How to share a case without names

Removing a name is necessary but not sufficient. A phone number, email, record number, exact address, facility, clinician name, precise date, image label, device identifier, or link can point directly to a person. Indirect details can also combine into a recognizable story: an unusual occupation, a rare event in a small town, exact age, exact admission dates, and a distinctive family history may identify someone even when each detail seems harmless by itself.

The right question is not only “did I remove the obvious fields?” but “could an intended reader connect the remaining story with information reasonably available elsewhere?” United States HHS guidance describes Safe Harbor and Expert Determination as two formal routes under HIPAA, and explicitly notes that residual risk is not literally zero. Other countries and institutions use different legal frameworks. Follow the law, consent rules, and governance requirements that apply to your work; a platform checklist is not legal clearance.

Review the title, narrative, pasted reports, comments, filenames, image pixels, image metadata, and any quoted correspondence. Free text deserves special attention because identifiers may be embedded in a sentence that looks clinical. Headers and footers from laboratory or imaging reports often contain names, dates, accession numbers, barcodes, or facility details. Cropping a visible label may not remove metadata stored inside an image file.

Do not include names of relatives, employers, household members, or staff when they make the patient traceable. Avoid exact appointment, admission, procedure, discharge, and birth dates unless a properly governed method permits them.

• Direct identifiers: names, contact details, addresses, account and record numbers, URLs, and device identifiers.
• Narrative identifiers: exact dates, exact age, rare occupation, named facility, public incident, or distinctive family detail.
• Media identifiers: faces, tattoos, room labels, wristbands, scans with burned-in text, filenames, and embedded metadata.
• Cross-case identifiers: details that become revealing when several posts by the same author are read together.

A useful case needs sequence, not calendar precision. Replace exact dates with relative intervals such as “three weeks after,” “on the second hospital day,” or “over six months.” Use age bands when exact age is not essential, broaden geography, and remove unnecessary occupational or family details.

Do not change a fact in a way that creates false medicine. Shifting every date by an arbitrary amount can distort intervals; swapping sex, anatomy, dose, or laboratory values can change the differential. Prefer suppression, categorization, ranges, and relative time.

Write the educational narrative, then review it again with only privacy in mind. A second person or institutional privacy process may catch details the author overlooks because they already know the patient. Read the case as a local colleague, a family member, and a search engine might read it. Ask whether a phrase copied into a web search could lead back to a news report, fundraising page, conference slide, or social post.

Automated scanners are useful backstops, not proof of removing identifying details. They can flag common patterns but miss context and unusual identifiers. SameCase runs an identifier scan before submission and a server-side scrub, yet contributors remain responsible for excluding identifying material. If identification risk cannot be reduced without losing the case’s meaning, do not submit it.

Use this as a final review aid, not as legal approval. Apply the rules of your country, employer, ethics process, consent policy, and publishing venue. If one unusual combination of details could still identify someone, stop and seek an appropriate privacy review rather than relying on the checklist alone.

A safe edit preserves the reasoning while reducing traceability. For example, replace “a 43-year-old school principal admitted to Northside Hospital on 14 March” with “an adult education worker admitted in early spring” only if age, occupation, facility, and exact date are not clinically necessary. Never alter anatomy, results, treatment, or timing in a way that changes the medical meaning.

• Title and prose: remove names, initials, facilities, exact locations, contact details, record numbers, and distinctive public events.
• Time and demographics: prefer age bands and relative intervals; keep exact values only when essential and permitted.
• Files and images: inspect pixels, labels, barcodes, filenames, DICOM headers, device data, and embedded metadata.
• Combined clues: search key phrases and ask whether occupation, geography, rare diagnosis, and timing identify one person together.
• Governance: confirm consent or institutional approval where required and document who performed the privacy review.
• Final decision: do not publish when removing identifying details would destroy the clinical meaning or residual risk remains unacceptable.

Confirm that the case contains only what is needed to understand the presentation, reasoning, workup, resolution, and learning point. Open every image at full resolution, rename files generically, and remove metadata through an approved workflow. Recheck the title, because a rare diagnosis plus location or occupation can be more revealing than the body. Make sure consent or institutional approval has been handled where required.

After publication, treat privacy reports as urgent. A case that may identify a patient should be hidden while it is reviewed, not left visible while the author debates whether the clue is decisive. De-identification is a continuing responsibility because outside information and re-identification techniques change over time.