Healthcare generates a constant stream of documents that must be shared but must not carry identity: a chart sent for a second opinion, records supporting a claim, case material for research or teaching, a referral letter.

Getting this wrong is both a privacy failure and a regulatory one. Here's what has to come out, why the format matters more than people expect, and — since this is a compliance-adjacent topic — a clear statement of what a tool like ours does and does not give you.

What counts as an identifier

HIPAA's Safe Harbor method for de-identification lists 18 identifiers that must be removed for data to no longer count as protected health information. Names are the obvious one. The less obvious ones cause the trouble:

Names of patients, relatives, employers and household members
Geographic detail smaller than a state — including ZIP codes in most cases
All date elements tied to an individual — admission, discharge, birth, death — beyond the year, and any age over 89
Phone, fax, email, URLs and IP addresses
Social Security numbers
Medical record numbers, health plan beneficiary numbers, account numbers
Certificate and licence numbers, device identifiers and serial numbers
Vehicle identifiers, biometric identifiers, and full-face photographs

Two of these are routinely missed. Dates are everywhere in a chart and rarely feel like identifiers. And record numbers appear in headers and footers on every page, where the eye stops seeing them by page three.

Safe Harbor isn't the only route — expert determination is the alternative, and it's the appropriate one when you need to retain dates or geography for the data to be useful.

Why healthcare documents are the hard case

They're overwhelmingly scanned. Faxes are still routine. Charts get printed, annotated, and re-scanned. Records arrive as photographs. A scanned page has no text to remove — only pixels — so any tool that searches for text finds nothing to do, and some will report success on a document it couldn't read at all.

Fax quality is genuinely bad. Heavy compression, low resolution, skew. That directly reduces OCR accuracy, and reduced OCR accuracy on a scan means an identifier that is never located and therefore never removed — silently.

Handwriting is everywhere. Clinician notes, signatures, annotated margins. No OCR reads cursive reliably, so handwritten identifiers will not be detected automatically. On annotated charts this is the largest single gap, and it needs a human.

Headers repeat. The patient name and MRN sit on every page. A per-page check matters more here than in most document types.

A workflow

1. Work from a copy. Redaction is permanent by design.

2. List identifiers before you start. Patient name and known variants (maiden name, misspellings that appear in the record), relatives' names, MRN, account and claim numbers, provider names where required. Enter these as explicit terms — pattern-matching cannot reliably distinguish a person's name from any other capitalised words, and guessing produces documents blacked out into uselessness.

3. Add structured detection for Social Security numbers, phone numbers and email addresses — the high-volume items a reviewer skims past.

4. Handle dates deliberately. Decide up front whether you're removing them. Under Safe Harbor most date elements go; under expert determination they may stay. Don't leave this to the tool.

5. Verify every page. Especially headers, footers and any handwriting.

6. Confirm the images. A page can have a typed body and a scanned insert; a tool that treats the page as text-only will redact the text layer perfectly and never look at the image, leaving the MRN inside it fully legible.

Verification checklist

Copy-paste the document into a text editor — no identifiers appear
Zoom into redacted areas on scanned pages — nothing legible through the black
Headers and footers checked on every page, not just the first
Handwritten content reviewed by a person
Dates handled according to your chosen de-identification method
Document metadata stripped — properties often carry a name
Embedded images checked on pages that also contain text

What we do and don't offer — plainly

This matters more than marketing copy on a healthcare page, so:

What the tool does. Removes text objects from the PDF content stream on digital pages; OCR-reads scanned pages and destroys the matching pixels, discarding the original image; strips document metadata; processes your file in memory and discards it within seconds. Nothing is retained, logged, or used for training.

What it does not do. We do not currently offer a Business Associate Agreement. Using this tool does not by itself make a workflow HIPAA-compliant, and no software can make that claim on your behalf. It does not detect handwriting, and OCR accuracy falls on badly degraded faxes.

If your organisation requires a BAA before PHI can touch a third-party service, talk to us first rather than assuming — and assess the tool against your own obligations. We would rather lose the use case than have you discover the gap afterwards.

The short version

Names, dates, ZIP codes and record numbers are the identifiers that get missed. Scans and handwriting are where automation stops helping. Verify per page, not per document — and check the healthcare page or our security posture for the specifics of how files are handled.

Redacting Patient Records: A HIPAA-Minded Workflow