De-identification vs. anonymization: what nonprofits should ask

De-identification describes work to reduce the connection between information and identifiable people. “Anonymization” is often used to suggest a stronger result, but the word alone does not establish that a nonprofit's records are safe to share. Ask which standard is being used, what was changed, and what evidence supports the result.

For a licensing discussion, the useful question is not which label sounds more reassuring. It is whether the proposed records, recipient, uses, and safeguards have been evaluated together. This guide explains the terms and provides questions for that evaluation, rather than instructions for performing your own technical privacy assessment.

Separate the terms from the claims

Different contracts and legal regimes may define these terms differently. The following is a working vocabulary for discussion, not a substitute for the definitions in an applicable law or agreement.

Ask the provider to explain its terminology using an example relevant to your records. An explanation based only on a tidy spreadsheet may not address free-text reports, email threads, or attachments.

Names are only the beginning

A record can contain clues beyond a name or contact field. Consider the combination of a small town, an unusual job, a precise event date, and a distinctive personal experience. A person familiar with the community may recognize the situation even when an unfamiliar reader would not.

This matters for nonprofits because program narratives often describe context. The context that makes a story useful to a caseworker or evaluator may also make it distinctive. A review needs to consider the narrative rather than simply confirm that one database column was removed.

The HHS HIPAA guidance describes two formal methods, Expert Determination and Safe Harbor, and addresses identifiers in free text. Even those methods retain some risk of identification. Their legal significance is specific to HIPAA; other rules or agreements may still need review.

For the broader organizational process, start with nonprofit data licensing and privacy.

Review what happens before the final dataset exists

Suppose a provider proposes to remove personal information after receiving an export. The eventual output and the original transfer are separate review points. Who receives the originals? Is that access authorized? Where are working copies stored? What happens to material that fails review?

Do not let a promise about the final product answer a different question about the collection process. Ask whether evaluation can begin with a description, an approved inventory, or another appropriately limited approach. Any later access to originals needs its own scope and authority.

The same reasoning applies when staff plan to prepare files internally. Identify the person who approves access, the staff who perform the work, and the person who reviews the result. A preparation folder should not become an uncontrolled second archive.

Ask for an assessment, not a software adjective

NIST SP 800-188 discusses evaluating disclosure risk and notes that tools which mask information do not necessarily provide adequate de-identification. Its government-data focus makes it a technical reference, not a certification for nonprofit licensing.

Use these questions to make a provider's explanation concrete:

1. What kinds of files and languages can the process handle?
2. Does it examine attachments, comments, filenames, and document metadata?
3. How are unusual identifiers and descriptions of rare events addressed?
4. What assumptions are made about information the recipient already has?
5. Who reviews errors and makes decisions the software cannot resolve?
6. What evidence is retained about the assessment and the exact release version?
7. What changes would require a fresh review?

These are discussion prompts, not a pass/fail scoring system. The significance of each answer depends on the collection and the consequences of a mistake.

An original comparison exercise

Imagine a fictional community program with a report describing one participant's employment outcome. Staff create three possible versions for internal discussion. They do not send any version to a buyer in this example.

Version A removes the participant's name but retains the exact employer, interview date, and personal history. Version B groups outcomes across a larger reporting period and removes the individual story. Version C keeps the original report in a restricted environment and permits only a specific approved analysis.

The exercise is not to declare B or C automatically safe. It is to ask what each version reveals, what useful purpose it serves, and who could combine it with other information. It also exposes a commercial question: would the proposed use still work with less detail?

Write one sentence for each version describing what a recipient could learn. If the team cannot do that clearly, it is too early to rely on a reassuring label.

Put obligations beside technical measures

Ask whether the agreement addresses attempts to identify people, combining information with other datasets, onward disclosure, incident handling, and retention. A technical measure and a contractual promise serve different roles; neither should be treated as a substitute for understanding the other.

Ask what the nonprofit can verify. Can it receive a description of the released version and the assessment performed? Will it learn if the scope changes? Who is accountable if an excluded category appears in a transfer?

Use the data licensing agreement checklist to record these points alongside permitted uses and compensation. If you cannot accept the residual risk, discuss exclusion or decline the proposed use rather than assuming a higher payment resolves it.

Questions nonprofit leaders often ask

Can staff make records anonymous by deleting names?

Deleting names can be one preparation step. It is not enough evidence, by itself, to describe a collection as anonymous. Seek a review suited to the file types, context, recipients, and applicable rules.

Does an aggregate report always avoid privacy concerns?

No. Ask whether small groups or unusual combinations reveal information about a particular person. Also check whether the organization has permission for the proposed use of the report itself.

Can we send sample client records to test a tool?

Treat a sample as a disclosure, not an exception to the review process. Discuss an appropriate evaluation method before sharing actual client information. The sensitive-records guide identifies categories that warrant particular care.

What should we bring to an initial conversation?

Bring a high-level description of the collections, the systems involved, and the concerns you already know about. Datifide's initial intake does not require files or passwords. It starts a review; it does not certify de-identification or authorize a later transfer of operational records.