Surgical video de-identification: a preparation checklist

Where can identifying information appear?

Start by mapping every component of the proposed release. A recording can include a patient banner before the operative view begins, a spoken name in audio, or identifying information in a folder structure. A clean-looking frame does not describe the entire file.

Include derivative files in the inventory. Thumbnails, annotation exports, transcripts, and sample notebooks can reproduce information removed from the main video. Review the package that the recipient will actually receive.

What does HIPAA de-identification involve?

HHS describes two HIPAA methods: Expert Determination and Safe Harbor. Expert Determination involves a qualified expert assessing identification risk; Safe Harbor requires specified identifier removal and no actual knowledge that the remaining information could identify an individual. HHS also explains that de-identification does not reduce risk to zero. See HHS: de-identification guidance.

The correct approach depends on the material, the recipient, and the surrounding circumstances. Do not treat an automated redaction tool’s output as a legal conclusion. This guide is a planning aid, not a determination that a particular dataset satisfies HIPAA or another privacy law.

For projects spanning countries, ask the appropriate advisers to identify applicable privacy rules, organizational roles, permissions, and transfer conditions. A U.S. de-identification assessment should not be assumed to resolve every requirement elsewhere.

How can a team make the review reproducible?

Record the source version, transformation steps, tool versions, reviewer decisions, and final release identifier. Keep originals under the appropriate access controls and prevent accidental substitution of a raw file into a prepared release. Use a manifest to reconcile exactly what is included.

• Define the scope and applicable review standard before processing.
• Specify how automated detection and human review will be combined.
• Test the process on representative footage, including transitions and difficult cases.
• Document exceptions and unresolved findings instead of silently excluding them.
• Require an explicit release decision from the designated authority.

A quality review should cover both privacy and research utility. An edit may successfully obscure information while removing the feature a research team needs. Resolve that tension during scoping rather than trying to reverse an approved release later.

What happens after the footage is prepared?

Preparation does not remove the need for sensible delivery and access arrangements. Agree on approved recipients, secure transfer, permitted uses, retention, incident handling, and whether any onward sharing is allowed. Record which version each recipient receives.

Keep a correction process available. If a previously missed identifier is discovered, the team needs a way to identify affected files, notify the appropriate parties, and implement the required response. That process should be part of the project plan, with an owner and escalation route.

What should a provider share in an initial inquiry?

Aggregate information is usually enough to start: the broad procedure categories, approximate archive size, recording format, geography, and the role of the person making the inquiry. You can describe uncertainty about rights or privacy without sharing the underlying patient material.

Operavue’s public forms accept business inquiries only. They do not accept footage uploads and should not contain patient names, identifiers, records, or confidential case descriptions. Any proposed data transfer is a separate process with its own review and agreements.