De-identified Health Data: A Market Built on Imperfect Anonymity

The Data That Powers Medical AI Might Not Be as Anonymous as You Think

In 2019, a research team at Imperial College London demonstrated that machine learning models could re-identify 99.98% of Americans from anonymized datasets using just 15 demographic attributes. The dataset had been de-identified — names, addresses, social security numbers, and direct identifiers stripped out — following standard practice. The identifiability came not from any single data point but from the combination of characteristics that, in aggregate, are essentially unique to individuals. This is the uncomfortable premise at the heart of the de-identified health data market: anonymization is a process, not a guarantee.

That market is substantial and growing. Healthcare organizations, pharmaceutical companies, AI developers, and policy researchers all have legitimate and powerful reasons to want access to real-world patient data without the legal and ethical constraints of identified data. A structured look at this sector's development is available in this health data privacy and de-identification services industry analysis. What it reveals is a market that is simultaneously essential to medical progress and operating in persistent ethical tension.

How De-identification Is Supposed to Work

HIPAA's Safe Harbor method requires the removal of 18 specific identifiers — name, date of birth, geographic data below the state level, and 15 others. If these identifiers are removed and the covered entity has no actual knowledge that the remaining information could identify an individual, the data is legally de-identified and can be used, shared, or sold without patient authorization.

The Expert Determination method allows an alternative approach: a qualified statistician certifies that the risk of re-identification is "very small." No specific methodology is prescribed. This gives data holders significant flexibility and gives the market its commercial foundation. Electronic health records, insurance claims data, pharmacy transaction records — all of this can be packaged and sold as de-identified data, feeding research pipelines, AI training datasets, and market intelligence products.

Who's Buying and Why It Matters

The customers for de-identified health data are varied and the use cases are genuinely valuable. Drug companies use real-world evidence from de-identified claims data to understand how their products perform outside clinical trial conditions — which patients are prescribed them, what dosing patterns emerge, what side effects appear at scale. Health economists use population-level data to model disease burden and healthcare utilization. AI companies use clinical records to train diagnostic algorithms.

IQVIA — formerly IMS Health — has built a multi-billion dollar business around health data services, including large datasets derived from de-identified patient records. Flatiron Health, acquired by Roche for $1.9 billion in 2018, specifically focused on real-world oncology data. These aren't fringe operations. They are central infrastructure for modern medical research and drug development.

The Re-identification Problem Doesn't Go Away

The Imperial College study wasn't an isolated demonstration. A foundational 2000 paper by Latanya Sweeney showed that 87% of Americans could be uniquely identified by zip code, date of birth, and sex alone — all information that standard de-identification methods might leave intact in some forms. When health data includes rare diagnoses, unusual drug combinations, or highly specific geographic and temporal information, the theoretical re-identification risk becomes practically meaningful.

The de-identified health data market is not responding to this with denial — the more sophisticated players are investing in stronger anonymization methods, including differential privacy approaches that add mathematically calibrated noise to datasets to reduce re-identification risk. But there is a fundamental tension between data utility and privacy protection: the more thoroughly data is anonymized, the less analytically useful it becomes.

Where the Regulatory Lines Are Moving

Several U.S. states have enacted or are considering health data privacy laws that go beyond HIPAA's de-identification framework. California's CMIA, Washington's My Health MY Data Act, and similar legislation in other states are creating a patchwork of obligations that companies in this space must navigate. Internationally, GDPR's treatment of health data is more restrictive than HIPAA's, and the definition of what constitutes identifiable data under European law is more expansive.

The market is real, the use cases are important, and the ethical complexity is not going to resolve itself neatly. That tension, more than any single regulatory development, will define how this industry develops over the next decade.