ISO 25237:2017

Overview

ISO 25237:2017 - Health informatics - Pseudonymization provides principles, requirements and guidance for protecting personal health information through pseudonymization. It is intended for organizations that perform pseudonymization themselves and for providers that claim trustworthiness as pseudonymization services. The standard defines core concepts and a practical methodology to reduce identifiability while supporting controlled re-identification when necessary.

Key topics and technical requirements

• Conceptual definition (Clause 5): establishes the standard concept of pseudonymization and distinguishes it from anonymization and de-identification.
• Methodology (Clause 6): prescribes a combined organizational and technical approach to implement pseudonymization services, addressing direct and indirect identifiers, structured and unstructured data, and inference risks.
• Controlled re-identification (Clause 7): specifies a policy framework and minimal requirements for when and how re-identification may be performed under controlled conditions.
• Risk assessment guidance (Annex B): outlines procedures to assess re-identification risk and residual identifiability.
• Use cases and implementations (Annex A, C): provides illustrative pseudonymization scenarios, examples of de-identification systems, and reversible/irreversible use cases.
• Interoperability (Annex D): informative requirements to support consistent integration of pseudonymization services across systems.
• Trustworthy operations (Annex E): policy framework and minimum requirements to ensure reliable, auditable pseudonymization services.
• Normative reference: aligns with ISO 27799 (information security management in health), reinforcing the link between pseudonymization and broader health IT security controls.

Practical applications and who should use it

ISO 25237:2017 applies to:

• Healthcare providers and health IT vendors implementing patient data sharing and identity protection
• Research organizations and clinical trial sponsors preparing datasets for secondary use
• Public health agencies and registries needing privacy-preserving surveillance and reporting
• Pharmacovigilance, patient-safety reporting, quality assessment, and peer review programs
• Trusted third‑party pseudonymization service providers and auditors

Typical applications include pseudonymous care, research datasets, de-identified data exchange, patient identifier management, public health monitoring, and confidential incident reporting.

Related standards

• ISO 27799 - Health informatics: information security management in health (normative reference in ISO 25237)
• Relevant ISO/IEC privacy and information-security standards for context and alignment

ISO 25237:2017 is a practical, implementation-focused standard for organizations that must balance data utility and patient privacy through robust pseudonymization and controlled re-identification practices. Keywords: ISO 25237:2017, pseudonymization, health informatics, data privacy, de-identification, re-identification, pseudonymization services, privacy risk assessment.