Only if all 18 Safe Harbor identifier types are gone, including dates, places and record numbers inside sentences, and nothing left points to the patient. Removing names is not enough.
SOC 2 Type II · ISO 27001 · HIPAA, BAA available
Safe Harbor check
One cardiology note, after a names-only script
Names of the patient
RemovedNames of relatives
Still thereDates, beyond the year
Still thereRecord, phone and device numbers
Still thereA town smaller than a state
Still thereClues like “the only pharmacist in town”
Needs reviewWith Protecto
Every listed identifier is found inside the sentences, then removed or tokenized by policy. Your expert signs off.
Redaction can meet Safe Harbor, but only when it removes every listed identifier wherever it appears in the note and your organization has no actual knowledge that what remains could identify the patient. HHS applies the same rule to free text as to database fields. For a clinical note, that means five checks.
For the patient and for relatives, employers and household members. Names, record numbers, phone numbers and the rest, including those written mid-sentence.
Visit, admission, discharge, birth and death dates lose the month and day. Ages over 89 become “90 or older”.
Street, town, county and full ZIP code. The first three ZIP digits may stay only where that area holds more than 20,000 people.
A rare job, a rare disease in a small town or a news event in the note can identify someone after the list is removed. If you know that, the note is not de-identified.
Missing one MRN in a thousand notes fails Safe Harbor for those notes. Protecto’s agentic detection and classification engine finds identifiers inside clinical sentences across 50+ entity types and removes them with no mapping kept. Whether a data set meets Safe Harbor is your expert’s or counsel’s call.
Inovalon built a secure, HIPAA-compliant analytics product on sensitive healthcare data with Protecto
Than AWS Comprehend and Microsoft Presidio in the UT Dallas / DataXpert benchmark
Entity types across PII, PHI and PCI, plus custom entities such as your MRN format
Documents Inovalon tested in under a week
A research team wants a hosted model to pull outcomes from 5,000 cardiology notes. They plan to send de-identified notes, with no BAA.
An analyst runs the hospital’s redaction script, which replaces patient names with “[NAME]”. The team assumes the batch is now de-identified. Switch the views to see one note before the script, after it, and with Protecto in the path.
The script removed one of eight listed identifiers. One more detail fails the actual knowledge test. The fall, the warfarin and the pacemaker check stay readable either way, because Safe Harbor does not ask you to remove clinical facts.
The note in the EHR (fictional)
Pt Rosa Delgado (MRN 00-583-219), 91 y/o F, seen 08/22/2026 at the Clearwater Springs clinic after a fall at home. Daughter Ana (cell 555-0142) says she stopped warfarin last week. Pacemaker serial PM-77310-K checked, normal. Retired, was the only pharmacist in Clearwater Springs for 30 years.
What the model receives after a names-only script
Pt [NAME] (MRN 00-583-219record no.), 91age 90+ y/o F, seen 08/22/2026date at the Clearwater Springstown clinic after a fall at home. Daughter Anarelative (cell 555-0142phone) says she stopped warfarin last week. Pacemaker serial PM-77310-Kdevice checked, normal. Retired, was the only pharmacist in Clearwater Springscontext for 30 years.
What the model receives with Protecto in the path
Pt <PERSON>Lm4Tq8</PERSON> (MRN <MRN>8203571946</MRN>), 91 y/o F, seen <ADMIT_DATE>k9Wq2Ls7</ADMIT_DATE> at the <CITY>r7Hn3Vd2</CITY> clinic after a fall at home. Daughter <PERSON>Qe2Bx5</PERSON> (cell <PHONE_NUMBER>555-8810</PHONE_NUMBER>) says she stopped warfarin last week. Pacemaker serial <DEVICE_ID>Zt61Kp0</DEVICE_ID> checked, normal. Retired, was the only pharmacist in <CITY>r7Hn3Vd2</CITY> for 30 years.
Each marked detail must go before this note counts as de-identified under Safe Harbor.
Each outlined detail is a listed identifier, except the job, which fails the actual knowledge test.
Tokens are pseudonyms, so this note may still be PHI. For a set that must meet Safe Harbor, Protecto removes the identifiers with no mapping kept.
Each detail in the sample note, the Safe Harbor rule it falls under, and who catches it.
| In the note | Safe Harbor rule | Names-only script | Protecto |
|---|---|---|---|
| Rosa Delgado | Name of the patient | Removed | Detected as PERSON |
| MRN 00-583-219 | Medical record number | Missed | Detected as MRN |
| 91 y/o | Ages over 89 become “90 or older” | Missed | Your age rule, applied by a reviewer or a custom entity |
| 08/22/2026 | Dates keep only the year | Missed | Detected as ADMIT_DATE |
| Clearwater Springs | Place smaller than a state | Missed | Detected as CITY |
| Ana | Name of a relative | Missed | Detected as PERSON |
| 555-0142 | Telephone number | Missed | Detected as PHONE_NUMBER |
| PM-77310-K | Device identifier or serial number | Missed | Detected as DEVICE_ID |
| “Only pharmacist in Clearwater Springs”Not on the list | Actual knowledge: anyone in town knows who this is | Missed | Added as a custom entity, or sent to your reviewer |
Example note and values are fictional.
