De-identification explained for Australian clinicians

Under the Privacy Act, information is de-identified when it "is no longer about an identifiable individual or an individual who is reasonably identifiable". Once that is true, it is no longer personal information. Removing the name is only the first step. The real test is whether someone could reasonably work out who the person is, in the setting where the data will be used. A case summary with no name but a rare diagnosis, a school and an appointment date can still point at one child. This guide covers what the law says, why paediatric records are harder to de-identify than most, and a practical way to do it.

This is general information, not legal advice.

What does de-identified mean under the Privacy Act?

The Privacy Act defines personal information as information or an opinion about an identified individual, or an individual who is reasonably identifiable. The Office of the Australian Information Commissioner (OAIC) explains this in its guidelines on key concepts. The same guidelines say information is de-identified when it is no longer about an identifiable individual or an individual who is reasonably identifiable. De-identified information is not personal information, so the Australian Privacy Principles (APPs) do not apply to it in the same way.

Health information is sensitive information, which has stricter rules, and the small business exemption does not apply to a health service that holds it.

The OAIC's guidance, De-identification and the Privacy Act, treats de-identification as risk management rather than an exact science. The aim is a risk of re-identification that is very low, with no reasonable likelihood of re-identification, in the specific data access environment. The same data can be fine in one setting and unsafe in another.

De-identified, anonymised, pseudonymised: what's the difference?

The Privacy Act uses the term "de-identified". People use "anonymised" and "pseudonymised" more loosely, and definitions in other jurisdictions (the European GDPR is the usual comparison) do not line up neatly with the Australian one. Do not assume a term borrowed from a vendor's marketing page carries any legal meaning here.

Pseudonymised data replaces direct identifiers, such as a name, with a code or an alias, and a key links the code back to the person. Where a key exists, the data is generally still personal information for whoever holds the key. That follows the OAIC's point that the holder of the original dataset may still be able to re-identify people, while a recipient without the key may be dealing with de-identified data. The practical question is always who has the data, what else they hold, and what they could reasonably do with it.

Why paediatric data is easy to re-identify

Children's records carry features that make a person stand out in a small group. The OAIC says the "motivated intruder" test is the minimum standard: could someone who sets out to identify a person, using resources reasonably available to them, succeed? For paediatric information, several things help that person along.

• Small populations. A seven-year-old in a regional town is a short list.
• Rare conditions or unusual presentations, which narrow the list further.
• School name, class year and suburb, which are easy to match against public information.
• Dates of birth and appointment dates, which can be matched against other records or a parent's memory.
• Siblings and parents named in the history, including in family and developmental sections.
• Photos and voice recordings, where the face or voice is the identifier.
• Free-text notes, where a clinician may write a teacher's name, a sports team or a family event without thinking.

None of these is a name, yet combined they often identify a child.

How to de-identify clinical information: a step-by-step approach

The OAIC describes two steps. First, remove direct identifiers such as name and address. Second, remove or alter other identifying information, apply controls to the data access environment, or both.

Step 1: remove direct identifiers. For paediatric notes this means the child's name and nicknames, parents' and siblings' names, street address, phone numbers, email addresses, record and insurance numbers, and any photo or recording.

Step 2: deal with quasi-identifiers. These are details that are not identifying alone but identify in combination: school, suburb, date of birth, appointment dates, rare diagnosis, language spoken at home, the name of a treating colleague or service. The OAIC lists techniques that can be used in plain terms:

• Sampling: sharing a subset of records instead of all of them.
• Removing or choosing variables: leaving out a field or choosing a coarser one.
• Rounding and grouping into ranges: an age band instead of a birth date, a month instead of a day.
• Perturbation: making small changes to values.
• Swapping: exchanging values between records.
• Synthetic data: artificial records that keep the pattern of the real ones.
• Encrypting or hashing identifiers.

Step 3: consider the data access environment. Controls matter as much as edits. The OAIC lists limiting who has access, secure environments, analysis-only access, and contracts that prohibit re-identification. A summary shared in a closed supervision group sits in a different risk position from one posted online.

Step 4: get specialist help where the risk is higher. The OAIC says rich data, public release and sharing among multiple parties need specialist expertise. For a framework to work through, see the OAIC and CSIRO Data61 De-Identification Decision-Making Framework.

