of admission, diagnoses, medication codes, and national patient IDs. Uploading to any cloud service risks GDPR Art. 9 special-category data violations and HIPAA PHI transmission requirements. No Business Associate Agreement has been established with the research partner's IT infrastructure.
Why Healthcare Is the Highest-Risk Industry for Breaches
Every one of the incidents below started the same way: patient data left a controlled environment. That is exactly the step anonym.plus is designed to remove from your workflow.
| Statistic | Detail | Source |
|---|---|---|
| $7.42M | Average cost of a healthcare data breach | HIPAA Journal, 2025 |
| 139 breaches | Large healthcare breaches reported in Q3 2025 alone, affecting 9.5 million patients | Compliancy Group, 2025 |
| 193 million people | Affected by the Change Healthcare breach — the largest healthcare data breach on record | HHS OCR breach portal; HIPAA Journal, 2025 |
| Costliest sector | Healthcare has repeatedly had the highest average data-breach cost of any industry in IBM's annual report | IBM Cost of a Data Breach Report |
These figures describe breaches at organizations that, in most cases, already had cloud-based security tooling in place. Anonymizing PHI before it is uploaded anywhere — rather than trusting a vendor to protect it after upload — removes an entire category of exposure.
The Solution
The research team installs anonym.plus on a workstation within the hospital's secure network. They use Batch mode to process the full patient dataset (XLSX format, 40,000 rows) using the Healthcare preset. All 18 HIPAA Safe Harbor identifiers are removed using the Replace operator. Health data is permanently replaced with structured labels: [PERSON_1], [DATE_1], [MEDICAL_RECORD_1]. The processing takes under 3 minutes. No data leaves the hospital network during processing.
The Results
- All 18 HIPAA Safe Harbor identifiers removed — Safe Harbor de-identification achieved
- Dataset exits GDPR Art. 9 scope — no longer health data under Recital 26
- No BAA required — anonym.plus is not a Business Associate; no PHI transmitted to any third party
- Dataset shared securely with academic partners via standard file transfer — no special data transfer agreement needed
- Processing history logged locally as documentation for DPIA and research ethics compliance
PHI Entity Types Detected
| HIPAA Category | anonym.plus Entity Type | Example |
|---|---|---|
| Names | PERSON | Dr. Maria Schmidt → [PERSON_1] |
| Dates | DATE_TIME | 03/15/1978 → [DATE_1] |
| Phone numbers | PHONE_NUMBER | +49 30 123456 → [PHONE_1] |
| Email addresses | EMAIL_ADDRESS | patient@clinic.de → [EMAIL_1] |
| SSN / National IDs | US_SSN, DE_TAX_ID, IN_AADHAAR | 123-45-6789 → [ID_1] |
| Medical record numbers | MEDICAL_LICENSE, Custom entity | MRN-78234 → [MRN_1] |
| IP addresses | IP_ADDRESS | 192.168.1.45 → [IP_1] |
| Geographic data | LOCATION, STREET_ADDRESS | Hauptstraße 12, Berlin → [LOCATION_1] |
Compliance Achieved
- HIPAA Safe Harbor (45 CFR §164.514(b)): All 18 identifiers removed. No actual knowledge of re-identification risk.
- GDPR Art. 9: Health data anonymized — no longer special-category personal data after Replace processing.
- GDPR Recital 26: Replace operator produces true anonymization — re-identification effectively impossible.
- No BAA required: anonym.plus is not a Business Associate. No PHI transmitted. No DPA (Art. 28) required.
- DPIA support: Local processing history provides audit trail for Data Protection Impact Assessment documentation.
How Offline De-Identification Works
- Load locally. Drag in clinical notes, spreadsheet exports, or EHR data extracts (CSV, XLSX, or plain text). Nothing uploads — the file only ever exists on the workstation running anonym.plus.
