Pseudonymisation of Patient Data - hmislk/hmis GitHub Wiki
Pseudonymisation replaces a patient's identifying information โ name, NIC, address, contact details โ with non-identifying placeholder values, while keeping the clinical record intact. The patient's PHN (Personal Health Number) and all linked bills, investigation results, and clinical notes remain fully accessible and queryable; only the demographic identifiers are obscured.
This is different from anonymisation:
| Concept | What it does | Can you find the record later? |
|---|---|---|
| Anonymisation | Permanently destroys all links between data and the individual | No โ the data is no longer traceable |
| Pseudonymisation | Replaces identifiers with a placeholder โ the PHN remains the key | Yes โ the record is still fully usable via PHN |
CareCode HMIS does not support anonymous patient registration. Registering a patient with no real identity makes their clinical results (lab reports, prescriptions, imaging) unreachable in practice โ you cannot hand results to a patient you cannot identify. Pseudonymisation is the correct approach when a customer (hospital) needs to extract a cross-section of data for research, audit, or reporting, while complying with privacy obligations.
Pseudonymisation is used when:
- A hospital needs to share a dataset with a third party (researcher, regulator, insurer) without disclosing patient identities.
- An internal audit needs aggregate statistics without patient-level identification.
- A patient requests that their identifying details be removed from visible records while their clinical history is retained.
It is not a substitute for proper patient registration. Every patient must be registered with real demographic data at the point of care.
When a record is pseudonymised, the following fields are overwritten with placeholders:
| Field | Replacement value |
|---|---|
| Name | Patient <PHN> |
| Full Name | Patient <PHN> |
| Name with Initials | Patient <PHN> |
| NIC / Passport |
<PHN>V (placeholder, derived from PHN) |
| Address | Address <PHN> |
| Phone Number | 10-digit placeholder derived from PHN |
| Mobile Number | same as phone placeholder |
| blank |
The following fields are not changed:
- PHN (Personal Health Number) โ remains the permanent record key
- Date of birth / Age
- Sex
- All bills, investigation results, prescriptions, admissions, and clinical notes
- Search for the patient and open their Edit Patient page. Main Menu โ OPD โ Patient Lookup & Registration โ (search) โ Edit
- Click the Pseudonymise button (visible only to users with the Clinical Patient Pseudonymise privilege).
- Read the warning dialog carefully. Confirm that you have the required authorisation.
- Click Yes, Pseudonymise to proceed.
The system will immediately replace the identifying fields with placeholders, save the record, and display a success message. The action is logged in the audit trail.
Pseudonymisation in CareCode HMIS is one-way. The original demographic data is not stored anywhere after the operation completes. If the real identity needs to be restored later, it must be re-entered manually by an authorised user on the Edit Patient page.
| Action | Privilege needed |
|---|---|
| Pseudonymise a patient record | ClinicalPatientPseudonymise |
| View the Pseudonymise button | ClinicalPatientPseudonymise |
| Edit the pseudonymised record afterwards |
LabEditPatient (standard edit privilege) |
To grant the privilege, a super user must go to:
Administration โ Manage Users โ User Roles โ (select role) โ Clinicals โ Pseudonymise Patient
Every pseudonymisation is logged. To view the history:
Main Menu โ Administration โ Audit Events
Look for events named "Pseudonymise Patient". Each entry shows the user who performed the action and the timestamp.
Note: Pseudonymisation is an irreversible action. The original identifying data cannot be recovered from the system after it is applied. Ensure you have explicit authorisation before proceeding.