De-identification is the removal of identifying information from data. Several US laws, regulations and policies specify that data should be de-identified prior to sharing as a control to protect the privacy of the data subjects. In recent years researchers have shown that some de-identified data can sometimes be re-identified. This document summarizes roughly two decades of de-identification research, discusses current practices, and presents opportunities for future research.