Protecto replaces Safe Harbor identifiers in records and clinical notes before any model, agent, or tool receives them, on-premises or in your private cloud.
Maria Alvarez, MRN 4471-209, discharged 03/14 after CHF exacerbation. Furosemide 40 mg daily.
[PERSON_3c1], [MRN_8f2], discharged [DATE_51a] after CHF exacerbation. Furosemide 40 mg daily.
A healthcare data platform prepared its claims archive for AI
Claims documents in scope
Archive-scale processing
Every mask, reveal, and access
A health system pilots an assistant that drafts follow-up letters from discharge summaries. The notes mix names, dates, record numbers, and phone numbers into ordinary sentences. The assistant sends text to a hosted model, stores chunks in a search index, logs every call, and hands tasks to a scheduling agent. The privacy officer asks which of these receive PHI, and under which agreement. The pilot stops there.
Discharge summaries, referral letters, and claims notes are where AI saves clinicians the most time. They are also where PHI sits, written into sentences, not neat columns.
HIPAA lets you use or disclose PHI only as the rules permit, limited to the minimum necessary (45 CFR 164.502(a), (b)). A vendor that handles PHI for you needs a business associate agreement. One sprint can add a model, an index, a log store, and a tool.
Blanking every value turns a note into “Patient [REDACTED] seen for [REDACTED].” Pattern tools miss a name or a date written into a sentence. Either the answer breaks or PHI slips through, and teams turn the tool off.
HIPAA asks for audit controls that record activity in systems holding ePHI (164.312(b)). An impermissible disclosure is presumed a breach unless a risk assessment shows a low probability of compromise (164.402). Without a record of which AI got which value, that assessment starts with no evidence.
Your follow-up assistant reads a discharge summary. Protecto runs on your servers or in your private cloud, finds the identifiers in the record and in the note, and applies a policy for each recipient. The hosted model, the index, and the logs get tokens and keep the clinical facts. The scheduling agent gets the patient’s phone number because your policy says so, and the release is logged.
Maria Alvarez → [PERSON_3c1]The same patient always gets the same token, so the model can follow one person through a note.
scheduling agent ← phoneA tool or role gets the value its task needs, and the release is logged.
MRN → removed, no mappingIdentifiers are dropped with no way back, for analytics or training sets.
Runs on your servers, in your data center.
Runs in your cloud account, in the region you choose.
Process claims archives and note exports in batches before they reach an index or a training set.
HIPAA reviews ask questions that code cannot answer quickly. Which PHI does this flow touch? Which recipient gets it, and what does it see? Protecto logs each decision, so your team can answer per flow and keep the report with your risk analysis.
[PERSON_3c1], discharged [DATE_51a], continue furosemide 40 mg daily, recheck weight in 3 days.
Referral for [PERSON_9e0], [ADDRESS_2d7], cardiology consult for reduced ejection fraction.
draft_letter(patient=[PERSON_3c1], mrn=[MRN_8f2])
book_followup(phone=(617) 555-0142, patient=[PERSON_3c1])
Maria Alvarez, MRN 4471-209: lives alone, daughter checks in weekly.
Civil penalties come in four tiers, from violations an organization did not know about to willful neglect left uncorrected, and HHS adjusts the amounts for inflation each year (45 CFR 160.404, 102.3). Most of the rules below apply to covered entities and business associates alike.
| Rule | Requirement | Protecto solution |
|---|---|---|
| Permitted uses and disclosures164.502(a) | PHI may be used or disclosed only as the Privacy Rule permits or requires. | Each recipient gets a policy. Models, indexes, and logs get tokens. Real values go only where your policy releases them. |
| Minimum necessary164.502(b), 164.514(d) | Make reasonable efforts to limit PHI to the minimum necessary for the purpose, and limit workforce access to what each role needs. | Protecto releases only the values a task needs, per recipient and per role. |
| De-identification164.514(a), (b) | Data is de-identified by removing the 18 Safe Harbor identifiers with no actual knowledge of re-identification, or by an expert’s determination. | Protecto detects Safe Harbor identifiers in records and clinical text, and removes or tokenizes them by policy. Your expert or counsel decides if a data set is de-identified. |
| Business associates164.502(e), 164.504(e) | A vendor that handles PHI for you needs a written agreement and appropriate safeguards. | Model vendors receive tokens instead of identifiers. When Protecto runs in your environment with no Protecto access, PHI stays there and Protecto is not a business associate. When Protecto hosts the service, Protecto signs a BAA. |
| Risk analysis164.308(a)(1)(ii)(A) | Assess risks to the confidentiality, integrity, and availability of ePHI. | The scan and flow report show which PHI each AI flow touches and where it goes, as input to your risk analysis. |
| Access control164.312(a)(1) | Give access to ePHI only to people and software granted access rights. | Unmasking is by role. Only the people and tools you approve see real values. |
| Audit controls164.312(b), 164.308(a)(1)(ii)(D) | Record and examine activity in systems that contain or use ePHI, and review those records regularly. | Every detect, mask, and reveal decision is logged in your environment, ready for review. |
| Transmission security164.312(e)(1) | Guard ePHI sent over a network against unauthorized access. | Identifiers are replaced before data leaves for a hosted model, so the call carries tokens. |
| Breach notification164.402, 164.404 | An impermissible disclosure is presumed a breach unless a risk assessment shows a low probability of compromise. Patients must be told within 60 days of discovery. | A leaked model log or index holds tokens, not identifiers. Your privacy officer decides what that means for the assessment. |
State health privacy laws and 42 CFR Part 2 for substance use disorder records can add duties. Check with counsel.
