How to De-Identify Health Data

In the US if you're following the letter of the law all you need to do is remove all the attributes that they list in this safe harbor provision of HIPAA and then the data is considered de-identified. So depending on the data type there's a bunch of different techniques you can use to do that but that's essentially the name of the game. And what really matters is where the data was collected not the data so even though you're in the USif you're using data through some partnership with American Institute in Canada you'd have to follow the Canadian rules.