Standard
Written down, versioned, and the same every time.
De-identification that varies by operator is not a standard, it is a habit. Ours is a document, it names the standards it is built against, and the result is reviewed by a second person.
What it is built against
The identifier taxonomy follows the HIPAA Safe Harbor identifier classes at 45 CFR 164.514, used outside health precisely because it is specific and auditable. Lifecycle risk framing follows ISO/IEC 27559. Technique selection follows NIST SP 800-188. The residual-risk target follows the Ontario Information and Privacy Commissioner's de-identification guidelines for structured data.
Source of record: operations/De_Identification_Standard.mdTechnique by identifier class
- Direct identifiers. Names, contact details, account and government numbers. Suppressed, or replaced with a salted non-reversible token where the link between records has to survive.
- Quasi-identifiers. Dates, locations, rare roles and job titles. Generalised or banded. Dates shifted consistently within a corpus where the interval matters more than the absolute.
- Free text. Screened for direct identifiers by pattern and by a mandatory substring scan against the known identifier list for that corpus.
- Scanned and photographed documents. Identifiers removed by pixel destruction, not by an overlay. An overlay that can be moved is not a redaction.
Quality assurance
Two people. The operator who applied the standard and a second reviewer who did not. Both are recorded against the delivery, by name, in the provenance record. A corpus does not ship on one person's word.
Source of record: operations/De_Identification_Standard.mdResidual risk, stated per corpus
No de-identification reduces risk to zero, and a supplier claiming otherwise is telling you something untrue. Each corpus carries a residual-risk note describing what remains and why it was accepted. You get that note before you licence, not after.
Source of record: operations/De_Identification_Standard.mdDe-identified is not anonymised
These are different legal terms with different thresholds, and Quebec's Law 25 in particular distinguishes them sharply. We say de-identified because that is what we do. Where a corpus meets a higher bar we say so specifically and show the working.
Source of record: operations/De_Identification_Standard.mdNo re-identification
Every licence carries a covenant against attempting to re-identify any individual in a corpus, and against combining it with other data for that purpose. It binds the lab and anyone it sub-licenses to.
Source of record: legal/Supplier_Licence_Standard_Terms.md