Our whitepaper, HIPAA for Enterprise AI and Agents, follows one scheduling agent through a medical group and maps which PHI each role, model, and vendor may receive.
A healthcare data platform wanted search, summarization, and analytics over about 750 million claims documents holding patient information, clinical notes, and billing records. Broad redaction turned notes into “Patient [REDACTED] seen for [REDACTED].” Protecto Vault processes the archive in batches, replaces identifiers with reversible tokens, and logs every mask, reveal, and access event. The same note now reads “Patient [PERSON_TOKEN] seen for asthma follow-up.”
Claims documents in scope
Asynchronous processing across the archive
Every mask, reveal, and access event
Bring one AI flow and a sample of your notes. We will show what each recipient receives.
One medical group’s scheduling agent, followed from request to booking. The questions to settle before launch, what each role, model, and vendor may receive, and the audit evidence reviewers ask for.
An independent benchmark by UT Dallas and DataXpert, with results by entity type, including medical record numbers.
How DeepSight finds PII and PHI from context, with Protecto’s internal test results.
Not by default. Safe Harbor asks you to remove the 18 identifiers (45 CFR 164.514(b)(2)). Protecto’s default tokens are consistent and can be reversed by whoever holds the vault, so they work as pseudonyms, and tokenized data may still be PHI. For data sets that must be de-identified, Protecto can remove identifiers with no mapping kept. Whether a data set meets Safe Harbor or Expert Determination is your expert’s or counsel’s call.
Names, street addresses and other places smaller than a state, dates, phone and fax numbers, email addresses, Social Security numbers, medical record numbers, health plan and account numbers, license, vehicle, and device numbers, URLs, and IP addresses. These are part of 50+ entity types, plus custom entities such as your own MRN format. Protecto works on text and structured data, so images such as face photos need separate handling.
That depends on who runs Protecto. When Protecto hosts or manages the service, or can access your instance for support, upgrades, or monitoring, Protecto is a business associate and signs a business associate agreement before any PHI flows. When Protecto runs on your servers or in your private cloud with no Protecto access, Protecto does not receive PHI and is not a business associate.
If the provider receives only tokens, far fewer identifiers reach it. Tokens can still be PHI if they can be linked back to a patient, so many teams keep a BAA in place. Your counsel makes that call.
Protecto replaces identifiers and leaves the clinical facts in place, such as diagnoses, medications, and lab values. Each patient gets the same token every time, so the model can follow one person through a note and across records.
Yes. Protecto finds PHI in structured records, such as EHR exports and claims tables, and in free text, such as clinical notes, discharge summaries, referral letters, and patient messages.
Any recipient in the path: hosted and self-hosted models, RAG indexes, logs, agent memory, MCP tool calls, and APIs. Each one gets its own policy: tokens, real values by role, or nothing.
On-premises, in your private cloud account, air-gapped, or as SaaS. For an air-gapped setup, the model runs inside the same boundary.
Protecto logs each detection, mask, and reveal. Your team can report which PHI a flow touched, which recipient received what, and who viewed real values, and use that in your risk analysis and audit reviews.
Bring one AI flow and sample notes. We will show what the model, the index, and each tool receive, and the report your reviewers get.
Which PHI each role, model, and vendor may receive when an AI agent works on patient records.
By submitting you agree to Protecto’s privacy policy.
How DeepSight finds PII and PHI from context, with Protecto’s internal test results.
By submitting you agree to Protecto’s privacy policy.
A third-party study compares how accurately Protecto, Microsoft Presidio, and AWS Comprehend find personal and health data in unstructured text.
By submitting you agree to Protecto’s privacy policy.
A practical guide to privacy controls for AI assistants, RAG, and agents. One workflow traced from request to CRM update, with what each destination may see.
By submitting you agree to Protecto’s privacy policy.