De-identify a dataset, step by step
Interactive
Learning objective: by the end of this lab, you will be able to name the categories of identifiers that make a health dataset re-identifiable, and describe what handling each category requires.
Toggle the two steps below and watch the sample dataset change. Read the explanation under each step for the reasoning, but drive it yourself first.
Critical: names, phone numbers, and MRNs are exposed. Anyone with this file can identify every patient directly.
| Name | Phone | MRN | DOB | ZIP | Admitted | Diagnosis |
|---|---|---|---|---|---|---|
| Alex Chen | 555-0142 | MRN-88213 | 1987-03-14 | 90210 | 2026-01-15 | Type 2 diabetes |
| Priya Patel | 555-0198 | MRN-88214 | 1992-11-02 | 90211 | 2026-01-16 | Hypertension |
| Jordan Reyes | 555-0173 | MRN-88215 | 1979-07-22 | 59718 | 2026-01-15 | Fibrodysplasia ossificans progressiva |
| Sam Okafor | 555-0156 | MRN-88216 | 1995-05-30 | 90210 | 2026-01-17 | Seasonal allergies |
| Morgan Lee | 555-0189 | MRN-88217 | 1988-09-11 | 90212 | 2026-01-16 | Migraine |
Step 1: Direct identifiers
Names, phone numbers, and medical record numbers are direct identifiers. They are removed outright, not masked. There is no acceptable way to keep them and still call a dataset de-identified.
Step 2: Quasi-identifiers
Date of birth, ZIP code, and admission date are not identifying alone, but combined they frequently are. Generalise them: birth year instead of birth date, three-digit ZIP instead of five, month of admission instead of exact date.
Step 3: The small-cell problem
Even after steps 1 and 2, a rare diagnosis in a small ZIP code can still identify someone. Toggle both steps above and look at Jordan Reyes's row: a rare diagnosis holds even once the fields around it are generalised. This is why de-identification is a property of the whole dataset, not of any single field, and why it needs to be re-checked whenever a dataset is filtered or combined with another.
What to take away
Re-identification risk is cumulative and dataset-wide, not field-by-field. You just watched two fields fix most of a dataset and leave one row exposed anyway. That is not a bug in the exercise. It is the actual shape of the problem.