Consent, data governance, and de-identification

"They told me the dataset was anonymized. I recognized three people by their heartbeats before lunch."

A Well-Read AI Agent

This section assumes the regulatory framing of Section 34.1 and treats the re-identification threat of Section 34.4 as a given adversary rather than re-deriving it. It also builds directly on the leakage-safe dataset discipline of Chapter 5, because subject-level provenance is the same bookkeeping that both prevents evaluation leakage and enforces consent scope, and it points forward to the cryptographic and federated protections of Chapter 64 for when de-identification alone is not enough.

Consent that survives contact with machine learning

What consent has to cover. Under the HIPAA Privacy Rule in the United States and the GDPR in the European Union, consent (or another lawful basis) governs collection, and, critically, secondary use: training a model is almost never the purpose a patient signed a clinic form for. The historical model is specific consent, where a person agrees to one study with a defined question. That model collides with ML, where the value of a biosignal corpus is precisely that it can answer questions nobody had asked yet. Two mechanisms bridge the gap. Broad consent asks the participant to permit a described range of future research under governance oversight; it is what most large biobanks run on. Dynamic consent keeps a live channel to the participant (typically an app) so permissions can be granted, narrowed, or withdrawn per use over time. Dynamic consent matches wearables well, since the device already has the user's attention and a natural place to surface a toggle.

Why withdrawal is the hard part. GDPR grants a right to withdraw and a right to erasure, and consent that cannot be withdrawn is not really consent. For a static file this is a delete. For a deployed model it is thorny: the person's data has already shaped the weights. In practice teams satisfy withdrawal by removing the subject from all training pools and datasets and retraining on the next scheduled cycle, which is exactly why the per-subject lineage below is not optional bookkeeping but a compliance primitive. Machine unlearning, which tries to excise one subject's influence from an existing model without full retraining, is an active research area we return to in Chapter 70, but retrain-on-cycle remains the defensible default.

Governance: provenance, purpose limitation, and the minimum footprint

What governance actually is. Data governance is the operational answer to four questions asked continuously across a dataset's life: where did each record come from, what is it allowed to be used for, who may access it, and can you prove all three after the fact. Three principles do most of the work. Purpose limitation means data collected under one consent scope cannot silently be repurposed for another; a heart-rate corpus gathered for arrhythmia research is not automatically fair game for a stress-detection product. Data minimization means you collect and retain the least that serves the purpose, because the cheapest way to avoid leaking a field is to never store it. Least-privilege access means raw waveforms and the identity linkage table live behind separate, individually audited doors, so that the people training models see de-identified signals and the re-linking key sits with a small governed group under a data use agreement.

Why lineage ties it all together. Every one of these principles reduces to a join key: a stable, pseudonymous subject id that follows a person's data everywhere and never equals their name. With it, withdrawal is a filter, purpose limitation is a policy check on that id, and leakage-safe splitting (no subject in both train and test) is the same query. Without it, you cannot honor a withdrawal request or prove a purpose boundary, and you have no governance at all, only good intentions. The function below shows the de-identification and consent-scoping step for the tabular metadata that accompanies a biosignal, which is the part where classical techniques genuinely help.

import hashlib
from datetime import timedelta

def deidentify_record(rec, salt, consented_purposes, requested_purpose,
                      k_anon_zip3_counts):
    """De-identify one biosignal metadata record and enforce consent scope.
    Returns a release-safe dict, or None if use is not permitted."""
    # 1. Purpose limitation: refuse data outside its consent scope.
    if requested_purpose not in consented_purposes:
        return None
    # 2. Pseudonymous subject id: keyed hash, NOT reversible without the salt.
    subject_id = hashlib.sha256((salt + rec["mrn"]).encode()).hexdigest()[:16]
    # 3. HIPAA Safe Harbor style generalization of quasi-identifiers.
    zip3 = rec["zip"][:3] if k_anon_zip3_counts[rec["zip"][:3]] >= 5 else "000"
    age = min(rec["age"], 89)                      # cap ages 90+ into one bin
    # 4. Consistent per-subject date shift preserves intervals, hides real dates.
    shift = int(hashlib.sha256((salt + rec["mrn"] + "d").encode())
                .hexdigest(), 16) % 365
    visit = rec["visit_date"] - timedelta(days=shift)
    return {"subject_id": subject_id, "zip3": zip3, "age_capped": age,
            "visit_shifted": visit.isoformat(), "signal_ref": rec["signal_ref"]}

Read that code beside the key insight: it does careful, standard work on the metadata and deliberately leaves signal_ref pointing at the raw waveform, because the same tricks do not de-identify the waveform itself. A three-digit ZIP protects a location; nothing analogous shrinks an ECG's identifying power without also destroying the diagnostic content you collected it for. That is the boundary where classical de-identification stops and the cryptographic methods of Chapter 64 take over.

from presidio_analyzer import AnalyzerEngine
from presidio_anonymizer import AnonymizerEngine

analyzer = AnalyzerEngine()
results = analyzer.analyze(text=note, language="en")           # find PHI spans
clean = AnonymizerEngine().anonymize(text=note, analyzer_results=results)

When de-identification is not enough

What to reach for. When the residual risk from raw waveforms is too high for open release, you stop moving the data and start moving the computation. Differential privacy adds calibrated noise so that any single subject's presence or absence changes the released model or statistic by a bounded amount, giving the formal guarantee \(\Pr[\mathcal{M}(D)\in S]\le e^{\varepsilon}\,\Pr[\mathcal{M}(D')\in S]\) for datasets differing in one person; the privacy budget \(\varepsilon\) is the risk knob made mathematical. Federated learning keeps raw signals on the device or in the hospital and shares only model updates, so the corpus is never centralized at all. These are the subject of Chapter 64; the point here is governance, deciding when a signal's irreducible identifiability pushes you off the de-identify-and-release path and onto the keep-the-data-still path. That decision, documented, is itself a governance artifact of the kind catalogued in Section 34.7.

What's Next

In Section 34.6, we turn from who is protected to who is served: fairness and equity in health sensing, where the same subject-level lineage that enforces consent also lets you measure whether a model works as well across skin tones, ages, and body types, and why a privacy-preserving pipeline that quietly under-serves a subgroup has solved one problem by creating another.