Removing names is the easy part of clinical de-identification. A rare occupation, a precise admission date, a small workplace, and an unusual diagnosis may identify someone when combined. Delete too aggressively, however, and the record loses medication doses, laboratory trends, or the sequence of treatment.
The process has to meet two separate tests. It must reduce identifiability for the intended recipient and preserve the clinical meaning required for the declared use.
Detection is not legal de-identification
Vietnam's Law on Personal Data Protection 91/2025/QH15 took effect on 1 January 2026. It defines de-identification as changing or deleting information to create new data that cannot identify or help identify a specific person. Under that definition, data after de-identification is no longer personal data.
That is an outcome standard, not a seven-label checklist. Decree 356/2025/NĐ-CP took effect on the same date, replaced Decree 13/2023/NĐ-CP, and lists health status as sensitive personal data. A hospital still has to consider processing purpose, access controls, storage, recipients, and the sector rules that apply. This article describes technical evaluation, not legal advice.
The distinction matters for Meddies. The current public model card defines Meddies PII as a research extractor for seven entity families: human names, dates, identity numbers, phone numbers, email addresses, addresses, and organisation names. It does not redact or anonymise the source record. It does not certify compliance with Vietnamese law.
A downstream process must decide how to transform detected spans, inspect surfaces the model never saw, and validate the result on local data. The seven families are one component, not a complete de-identification scheme.
Map the ways identity survives
Begin with direct identifiers and their untidy forms. Vietnamese names may appear with or without diacritics. Phone numbers can be split by punctuation. Addresses are abbreviated. Record numbers can sit inside JSON, tables, or OCR output.
Then look for quasi-identifiers. Precise dates, very high age, small locations, employer, family relationships, rare occupations, and unusual events may become identifying when linked with outside data. Their treatment depends on the use. A team might generalise a place, shift dates consistently, retain relative intervals, or keep more detail inside a tighter access boundary.
The record body is only one surface. File names, metadata, document comments, image pixels, and linkage keys can carry identity too. A text extractor cannot inspect all of them.
Finally, describe the recipient. Which outside sources could that person or organisation access? Can they export rows, or only query them in a controlled environment? Residual-risk language has no stable meaning until the likely linkage path and access model are explicit.
Treat clinical utility as its own deliverable
State which facts the downstream task needs before transforming the record. The list may include symptoms, diagnoses, medication, dose, route, allergy, adverse reaction, laboratory result and unit, vital signs, procedures, negation, and event order. Keep no more detail than the declared use requires.
Some useful fields still need modification. A real admission date may be unnecessary when the interval between events is enough. Age may be clinically relevant while an extreme age raises identification risk. Facility type may support analysis when a small hospital's name creates an avoidable link.
After processing, clinical reviewers check whether each deletion, replacement, or generalisation changed the intended meaning. Removing a dose is not merely a false positive in an entity-recognition report. It can invalidate the downstream task.
Maintain two error registers. The privacy side reports recall by identifier class, exact-span errors, copied versus invented values, and failures on abbreviations, OCR noise, or mixed Vietnamese and English. The utility side measures whether medication, dose, result, negation, timeline, and event relationships remain correct. Slice both by document type and challenge group. A strong average can hide the cases most likely to expose a patient or damage a clinical fact.
Validate in Vietnamese hospital conditions
A 2025 npj Health Systems study defined Korean-specific categories and preprocessing for discharge summaries mixing Korean, English, and special characters. A 2026 systematic review found that most clinical de-identification research still focuses on English and identified code-mixing and reproducibility as gaps.
Those studies do not predict performance in Vietnam. They show why a result from another language or benchmark cannot replace testing on the target hospital's abbreviations, forms, OCR errors, record exports, and mixed-language notes.
Identifier scoring is not the final privacy test. The evaluation should also attempt linkage under the expected recipient and access conditions, then document controls around the data. Query-only access, audit logs, contractual limits, export restrictions, and retention periods do not repair a missed identifier, but they change the opportunity to exploit one.
Claims the evidence cannot support
Do not promise permanent anonymity. Identifiability changes as public data grows, recipients change, and access expands. Even the US HHS guidance for HIPAA de-identification says its recognised methods retain a very small, non-zero identification risk. That is a US methodological example, not a Vietnamese legal standard.
Do not equate de-identification with complete legal compliance. Legal basis, purpose, data-subject rights, transfers, access controls, and the responsibilities of each party remain separate questions.
Do not promise zero utility loss either. Privacy protection and detail can conflict. The defensible claim is narrower: document each transformation, test residual identification risk, measure which clinical facts changed, and restrict access to what the use case needs.
Reliable identifier extraction helps. Calling the result de-identified requires more evidence. The hospital must show that the remaining data cannot identify or help identify a person in the selected use context, while the clinical information required for that use still works.