Medical Record Anonymization Under Brazil's LGPD: Compliance Essentials and AI Training Data Compliance

Why Medical Data Anonymization Has Become a Key Legal Issue for AI Training in Brazil

Medical records contain large amounts of sensitive personal information, making them one of the most valuable and most sensitive data types for AI model training. In Brazil, with the implementation of the General Data Protection Law (LGPD, Lei nº 13.709/2018), healthcare institutions and AI developers face a core question: can anonymized medical records still be considered "personal data"?

Under Article 11 of the LGPD, as long as the anonymization process meets the "irreversibility" requirement, anonymized data is excluded from the scope of the LGPD. This means that compliant anonymization not only resolves privacy compliance issues, but also opens the door to lawful use of AI training data.

The LGPD's Technical Threshold for Anonymization: More Than Just Deleting Names

The Dual Requirement for Direct and Indirect Identifiers

The LGPD does not provide a technical definition of "anonymization," but Article 11 explicitly requires that the anonymization process must be irreversible. This gives rise to two cumulative conditions—eliminating all direct identifiers (name, CPF, SUS card number) and indirect identifiers (date of birth, postal code, combinations of specific diagnoses and gender), while ensuring that re-identification cannot be achieved through reasonable means.

In practice, merely replacing names with pseudonyms is far from sufficient. A compliant process requires validated methodologies such as generalization, suppression, or differential perturbation, along with complete technical documentation. International standards such as ISO/IEC 20889 and NIST SP 800-188 provide reference technical frameworks for this purpose.

Differential privacy and k-anonymity are two foundational concepts for understanding the technical threshold of anonymization. K-anonymity requires that each record in a dataset be indistinguishable from at least k-1 other records on quasi-identifiers, thereby reducing the risk of re-identification through attribute combinations, but it offers limited protection against background knowledge attacks (such as an attacker already knowing that someone lives in a certain postal code area). Differential privacy, by contrast, injects controlled noise into statistical results or data, mathematically guaranteeing that the addition or removal of any single record has a negligible effect on the output, usually measured by a privacy budget ε; the smaller the ε, the stronger the privacy protection but the lower the data utility. In medical AI training scenarios, differential privacy is especially suitable for publishing aggregate statistics or training gradients, while k-anonymity, generalization, and suppression are better suited for de-identifying structured medical records. ISO/IEC 20889 is precisely the international standards framework that systematically organizes these privacy-enhancing technologies.

Reversibility Risk: The Trap of Unsalted Hashing

If anonymization is incomplete—for example, using only unsalted hashing—the information is still considered "personal data" under the LGPD. In that case, all obligations apply again: a legal basis for processing (consent, legitimate interest, or contract performance), a privacy impact assessment (Article 38), and joint liability between the controller and the operator (Article 42).

Successful re-identification cases have been found by IBGE and TCU in public health databases, further reinforcing the need for ex ante technical assessment.

Unsalted hashing refers to directly applying a hash function such as SHA-256 to an identifier (such as a CPF or medical record number) without attaching a random string. Because identifier spaces such as CPF are limited and fixed in format, attackers can precompute the hashes of all possible values through rainbow tables or brute-force enumeration, thereby mapping hash values back to the original identifiers. Salting (concatenating a random and secret salt value before hashing) or using a keyed hash (HMAC) can significantly increase the difficulty of re-identification, but even then, if the salt is leaked or the same identifier uses the same salt across multiple datasets, linkage can still be achieved through cross-matching. Therefore, hashing is generally not regarded as a sufficient means of satisfying the LGPD's irreversible anonymization requirement, especially when identifier entropy is low. A more robust approach is to combine generalization, suppression, or differential privacy, and to conduct negative re-identification testing across the entire process.

Who Is Responsible for Anonymization Quality? The Controller's Inescapable Obligations

Objective Liability and Audit Requirements

Under Article 42 of the LGPD, the controller (such as a hospital, health insurer, or research institution) bears objective liability for the effectiveness of the anonymization process. The controller must maintain records of processing activities (Article 37), conduct regular risk assessments (Article 38), and adopt up-to-date technical measures.

