Azure de-identifies clinical text one way. Protecto gives the same patient the same token in every AI call, then returns real values to staff your policy allows.
SOC 2 Type II · ISO 27001 · HIPAA, BAA available
One request, two replies
Draft a reply to Marcus Bell about his denied MRI.
Azure de-identification
Model saw Peter Lowe
Dear Peter Lowe,
Wrong nameProtecto
Model saw <PERSON>Rk7Wd2</PERSON>
Dear Marcus Bell,
Ready to sendAzure keeps no key back to Marcus. Protecto swaps him back for staff your policy allows.
Use Azure Health Data Services de-identification when you need a one-way copy of clinical text for research, sharing or model training, inside Azure. Use Protecto when PHI flows through live AI: prompts, retrieved records, agents and tool calls, where the same patient must keep the same token and some staff need real values back. Protecto works with any model, including Azure OpenAI.
Inovalon built a secure, HIPAA-compliant analytics product on sensitive healthcare data with Protecto
Documents Inovalon tested in under a week
Entity types across PII, PHI and PCI, plus custom entities
Than AWS Comprehend and Microsoft Presidio in the UT Dallas benchmark
“Protecto enabled our team to harness the full power of AI and analytics while maintaining strict HIPAA compliance and data privacy.”
De-identifying a note once is easy. Keeping one patient recognizable to the model, and private from it, across a whole conversation is the hard part.
A care manager at a health plan asks an AI assistant about a member, Marcus Bell. On Monday she asks for a summary of his open claims. On Tuesday she asks it to draft a reply about a denied MRI. On Thursday a claims lookup tool needs his member ID to check status.
With Azure’s surrogate operation, Monday’s request might call him “Michael Grant” and Tuesday’s might call him “Peter Lowe”. Microsoft documents that surrogates are consistent only inside one batch job, and that real-time calls get new surrogates each time. The model now sees two different people. Thursday’s lookup cannot work at all, because the service keeps no mapping back to the real member ID.
Monday
The model receives (Azure surrogate)
Summarize open claims for Michael Grant
A new name for this callThe model receives (Protecto)
Summarize open claims for <PERSON>Rk7Wd2</PERSON>
His tokenTuesday
The model receives (Azure surrogate)
Draft a reply to Peter Lowe about the denied MRI
A different name: the model sees a second personThe model receives (Protecto)
Draft a reply to <PERSON>Rk7Wd2</PERSON> about the denied MRI
Same token: the model follows one memberThursday
The tool gets (Azure surrogate)
No original value. The service keeps no mapping.
The lookup cannot runThe tool gets (Protecto)
HB-90215-07, resolved for this authorized user
The lookup works, and the reveal is loggedThis is the gap between de-identification and AI data protection: the text is private, and the workflow stops making sense.
Where they match, where Azure is strong and where Protecto goes further.
| Capability | Protecto | Azure de-identification |
|---|---|---|
| Main job | Protecting sensitive data going to and from AI models, agents and tools | De-identifying unstructured clinical text |
| Operations | Mask with consistent tokens, unmask by role, or remove identifiers with no mapping kept | Tag, Redact (entity type in brackets), Surrogate (realistic replacement values) |
| Same patient, same token | Yes, in every prompt and session, at any time | Within one batch job only. Separate batches and real-time calls get different surrogates |
| Real values back for allowed staff | Yes, by role, each reveal logged | No. The service is stateless and keeps no mapping |
| Tool calls and agents | Real value resolved at the tool boundary for an authorized user | Not available |
| Live prompts and answers | Inbound prompts and outbound answers, with real values restored by role | Real-time endpoint for complete text. Microsoft advises against real-time or transcription apps that see only the text before an identifier |
| Entity types | 50+ across PII, PHI and PCI, plus custom entities | 27 PHI entity types, including the 18 HIPAA identifiers |
| Custom entities | Yes, added in days | No |
| Inputs | Text, documents and structured data through the API. Batch through the asynchronous API. Pipelines through a Snowflake UDF, Databricks, Kafka or Spark | Unstructured text. Real-time requests up to 50 KB. Batch jobs of up to 10,000 documents of 2 MB each, in Azure Blob Storage |
| Languages | Tested in English, German, French, Spanish, Dutch, Arabic and Japanese. Others tested on your data | US English generally available. UK English, Canadian and French French, German and US Spanish in preview |
| Where it runs | SaaS, on premises, your private cloud or air-gapped | Managed Azure service only |
| Models | Any: Azure OpenAI, ChatGPT models, Gemini, Claude or a model you host | Any. You send its output to the model yourself |
| Audit | Logs each detection, mask and reveal, with reports on how policies are enforced | Basic (Azure platform logs) |
| Pricing | Quote | Per MB processed, 50 MB a month free |
| HIPAA | HIPAA compliant. Signs a BAA when Protecto hosts or can access the service | Covered by Microsoft’s Azure terms. Microsoft states outputs are not guaranteed to meet HIPAA Safe Harbor |
Azure facts from Microsoft Learn: the de-identification overview (updated 2026-01-27), transparency note (updated 2026-10-28), supported languages (updated 2026-10-28) and the Azure Health Data Services pricing page, all checked November 8, 2026. Microsoft’s transparency note, under Limitations: “Don’t use this system in a real-time or transcription application, where the caller might have access to the context only before a PHI utterance.” Protecto facts from docs.protecto.ai. Check each vendor’s documentation for changes.
