Home » Medical Data De-identification

Medical Data
De-identification

Notes, PDFs, DICOM, structured tables and FHIR - de-identified at regulatory grade accuracy, inside your own environment. Consistent tokenization and obfuscation across modalities for the same patient.

Live demos Schedule a Call

Proven at 2 billion notes

The largest validated de-identification
deployment in healthcare

Providence Health de-identified two billion patient notes with this pipeline: independently
validated, tested for model bias, and red-teamed for three months.

Patient notes processed

99%+

PHI detection accuracy

Red Team Re-identifications

500K

Notes in 2.5 Hours

How it was validated

Three-month red-team exercise by an external security provider
Adversarial testing on 790 patients with zero re-identifications
Manual review of 35,000+ notes by the compliance team
Equity analysis across gender, age, ethnicity and geography
Consistent obfuscation, date shifting and tokenization per patient
Accuracy above triple manual review by domain experts

Read the paper

Deliver regulatory-grade accuracy

0.95 is the bar that expert manual review reaches. Below it, your data cannot be considered de-identified.

PHI recall on expert-annotated clinical text, projected onto a 1M-note corpus at ~31 PHI mentions per note. *Databricks ai_mask() as reported in the 2026 benchmark. Ground truth and scoring code are public. Full 2026 benchmark →

De-identify data where it lives

0.98

micro F1 on the official 2014 i2b2 test set

0.98

PHI recall at 381,959-token scale

80%+

cheaper than API-based alternatives

Fixed

licensing – no per-token fees

Zero

data movement – runs where your data lives

Deterministic

same PHI, same token, every run

See It In Action

De-identification across all medical data types

Works with every major healthcare data format — maintaining structure while removing PHI.

Clinical Notes

Automatically identify and obfuscate 23+ PHI entity types including patient names, doctors, hospitals, medical records, locations, dates, and contact information.

PDF Documents (Text & Scanned)

Process PDFs directly — original structure and formatting preserved, PHI removed with 94%+ accuracy. Built-in OCR handles digital and scanned documents without recreating the file.

DICOM Medical Images

Redact burned-in PHI using intelligent pixel inpainting with complete metadata de-identification. Handles all DICOM modalities and saves back to DCM with image utility intact.

Structured Data & Databases

De-identify PHI from structured datasets automatically while enforcing GDPR and HIPAA compliance and maintaining clinical linkage across files, at millions of records.

Link All Data About Each Patient

Masking gives you [PATIENT] and [DATE] which is safe but useless.
Make sure de-identified data stays usable instead.

Consistent Tokenization & Obfuscation

Protect privacy without breaking data relationships. The same individual receives an identical, realistic replacement value across every document, so referential integrity survives for research and analysis.

Original text annotated

Obfuscated text annotated

Deterministic
Cross-modal
Referential integrity

Link Multimodal Patient Data Over Time

Maintain patient context across longitudinal records. Intelligent date shifting preserves temporal relationships, narrative continuity and linkability between notes, images and tables.

Original text annotated

Obfuscated text annotated

Date shifting
Temporal integrity
Multimodal linkage

HIPAA Expert Determination

Get an Expert Determination

We can evaluate and certify your de-identified dataset or pipeline: profile quasi-identifiers, compute k-anonymity risk, apply the least destructive mitigation, and produce full HIPAA Expert Determination documentation.

We perform it

Two analytical phases, both reproducible

Phase one scores the pipeline against a held-out Golden Set, held to a 0.94 PHI recall bar — the accuracy of a two-reviewer human process. Phase two measures the output: k-anonymity, l-diversity, t-closeness and prosecutor risk across several configurations.

You receive it ready

A signed report and the notebooks behind it

A formal report – credentials, methodology, metrics and the certifying statement — plus both executable notebooks, so your team can re-run the assessment whenever the data or the pipeline changes. No black boxes.

Talk to us
Read the guide

De-identify clinical text in multiple languages

Clinical documents de-identified at regulatory-grade accuracy across jurisdictions — with above 98% coverage of sensitive data reported across seven European languages, out of the box.

