Anonymising Outpatient Clinic Letters for Peer Review – UK GDPR-compliant anonymisation per UK GDPR Art. 9

An outpatient clinic letter is a clinical communication constituting special-category health data under UK GDPR Article 9(2)(h), transmitting diagnostic findings, treatment plans, and medication adjustments between hospital specialists and GPs. The NHS Records Management Code of Practice 2023 requires outpatient records to be retained for 8 years. anonym.legal pseudonymises patient and clinician identifiers while preserving clinical correspondence for peer review or governance.

When this applies

This task applies when outpatient clinic letters are reviewed by clinical governance teams, complaint investigators, or external peer reviewers who require the clinical content of the correspondence but have no legitimate need to identify the individual patient or responsible clinician. The Care Quality Commission, which oversees over 41,000 registered providers in England, inspects outpatient correspondence governance as part of clinical record reviews under Regulation 12 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014.

  1. Upload clinic letters individually or as a batch (PDF or DOCX).
  2. The engine identifies patient name, date of birth, NHS number, consultant name, and any family members or carers named in the letter.
  3. Each named individual is pseudonymised consistently; clinical findings, investigation results, treatment plans, and follow-up instructions remain in clear text.
  4. Referral dates, follow-up intervals, and clinic identifiers are preserved.
  5. A mapping table is produced with UK data residency.
  6. The pseudonymised letters are released for peer review; originals are retained in the patient record for the full 8-year period.

What you provide

  • Outpatient clinic letters (PDF or DOCX)
  • Any attached investigation results or imaging reports naming the patient

Limitations & cautions

  • The tool does not assess clinical appropriateness of the treatment plan described in the letter — obtain peer clinical review separately. Data breaches involving clinic letters can attract fines of up to £17.5 million or 4% of annual global turnover under DPA 2018 s.157.
  • Letters describing highly specific clinical presentations may retain re-identification risk; apply additional review for rare-condition correspondence.

FAQ

Can I pseudonymise clinic letters for use in a clinical governance case review without a patient consent form?

Processing under UK GDPR Art. 9(2)(h) (health care management) and the DPA 2018 Schedule 1 Part 1 health condition may provide a lawful basis for internal governance review. Confirm the lawful basis with your Data Protection Officer before proceeding. The 8 Caldicott Principles (updated 2013, Principle 8 added 2020) require that every disclosure of patient information is justified and proportionate.

Are letters co-signed by a registrar and a consultant both pseudonymised?

Yes. All named clinicians in the signature block — regardless of seniority — are pseudonymised with distinct pseudonyms. According to the ICO's subject access guidance, healthcare professionals' names in their professional capacity may not require redaction in Subject Access Requests, but may be pseudonymised for peer-review purposes.

Does the engine handle clinic letters with embedded investigation tables?

Yes. Tabular investigation results are processed; patient identifiers in table headers or footers are detected and pseudonymised, while numerical results in table cells are preserved. The NHS Records Management Code of Practice 2023 requires that adult health records — including outpatient letters — are retained for 8 years from the end of treatment.

Healthcare Records

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our company HQ is in Saarbrücken, Germany. Our servers run in Hetzner's Falkenstein datacenter.

Hetzner holds ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.