Database fields have labels. Sentences do not, so the tool has to understand what each value is.
Identifiers hide in ordinary sentences. “Daughter drove her in from Elk Grove” carries a relative and a town with no field name to match. Pattern rules catch phone numbers and Social Security numbers. They miss a first name, a unit named after a place, or a date written “the 22nd”.
Dates are everywhere. Admission, procedure, lab and follow-up dates all count, and they appear as “8/22”, “Aug 22” or “last Tuesday”. Safe Harbor keeps only the year of each.
Context can identify on its own. A rare disease, an unusual job or a local news event is not on the list of 18. HHS still says the note fails if you know the remaining text could identify the person. No tool decides that for you, which is why reviewers sample output and document the method.
Expert Determination is the other route. A qualified expert measures the risk for a specific use and documents it, which can let you keep more detail, such as shifted dates. Teams often use it for large note sets where cutting every date would ruin the analysis.
Six common approaches, scored on what Safe Harbor asks of free text.
| Approach | Finds identifiers inside sentences | Output maps to the 18 categories | Handles actual knowledge items | Who signs off |
|---|---|---|---|---|
| Names-only script or regex rules | Basic. Fixed formats only, such as SSN and phone | No | No | Your reviewer, on every gap |
| General PII detectorMicrosoft Presidio | Yes, for built-in types. Clinical identifiers need custom recognizers | Basic. You build the mapping | No | Your expert or counsel |
| Clinical de-identification servicesAzure Health Data Services de-identification, Amazon Comprehend Medical | Yes | Azure is built around HIPAA identifiers. AWS states Comprehend Medical entities do not map one-to-one to the Safe Harbor list | No. AWS recommends human review for compliance use | Your expert or counsel |
| Open-source clinical scrubbersPhilter, NLM Scrubber | Yes | Yes, with Safe Harbor policies you configure and validate | No | Your expert or counsel |
| ProtectoAgentic detection and classification engine | Yes. 50+ entity types, higher F1 than AWS Comprehend and Presidio in the UT Dallas / DataXpert benchmark | Yes, per entity type, with reports on how each policy was enforced | Custom entities for your known risks, such as job titles or unit names. A reviewer for the rest | Your expert or counsel |
| Expert Determination (a method, not a tool) | Uses one of the tools above | Not required. The expert sets the rules | Yes, in the expert’s risk analysis | The qualified expert, in writing |
Every row ends with a person signing off. What changes is how much a reviewer has to catch by hand.
Not legal advice. Safe Harbor rules summarized from 45 CFR 164.514(b) and HHS guidance (2012). Vendor facts from each vendor’s public documentation, November 2026.
Protecto finds identifiers in the text, removes or tokenizes them by policy, and records what it did for your reviewer.
Protecto reads notes, discharge summaries, transcripts and messages, and labels each identifier by type, such as PERSON, MRN, ADMIT_DATE and PHONE_NUMBER.
Local risks become custom entities, such as your MRN format, unit names or job titles your reviewers flag. Custom entities can be added in days.
Remove identifiers with no mapping kept for data sets that must meet Safe Harbor. Or replace them with consistent tokens for live AI use, where approved staff need real values back.
Batch jobs through the asynchronous API, or in pipelines through a Snowflake UDF, Databricks, Kafka or Spark.
Every detection and transformation is logged, and Protecto reports how each policy was enforced, so your expert can sample output and document the method.
Yes. HHS guidance says the 18 identifiers must be removed wherever they appear, including progress notes, discharge summaries and other narrative text, not only structured fields.
After the 18 identifier types are removed, the covered entity must not actually know that the remaining information could identify the person, alone or with other information. A note describing “the only pharmacist in town” fails this test even with every listed identifier gone.
It can keep the year of a date. Ages over 89, and any date element showing that age, must be grouped as 90 or older. Keeping exact or shifted dates needs Expert Determination instead.
No. Clinical facts are not among the 18 identifiers. A rare condition can still identify someone in context, so it falls under the actual knowledge rule, and an expert may restrict it under Expert Determination.
Not by default. Protecto’s tokens are consistent and reversible by whoever holds the mapping, which makes them pseudonyms, so tokenized notes may still be PHI. For data sets that must be de-identified, Protecto removes identifiers with no mapping kept.
Protecto supports HIPAA Safe Harbor. It detects identifiers inside clinical text, removes them with no mapping kept, and records what it did. Whether a data set meets Safe Harbor, including the actual knowledge test, is your expert’s or counsel’s call.
When the analysis needs detail Safe Harbor removes, such as exact dates, intervals or small-area geography. A qualified expert documents that the risk of identification is very small for the intended use. Protecto can apply the expert’s rules as policy.
Bring a sample of clinical notes. We will show which identifiers Protecto finds, what is removed, and what your reviewer still checks.
A third-party study compares how accurately Protecto, Microsoft Presidio, and AWS Comprehend find personal and health data in unstructured text.
By submitting you agree to Protecto’s privacy policy.
