Why the removal check reads only the patient fields
The pairing loop plants synthetic identifiers in an artifact, de-identifies it, and checks that none is left. This page explains which fields that check reads, and why.
synth draws patient names, provider and organization names, addresses, and phone numbers from the
same synthetic pools, and a de-identifier may rightly keep a provider's identity. So the removal check
reads only the values left at the fields that held patient identifiers, not the whole document. A
provider name that the de-identifier keeps, and that happens to match a patient's, is not reported as
a survivor. The check reads the de-identifier's real serialized output, so a de-identifier that finds
a field and fails to clear it is still caught.
Related
- Check a de-identifier with the pairing loop: the steps that run the loop.
- What it does and does not do: coverage across the formats.