# Pseudonymization vs. anonymization under HIPAA, GDPR, LGPD and Colombia's Law 1581

What each framework says about de-identified, pseudonymized and anonymized health data, and what that means for sending clinical text to AI models.

Published 2026-09-22 by NETBRAND CORP · https://netbrandcorp.com/blog/pseudonymization-vs-anonymization-hipaa-gdpr-lgpd/

> **In short:** tokenized data that can be reversed is pseudonymized, and every major framework still treats it as regulated personal or health data. Anonymization, where it exists as a legal concept, requires that re-identification is not reasonably possible. HIPAA uses its own term, de-identification, with two defined methods.

## HIPAA (United States)

HIPAA's Privacy Rule defines two ways to de-identify protected health information (45 CFR 164.514):

- **Safe Harbor:** remove 18 types of identifiers of the individual and of relatives, employers and household members. They include names, geographic subdivisions smaller than a state (the first three ZIP digits may stay for areas over 20,000 people), all elements of dates except the year, phone and fax numbers, email addresses, SSNs, medical record numbers, health plan beneficiary numbers, account numbers, license numbers, device and vehicle identifiers, URLs, IP addresses, biometrics, full-face photos and any other unique identifying number. Ages over 89 must be aggregated as 90 or older.
- **Expert Determination:** a qualified expert documents that the risk of re-identification is very small, given the data and its recipients.

Two practical consequences. Date shifting preserves clinical intervals but is not Safe Harbor on its own, because full dates are identifiers; it typically sits under Expert Determination. And tokenized text with a reversal key is still PHI while the key exists, so sending it to a cloud model needs a business associate agreement.

## GDPR (European Union)

GDPR defines **pseudonymisation** (Article 4(5)) as processing so that data can no longer be attributed to a person without additional information kept separately. Recital 26 is explicit: pseudonymised data is still personal data. Only information that is truly anonymous falls outside the regulation. Health data is a special category under Article 9.

## LGPD (Brazil)

Brazil's Lei 13.709/2018 defines anonymized data (Article 5) and states in Article 12 that anonymized data is not personal data, **unless the anonymization can be reversed** with reasonable effort. Pseudonymization is defined in Article 13 in the context of public health research, and health data is sensitive personal data. The Brazilian authority, ANPD, oversees enforcement.

## Colombia: Law 1581 of 2012 and Resolution 1995 of 1999

Law 1581 of 2012 classifies health data as sensitive data (Article 5) and restricts its processing to specific grounds, such as explicit authorization (Article 6). Resolution 1995 of 1999 sets the rules for clinical records and treats them as confidential documents. There is no separate statutory safe harbor, so the test is practical: can a person be identified from what you share?

## What this means for AI projects

1. Treat tokenized text as regulated data and cover it with contracts: BAA in the U.S., data processing agreements elsewhere, zero retention where available.
2. If the goal is to take a dataset out of scope, you need anonymization plus a measured re-identification risk, not just redaction.
3. Document your control with numbers: detection recall per entity type on your own documents. See [How to run a de-identification POC: 100 to 200 real documents and recall per entity](https://netbrandcorp.com/blog/de-identification-poc-measure-recall/).

[Velo](https://netbrandcorp.com/) is designed to support compliance with these frameworks: it keeps detection and the vault on-premise, lets you choose a policy per entity, and logs every detection and re-hydration. [Request a POC](https://netbrandcorp.com/#poc).

*This article is general information, not legal advice. Confirm your specific case with counsel.*