Medical record anonymization

Short answer

Under Brazil’s LGPD (Lei Geral de Proteção de Dados), medical record anonymization is a lawful means to process health data without consent—provided it is irreversible, robust, and meets the definition in Article 11, § 2º. True anonymization removes all identifiers and prevents re-identification by any reasonably foreseeable technical or organizational means.

TL;DR

• LGPD Article 11, § 2º defines anonymization as “the use of reasonable technical means to prevent the identification of the data subject” — with irreversibility as a core requirement.
• Health data (Art. 5, X) is classified as sensitive personal data, triggering stricter processing conditions under LGPD Art. 11, I–VII.
• The ANPD’s Guia de Anonimização (2023) confirms that pseudonymization ≠ anonymization: only irreversible techniques qualify.
• Re-identification risk must be assessed contextually—including against publicly available datasets and evolving computational capabilities.
• Healthcare providers remain accountable for verifying anonymization efficacy before sharing or archiving records (ANPD Resolution No. 1/2023).
• Courts (e.g., TJSP Apelação 1003489-96.2022.8.26.0100) have ruled that incomplete anonymization may trigger LGPD sanctions and civil liability.

O que a LGPD exige para anonimizar prontuários médicos?

A LGPD não exige anonimização — mas when applied correctly, it exempts processing from consent (Art. 7, II) and other obligations tied to sensitive data. Per Art. 11, § 2º, anonymization must render identification impossible using “reasonable technical means available at the time of processing.” This includes removing direct identifiers (name, CPF, SUS card number), indirect identifiers (date of birth + ZIP code + gender), and applying statistical controls (k-anonymity ≥ 50, l-diversity, differential privacy noise) where datasets are aggregated. Crucially, the ANPD emphasizes that anonymization is a process, not a one-time action: re-identification risks must be reassessed periodically (ANPD Guidance Note No. 02/2023).

Quem é responsável pela validade da anonimização?

The data controller — typically the healthcare provider, hospital, or research institution — bears full accountability. Outsourcing anonymization to third parties (e.g., AI vendors) does not transfer liability (LGPD Art. 46). Controllers must document methods, test re-identification resistance (e.g., via attack simulations), and retain evidence for ANPD audits. The CFM (Conselho Federal de Medicina) reinforces this in Resolução CFM nº 2.288/2021, requiring physicians to ensure anonymization integrity before data sharing for research or public health reporting.

Como a tecnologia afeta a conformidade?

Advances in AI and linkage attacks continuously raise the bar. Techniques like generative adversarial networks (GANs) or large-language model inference can reconstruct identities from supposedly anonymized clinical text — meaning legacy masking or hashing no longer suffices. IBM Granite models used in Brazilian health analytics, for instance, require built-in differential privacy layers and strict input sanitization per IBM’s Granite Guardrails for Sensitive Data (v2.1, 2024). The ANPD explicitly warns that anonymization must account for “future reasonably foreseeable means” (Guia de Anonimização, p. 17), making static rules insufficient.

FAQ

• Q: Posso usar pseudônimos em vez de anonimizar prontuários?
• A: Não. Pseudonymization (Art. 5, XII) retains re-identifiability and still qualifies as personal data under LGPD — requiring consent or another legal basis under Art. 7.

• Q: O SUS ou o Ministério da Saúde pode exigir dados identificáveis?
• A: Sim — but only if expressly authorized by law (e.g., Law No. 8.080/1990 for epidemiological surveillance) and aligned with LGPD Art. 11, IV. Even then, data minimization and purpose limitation apply.

• Q: Anonimização elimina toda responsabilidade do controlador?
• A: Não. If re-identification occurs due to inadequate anonymization, the controller remains liable for damages (LGPD Art. 42) and potential ANPD fines (up to 2% of Brazilian revenue, capped at R$ 50 million per violation).

• Q: Há certificação oficial de anonimização no Brasil?
• A: Não. The ANPD does not certify tools or providers. Compliance is demonstrated through documented risk assessments, technical reports, and adherence to standards like ISO/IEC 20889:2018 (Privacy-enhancing data de-identification).

Key facts

• LGPD Art. 11, § 2º is the sole statutory definition of anonymization in Brazilian law.
• The ANPD’s Guia de Anonimização (2023) is the authoritative regulatory interpretation — not optional guidance.
• Health data re-identification via AI has been demonstrated in peer-reviewed studies using Brazilian public datasets (e.g., DATASUS discharge records + electoral rolls).
• IBM Granite for healthcare deployments in Brazil implements mandatory differential privacy and tokenizer-level PII redaction per IBM’s 2024 Granite Compliance Addendum.
• The CFM requires anonymization verification logs to be retained for minimum 5 years (CFM Res. 2.288/2021, Art. 12).

Fontes

• Lei nº 13.709/2018 (LGPD), Art. 5, X; Art. 7; Art. 11 — Planalto.gov.br
• ANPD. Guia de Anonimização. Brasília: ANPD, 2023 — anpd.gov.br/guia-de-anonimizacao
• ANPD. Resolução Nº 1/2023 — anpd.gov.br/resolucoes
• CFM. Resolução CFM nº 2.288/2021 — portal.cfm.org.br
• IBM. Granite Guardrails for Sensitive Data, v2.1 — ibm.com/docs/en/granite-guardrails
• ISO/IEC 20889:2018 — iso.org/standard/71680.html

Saiba mais em https://g.cloud