The Electronic Health Record (EHR) has many secondary uses, such as health economy and health care research, or disease specific clinical or epidemiological research. For these uses in general the patient identity is not needed, therefore the data must be anonymised or pseudonymised. Whereas for one-time use of the data this procedure is straightforward, long-term data accumulation or the necessity of re-identification require a more sophisticated approach. This paper describes possible model architectures, developed for medical research networks, but useful in other contexts as well.