English

English

Spanish

French

German

Italian

Portuguese

Dutch

Romanian

Arabic

Customizable for your unique requirements

Healthcare organizations have diverse data formats, custom identifiers, and specific compliance needs. Our solution flexibly adapts to your workflow – not the other way around.

Custom Entity Recognition

Define and train models to recognize your organization’s specific identifiers:

Internal patient ID formats
Custom medical record numbering
Facility-specific codes
Department identifiers
Study participant IDs

Flexible Policies

Configure granular policies that balance data utility with privacy protection:

Obfuscate names with realistic fakes
Mask specific fields with asterisks
Shift dates while preserving intervals
Generalize locations (city → state)
Tokenize for consistent linkage

Format-Specific Processing

Native support for every healthcare document format, preserving structure and content:

Custom PDF templates and forms
Proprietary EHR exports
Legacy system formats
Complex table layouts
Embedded images and charts

Regulatory Compliance

Configure policies to meet your regulatory requirements:

HIPAA Safe Harbor
HIPAA Expert Determination
GDPR compliance ready
CCPA and state privacy laws
Custom regulatory frameworks

Enterprise Integration

Seamless integration into your existing tech stack with robust API access:

RESTful API Integration
Real Time Processing
Batch Processing
Horizontal Scaling & High availability
Full Audit Logs and Monitoring

Enterprise Security

Secured solution with multiple deployment options for any security posture

End-to-end Data Encryption
On-premise or Cloud Deployment
Air-gapped Environments
Zero Data Retention by Default

Peer-reviewed, state-of-the-art accuracy

Can Zero-Shot Commercial APIs Deliver Regulatory-Grade Clinical Text DeIdentification?

Beyond Accuracy: Automated De-Identification of Large Real-World Clinical Text Datasets

Accurate Clinical and Biomedical Named Entity Recognition at Scale

All peer-reviewed papers

Learn More

Watch real-world de-identification challenges solved

How healthcare teams tackle complex PHI removal — from messy clinical notes to billion-record databases, scanned PDFs to multimodal processing.

The same products your teams already license

Available on the AWS, Azure, Snowflake and Databricks marketplaces, so the pipeline runs next to data you cannot move.

Learn more

Live demo

Paste a note in the browser and see the output.

Product documentation

Pipeline stages, entity coverage, configuration options.

Colab notebook

The pre-trained de-identification pipeline, one click, your data.

Benchmark
ground truth

Public annotations and scoring code — reproduce every number.

Try it on your own data

Run the pre-trained pipeline in a Colab notebook, or bring us a sample and we will show you the accuracy on your documents.

Open Colab Notebook

Frequently asked questions

No. The pipeline runs in-place inside Databricks, Snowflake, Azure, AWS, your own datacenter, or an air-gapped network. Processing happens in memory, with zero data retention by default.

Yes — the full process, including statistical risk analysis, auditable validation and the legal documentation, alongside Safe Harbor if that is your standard.

Yes. Tokenization is deterministic: identical PHI produces identical tokens across notes, PDFs, DICOM, tables and FHIR. Date shifting preserves intervals, so longitudinal analysis holds.

De-identifying transforms PHI; it does not by itself produce the statistical evidence HIPAA's Expert Determination method requires. That gap is what a formal report closes — and it is what unblocks legal, IRB and ethics review the next time you share data.

Both are supported. Safe Harbor's 18 categories are fully automated in the pipeline. Expert Determination is the right standard when you obfuscate rather than mask, because the question shifts from "did you remove the fields" to "what are the statistical properties of the output".

Fixed licensing rather than per-token pricing, and CPU inference at billion-record scale — reported at 80%+ below API-based alternatives, with predictable cost as volume grows.

Yes. The pipeline has been deployed for de-identification projects across four continents, each under its own privacy law — GDPR and national implementations in Europe, HIPAA in the United States, and equivalent regimes in the Middle East, Africa and Australia. Identifier sets, date-shifting rules, surrogate generation and retention policies are configured per jurisdiction, and because everything runs inside the customer's own environment, data residency requirements are met by default.