Skip to main content
De-identification assists with HIPAA compliance but does not guarantee it. Always review output and consult your compliance team before using de-identified data in non-secure environments.

​
Prerequisites

  • Pidgeon CLI installed (dotnet tool install --global Pidgeon.CLI --version 0.1.0-beta.1)
  • A directory of real HL7 messages to de-identify

​
Basic de-identification

Process an entire directory of messages:
This:
  1. Reads every message file in ./real-messages
  2. Replaces patient names, MRNs, SSNs, addresses, and phone numbers
  3. Shifts all dates forward by 30 days (preserving relative intervals)
  4. Writes clean messages to ./safe-messages

​
Date shifting

Date shifting moves all dates by a fixed offset while preserving the temporal relationships between events:
Date shifting preserves the time between events. If a lab was ordered 2 hours before results arrived, that interval stays the same after shifting.

​
Consistent hashing

For scenarios where you need the same input to produce the same output (e.g., matching patients across de-identified files), use a salt:
The same patient name with the same salt always produces the same replacement name, so you can correlate records across files.

​
Preserve identifiers

If you need to keep certain identifiers intact (e.g., for matching across systems):
Using --keep-ids preserves MRNs and account numbers. Only use this when de-identified data stays in secure environments.

​
What gets de-identified

​
Workflow: real messages to test data

1

Collect real messages

Export messages from your integration engine (Mirth, Rhapsody, etc.) into a directory.
2

De-identify

3

Validate de-identified output

4

Use in testing

The de-identified messages retain the same structure, segment ordering, and field patterns as the originals — ideal for integration testing.

​
Next steps