PHI De-identification & Re-identification Risk

01 How it works

Six passes, no black box.

Every rule below runs in your browser on the text in the box. The text you paste is never transmitted — no request carries it off this page — and nothing is pre-computed. The page itself loads webfonts from Google; your note does not.

Step 01

Layered detection against §164.514(b)(2). Three detector families run over the raw text: deterministic regular expressions for structured identifiers, gazetteers for names, cities and states, and context rules that fire on a trigger phrase and redact only the value that follows it — so MRN: survives and the number does not.

Step 02

Checksum validation, not shape-matching. Candidates are confirmed arithmetically where a published check exists: VIN position-9 check digit (ISO 3779), DEA registrant checksum, NPI Luhn over the 80840 prefix, CMS MBI positional format, and the SSA issuance rules that bar area 000, 666 and 900–999. A candidate that fails its check is still redacted, but drops to lower confidence and says so.

Step 03

Span resolution. Overlapping candidates are resolved by rule specificity, then span length — so a full street address wins over the bare road name inside it, and a validated MBI wins over the generic alphanumeric-code net. Suppressed candidates are counted, not silently dropped.

Step 04

Transformation under the selected method. Safe Harbor §164.514(b)(2) strips all 18 categories, keeps the initial three ZIP digits unless the prefix is on the restricted-population list, keeps years, and aggregates ages over 89 to 90+. Limited Data Set §164.514(e)(2) removes only the 16 enumerated direct identifiers and retains full dates, city, state and 5-digit ZIP.

Step 05

Residual risk by equivalence class. The surviving quasi-identifiers — geography, sex, birth granularity — are multiplied against a stated population denominator to estimate k, the expected number of people sharing the released combination. Every constant in that arithmetic is printed on the page.

Step 06

Seeded human-review queue. A reproducible sample of the weakest detections is drawn with a mulberry32 PRNG seeded from a hash of the input, so two reviewers looking at the same note get the same queue. Nothing on this page calls the platform’s unseeded random source.

02 The tool

De-identify a note.

Edit the text and the analysis re-runs 200 ms after you stop typing.

Synthetic records. No real patient data is used anywhere in this tool.

Both notes were written for this demonstration; every name, number and address in them is invented.

Demonstration only. Not validated for clinical or compliance use.

This is not a certified compliance control, not a medical device, and not a substitute for expert determination or a qualified privacy officer.

Clinical free text — synthetic

Original — detections highlighted

De-identified output

Redaction token — band fill, accent underline Dotted underline — detected but lawfully retained

Identifiers found

Categories triggered

0 / 18

Characters redacted

Est. equivalence class k

—

03 Detections

Every span, and the rule that fired.

#	Category	Span	Confidence	Rule fired	Replacement

04 Category coverage

All eighteen, scored.

The full §164.514(b)(2)(i) list. Categories found in this note are marked in accent; categories clean in this note are muted — clean means not present, never not checked.

05 Residual risk

Safe Harbor is not zero-risk.

De-identification removes identifiers. It does not remove the quasi-identifiers that let an adversary link a record back to a person through an external register — a voter roll, an obituary, a local news report.

Re-identification risk band

—

Quasi-identifier	Released value	Factor	Basis

Bands follow common de-identification practice: k < 5 is treated as high risk, and k ≥ 11 as low, matching the CMS cell-size suppression convention that cells of 10 or fewer are too small to release. A low band here means the modelled combination is common — not that the record is safe. Safe Harbor is a regulatory safe harbor, not a mathematical guarantee; HHS's own de-identification guidance describes the residual risk as very small but explicitly non-zero, and offers Expert Determination under §164.514(b)(1) as the alternative route.

06 Human review queue

Where a person still has to look.

A reproducible sample of the weakest detections, drawn with a seeded PRNG so the same note always produces the same queue. Confirm each one before release.

07 Method & limitations

What this catches, and what it does not.

What it catches. Identifiers with deterministic shape — SSN, telephone, fax, email, URL, IPv4 and IPv6, ZIP and dates in six formats — plus checksum-validated VIN, DEA, NPI and CMS MBI values, context-anchored MRN, plan, account, licence and device numbers, and names from a — gazetteer with title, relation and signature rules.

What it misses. Names outside the gazetteer with no title or relation cue; misspellings, OCR noise and nicknames; dictation without punctuation; non-US formats; and most of category 18, whose characteristics no regular expression can enumerate. Ambiguity-prone surnames (Ward, Green, King) are excluded to protect precision. Payer and facility names are not enumerated identifiers and are kept, though in a small catchment they re-identify. Ambiguous numeric dates are read US-first.

What production adds. A clinical NER model fine-tuned on an annotated corpus such as i2b2/UTHealth, ensembled with these rules rather than replacing them; a per-institution term list; surrogate generation instead of bracket tokens; and measured recall on a held-out gold set, because an unmeasured pipeline is an unquantified breach.

Where a human stays. Every low-confidence span, every category-18 flag, and every note reported clean. The restricted ZIP list is the 17-prefix HHS list from Census 2000; refresh it before real use.