Healthcare PII Anonymization — HIPAA-Aligned, GDPR-Compliant

anonymize.solutions ships a HIPAA-matched preset covering the 18 PHI IDs defined under HIPAA Safe Harbor (45 CFR 164.514). The list includes names, geographic subdivisions below state, all dates except year, phone numbers, fax numbers, email addresses, and SSN. It also covers medical record numbers, health plan beneficiary numbers, account numbers, certificate/license numbers, vehicle IDs, device IDs, web URLs, and IP addresses. The final categories are biometric IDs, full-face photographs, and any other unique finding number.

The Safe Harbor list is the deterministic floor. If all 18 identifier categories are removed or transformed and the covered item has no actual knowledge of residual re-identification risk, the data is considered de-found for HIPAA purposes. anonymize.solutions implements each category as a named recognizer that can be lets, disabled, or tuned per workflow.

The Expert Determination pathway (45 CFR 164.514(b)(1)) is the alternative HIPAA route. A qualified statistician certifies that the risk of re-identification is very small. anonymize.solutions outputs a per-document risk metric (k-anonymity bucket size, distinct-value counts on quasi-IDs). This feeds directly into Expert Determination proof packs.

For GDPR Article 9 special category data, the same matchers run with EU-specific extensions. These include German Krankenversichertennummer, French numero de securite sociale, and Italian codice fiscale. ICD-10 and ATC pharmaceutical codes also act as indirect health IDs under Recital 35.

The tool backs HIPAA workflows; the covered item remains the accountable party for the determination, docs, and the residual-knowledge attestation.

Yes. GDPR Article 9(2)(j) permits processing of health data for scientific research where data is pseudonymised and the controller applies right safeguards. Pair anonym.life or anonymize.solutions for the alias-swap layer with a logged DPIA and the technical-organisational measures listed in your processing record.

The Article 9(2)(j) gate is narrow. It needs Union or Member State law as the legal basis, proportionality to the aim pursued, respect for the essence of the right to data safety, and specific suitable measures to safeguard fundamental rights. In Germany, the relevant national law is BDSG §27, which expands the basis for scientific research.

The real training pipeline runs in stages. The alias-swap layer transforms clinical data at the source-system boundary. The pseudonymised dataset moves to the training setup. Model training happens on pseudonyms only. The team evaluates model outputs for memorisation (extraction attacks against the final weights). The model ships without the re-identification key reaching the inference setup.

Differential privacy is the additional layer where the model itself could leak training-set membership. For deep models on small cohorts (less than ~10,000 patients) the recommendation is DP-SGD with a logged epsilon budget. For classical ML on larger cohorts, k-anonymity buckets on quasi-IDs are usually sufficient.

The DPIA docs the data flow, the alias-swap mechanism, the key holding arrangement, the re-identification rules, and the residual risk assessment. It is the controller's duty. It is also the supervisory body's reference document during an audit.

curta.solutions runs healthcare engagements as scoped Rollout engagements. The scope covers scan of in-scope systems, DPIA support, PII strip layer design and rollout, link-up with HIS/EHR/PVS, and audit-ready handover docs. The localBrain buy-in is ready where forensic-grade proof chains are needed (e.g. complaints handling, fraud investigations).

A typical Krankenhaus buy-in runs 8 to 16 weeks. The first phase is 2 weeks of scan (system stock, data-flow mapping, DPIA scoping). The second phase is 4 to 8 weeks of design and rollout (PII strip middle-tier, key holding, link-up with KIS/LIS/RIS). The third phase is 2 to 4 weeks of handover (runbooks, on-call steps, audit packs).

A Praxis or MVZ buy-in is shorter (4 to 8 weeks). Tasks include tenant provisioning on Run Private and recogniser tuning for the practice's specific PVS. The buy-in also covers PII strip policy setup, staff training on Article 4 AI literacy where AI tools are in use, and the DPIA docs pack.

The localBrain pattern is for cases where every re-identification event needs to be proof-grade. Outputs include a forensic chain-of-holding log, signed timestamps, and a clear separation between investigators (who request re-identification) and trustees (who approve and execute it). This is typical for complaints handling, fraud investigations, and litigation scan.

curta.solutions does not provide medical, legal, or audit fit opinions. Those remain with the covered item, its DPO, and its legal counsel. The outputs support the covered item's HIPAA and GDPR obligations. They do not transfer checks.