Protecto sits between your data and the model. It checks what goes in, what tools receive and what comes back.
The care manager types
Draft a reply to Marcus Bell, member ID HB-90215-07, born 05/30/1972, about his denied MRI.
Azure’s redact operation returns
Draft a reply to [patient], member ID [idnum], born [date], about his denied MRI.
The model receives with Protecto
Draft a reply to <PERSON>Rk7Wd2</PERSON>, member ID <HEALTH_BENEFICIARY_NUMBER>KT-37462-19</HEALTH_BENEFICIARY_NUMBER>, born <DATE_OF_BIRTH>11/08/1969</DATE_OF_BIRTH>, about his denied MRI.
Three requests about Marcus, one token
Azure surrogates match only inside one batch job, so each of these calls would get a different name.
The assistant calls the claims lookup tool
The model asks for
Member <HEALTH_BENEFICIARY_NUMBER>KT-37462-19</HEALTH_BENEFICIARY_NUMBER>
The tool receives
Member HB-90215-07, resolved for this authorized user
reveal · HEALTH_BENEFICIARY_NUMBER · claims-lookup · care manager · logged
The answer, by role
Hi Marcus Bell, we reviewed the denied MRI claim on member ID HB-90215-07. Here is what happens next…
Hi <PERSON>Rk7Wd2</PERSON>, we reviewed the denied MRI claim on member ID <HEALTH_BENEFICIARY_NUMBER>KT-37462-19</HEALTH_BENEFICIARY_NUMBER>. Here is what happens next…
Unmasked: this role handles the member’s claim. The reveal is logged.
Stays masked: this role reviews the reply, not the member.
Everyone else in the flow
Yes. Some healthcare teams keep Azure de-identification for one-way research and training copies inside Azure, and put Protecto in the path of live AI: clinician chat, member services assistants, RAG over clinical notes and agents that call claims or scheduling tools. The two do different jobs.
A de-identified copy of US English notes for a research data set or model training, inside Azure.
Prompts, answers, RAG and tool calls where the same patient keeps the same token and staff need real values back by role.
If you want one layer, Protecto can also remove identifiers with no mapping kept, for data sets that must be de-identified.
Neither tool makes a data set de-identified on its own. Your expert or counsel decides that. Microsoft states that the service’s output is not guaranteed to meet HIPAA Safe Harbor. Protecto’s default tokens are reversible by whoever holds the vault, so tokenized PHI is pseudonymized, not de-identified, and may still be PHI.
What Protecto adds for reviewers is the record: which identifiers each flow touched, what each model, index and tool received, and who saw real values.
HIPAA rule by rule for AI →
What tool keeps patient details private in AI answers? →
It is a service in Azure Health Data Services that finds protected health information in unstructured clinical text and tags it, redacts it or replaces it with realistic surrogate values. It covers 27 PHI entity types, including the 18 HIPAA identifiers, and runs through a real-time API or batch jobs on Azure Blob Storage. It is a different product from Azure AI Language PII detection.
Only inside one batch job. Microsoft’s documentation says that submitting the same files in different batches, or through the real-time endpoint, produces different surrogates. Protecto gives the same value the same token in every prompt and session.
No. Microsoft describes the service as stateless, and it keeps no mapping from surrogates to original values. If a workflow needs real values back, you build and secure that mapping yourself. Protecto keeps the mapping in its vault and returns real values only to roles your policy allows, logging each reveal.
Yes. Protecto is model agnostic. It sits between your application and Azure OpenAI, or any other model, so the model receives tokens and your users get real values back by role.
That depends on who runs it. When Protecto hosts or manages the service, or can access your instance for support, upgrades or monitoring, Protecto is a business associate and signs a BAA before any PHI flows. When Protecto runs in your environment with no Protecto access, Protecto does not receive PHI and is not a business associate.
Protecto runs as SaaS, on premises, in your private cloud or air-gapped, so it can run in infrastructure you control.
Bring a sample of clinical notes or claims. We will show what the model receives on day one and day ten, and what each role sees.