Worked example

The child below is fictional, as are the school and suburb.

Before

Jamie Example, born 14 March 2018, attends Example Creek Primary School in Exampleton. Jamie lives with his mother and his older sister, Sam. Jamie has Examplar syndrome, a very rare condition. He was first seen on 6 February 2026 for a language assessment, reviewed on 20 March 2026 and again on 15 May 2026. His teacher, Ms Sample, reports he struggles to follow multi-step instructions in class.

After

A boy aged 7 to 8 years, living in a regional area, with a rare genetic condition, was seen for a language assessment early in the year and reviewed over the following three months. His school reports difficulty following multi-step instructions in class. He has an older sibling.

What changed: the name, date of birth, school, suburb, sibling's name, teacher's name and exact dates are gone. Age is now a range, the location is generalised and the appointment dates are generalised into broad periods.

What risk remains. The rare diagnosis in a small region may still make this child reasonably identifiable to someone who knows the community, such as a teacher, a neighbour or another clinician. Whether the summary is de-identified depends on who will read it and what else they know. Shared in a supervision group in another city, the risk may be very low. Shown at a local conference, it may not be. In the second setting the diagnosis might need to be generalised further, or the case left out.

When do you need to de-identify?

De-identify when you want to use clinical information for something other than the care of that child and you do not have a basis to use or disclose the personal information. Common situations include:

• Case studies for conferences or teaching.
• Supervision or peer discussion outside the treating team.
• Research and clinical audit.
• Sharing an example with a colleague at another practice.
• Putting text into an AI tool that is not set up for clinical data.

On the last point, the OAIC's guidance on commercially available AI products recommends that organisations "do not enter personal information, and particularly sensitive information, into publicly available generative AI tools". Entering personal information into a public chatbot is likely a disclosure to the tool's owner and needs an APP 6 basis. A badly de-identified summary pasted into a chatbot can still be personal information.

De-identification does not remove other obligations. Research may still need ethics approval, and professional codes, workplace policies and any consent arrangements still apply.

Is de-identified data still covered by the Privacy Act?

If information is truly de-identified, it is not personal information and the Privacy Act's rules on personal information do not apply to it. Truly de-identified is a high bar, and the OAIC does not treat it as permanent.

The OAIC says APPs 6, 8 and 11 remain relevant as risk management: how you use the data, whether you send it overseas and how you secure it all affect the chance of re-identification. Data can become personal information again if controls fail or the data is breached, or when it is combined with other information. If that happens, the Notifiable Data Breaches scheme may apply.

In short

• Information is de-identified under the Privacy Act when it is no longer about an identifiable individual or an individual who is reasonably identifiable.
• Removing the name is the first step. School, suburb, dates, siblings and rare diagnoses often identify a child on their own or in combination.
• Pseudonymised data with a key is generally still personal information for the key holder.
• The risk depends on who receives the data and what controls surround it, so the same summary can be fine in one setting and unsafe in another.
• De-identification does not remove other obligations such as ethics approval for research.

FAQ

What is de-identified data under the Privacy Act?

It is information that is no longer about an identifiable individual or an individual who is reasonably identifiable. The OAIC says de-identified information is not personal information. The assessment is about whether re-identification is reasonably likely in the setting where the data will be used.

Is removing the patient's name enough to de-identify patient information?

No. Removing direct identifiers is the first of the OAIC's two steps. You also need to remove or alter other details, such as school, suburb and dates, or control who can access the data, because a combination of those details can still point to one child.

What is re-identification risk?

Re-identification risk is the chance that someone could work out who a person is from information that has had identifiers removed. The OAIC says the risk must be very low, and that a motivated intruder test is the minimum standard. Paediatric data carries higher risk because populations are small and details such as school and diagnosis stand out.

Can I paste a de-identified case into ChatGPT?

Only if it is genuinely de-identified for that setting. The OAIC recommends not entering personal information, particularly sensitive information, into publicly available generative AI tools. If a person could reasonably be identified from your text, treat it as personal information.

Syntropic Health drafts reports and notes inside the case, so there is no need to paste patient details into outside tools, and the clinician reviews and signs every draft.

Sources

• oaic.gov.au
• oaic.gov.au
• oaic.gov.au
• oaic.gov.au