You may not have noticed that outsourcing anonymization work to a third-party vendor does not transfer liability. The controller must audit and verify the methods used, especially when generative AI or language models are involved in extracting information from unstructured data.

Supplementary Regulation by CFM and ANS

In addition to the LGPD, Brazil's Federal Council of Medicine (CFM) Resolution No. 2.217/2018 requires that clinical data in scientific publications undergo "complete and irreversible" anonymization. The National Supplementary Health Agency (ANS) Normative Resolution No. 480/2021 requires that databases used for research retain records of the anonymization process.

The Brazilian Federal Council of Medicine (CFM) is the federal body responsible for regulating medical practice and ethics. Its Resolution No. 2.217/2018 is in fact part of the Code of Medical Ethics, which explicitly provides that in scientific publications, case reports, and research, clinical data must undergo "complete and irreversible" anonymization to protect patient identity. The National Supplementary Health Agency (ANS) regulates private health insurance plans, and its Normative Resolution No. 480/2021 requires that databases used for research retain detailed records of the anonymization process for auditing and traceability. These two sets of rules complement the LGPD: the LGPD provides a general personal data protection framework, the CFM imposes stricter de-identification requirements from the perspective of medical ethics, and the ANS regulates data governance from the perspective of health insurance operations. Violating these supplementary rules may trigger administrative, ethical, and professional liability at the same time. Therefore, when AI developers use medical records to train models, they must satisfy all three sets of requirements simultaneously.

Compliance Pathways for Using Anonymized Medical Records for AI Training

Technical Standards Are the Core Compliance Evidence

The ANPD issued technical guidance on anonymization in its 2023 "Guide on the Processing of Data in Scientific Research," aligned with ISO standards. Although the LGPD does not require formal certification, it does require objective technical evidence—including processing records, audit reports, and negative re-identification tests—to demonstrate compliance to the ANPD.

For organizations wishing to use anonymized medical records to train AI models, the key premise is: anonymization must conform to current technical standards, its irreversibility must be documented, and the supplementary rules of the CFM and ANS on biomedical research must be observed.

Legal Consequences of Accidental Linkage

If anonymized medical records are accidentally linked to a data subject, their anonymized status will be revoked, and all LGPD obligations will immediately be activated, including incident notification (Article 48) and potential administrative sanctions. This means organizations need to establish continuous monitoring mechanisms rather than treating anonymization as a one-time, set-and-forget task.

Frequently Asked Questions

Does anonymized medical record use require patient consent? If anonymization is effective and irreversible, then no. However, processing activities before anonymization still require a legal basis unless another lawful basis applies (such as legal compliance or the public interest in public health).

Does a data breach of anonymized data require notification? Article 46 of the LGPD explicitly excludes anonymized data from security incident notification obligations. This is a significant compliance advantage brought by anonymization.

Does the LGPD require anonymization certification? No formal certification is required, but technical evidence must be provided to demonstrate compliance.

Key Facts

• The LGPD defines anonymization as an irreversible process (Article 5, XII and Article 11, I)
• Article 46 explicitly excludes anonymized data from security incident notification obligations
• CFM Resolution No. 2.217/2018 requires "complete and irreversible" anonymization for scientific publications
• The ANPD's 2023 guide aligns with ISO standards

Sources

• Lei nº 13.709/2018 (LGPD), art. 5º, XII; art. 11, I; art. 46 — Planalto.gov.br
• Resolução CFM nº 2.217/2018 — CFM.org.br
• Guia ANPD: Tratamento de Dados em Pesquisa Científica (2023) — ANPD.gov.br
• Resolução Normativa ANS nº 480/2021 — ANS.gov.br
• ISO/IEC 20889:2018 — Privacy enhancing techniques

This article was compiled and adapted from the original analysis published on the g.cloud blog.