- Detect all 18 Safe Harbor identifiers. The local detection pipeline (Presidio + spaCy models running on-device) flags names, dates, MRNs, device identifiers, IP addresses, and the rest of anonym.plus's 340+ entity types — no data leaves the machine during scanning.
- Choose an operator and export. Use Replace, Redact, or Mask for permanent, irreversible de-identification, or Encrypt when a study may need to re-identify specific records later — Encrypt uses a locally stored AES-256-GCM key, decryptable only on a device that holds that key.
On-Device vs. Cloud vs. Manual Review
| Dimension | anonym.plus (on-device) | Cloud PII/DLP tools | Manual chart review |
|---|---|---|---|
| PHI leaves your network | Never — processing is 100% local | Yes — uploaded to a vendor's servers or API | No upload, but no consistent audit trail either |
| BAA required | No — anonym.plus is not a Business Associate; no PHI is transmitted | Usually, since PHI is processed by a third party | N/A |
| Throughput on large datasets | Batch mode processes tens of thousands of rows locally in minutes | Limited by API rate limits and network conditions | Hours to days, entirely human-paced |
| Entity coverage | 340+ entity types, including all 18 HIPAA Safe Harbor identifiers | Varies significantly by vendor and plan | Limited to what the reviewer is trained to recognize |
| Ongoing cost | One-time license, no subscription | Recurring subscription or usage-based fees | Ongoing staff time |
| Documentation for compliance | Local processing log supports DPIA/HIPAA audit documentation | Depends on vendor's logging/export capability | Manual notes, inconsistent |
Why On-Device Wins for Healthcare Specifically
PHI is uniquely valuable and uniquely regulated. Every tool that requires uploading patient data to a third-party server or API introduces a new vendor relationship, a new potential Business Associate determination, and a new point where a breach can occur outside your control. anonym.plus runs the entire detection-and-de-identification pipeline on the same workstation that is already inside your facility's network perimeter — patient data is never transmitted anywhere during processing. You can verify this yourself by disconnecting the network entirely — anonym.plus still processes documents with zero outbound network calls, by design.
This matters most for the two situations healthcare organizations face repeatedly: sharing a dataset with an external research partner before a data use agreement is fully negotiated, and responding to an audit or records request under time pressure. In both cases, the fastest and lowest-risk path is to remove the identifiers before the data leaves the building — not to trust a new cloud processor to remove them after it arrives.
Ready to try? Read the HIPAA de-identification guide →
Important Considerations
- HIPAA Safe Harbor vs Expert Determination: The Replace operator satisfies HIPAA Safe Harbor (all 18 identifiers removed) but does not constitute formal Expert Determination under 45 CFR §164.514(b)(1). For research datasets requiring Expert Determination certification, consult a qualified statistician to document re-identification risk analysis.
- Clinical utility trade-offs: Anonymization removes patient identifiers but preserves structured data (diagnoses, procedures, lab values). For longitudinal studies requiring patient-level tracking across time, consider pseudonymization with secure patient ID mapping instead of irreversible anonymization.
- State-specific breach notification: Anonymized data is not PHI under HIPAA and does not trigger federal breach notification (45 CFR §164.402). However, some state laws (e.g., California CMIA) have broader definitions of medical information. Verify state breach notification thresholds before treating anonymized data as non-regulated.
Frequently Asked Questions
Does anonym.plus handle HIPAA-regulated patient records?
Yes. All 18 Safe Harbor PHI categories are covered by built-in entity types plus custom entity support. Processing is 100% offline. anonym.plus is not a Business Associate — no BAA required or available.
Does anonymizing with anonym.plus satisfy GDPR Article 9 for health data?
Yes. Once processed with Replace or Redact operators, health data is no longer personal data under GDPR Recital 26. Art. 9 special-category restrictions no longer apply to the anonymized output.
What file size can anonym.plus handle for large patient datasets?
XLSX: 20 MB / 100,000 rows. CSV: 30 MB. For larger datasets, split into batches. Batch mode processes up to 20 files in parallel (Pro plan).