Not by itself. Redacted text must still pass HIPAA de-identification, or the AI provider must be allowed to receive PHI under a BAA. Most redaction fails the first test.
SOC 2 Type II · ISO 27001 · HIPAA, BAA available
Names removed, sent to an LLM
Walter Hayes seen 03/14/2026 at the Elk River clinic, MRN 448-21-07, retired fire chief. Wife Linda will drive him home.
Test 1. Is the text de-identified?
NoThe date, town, MRN and a relative’s name are still there, and a rare job in a small town points to one man.
Test 2. May the provider receive PHI?
Only with a BAAOn a plan the provider signs a BAA for.
With Protecto in the path
Identifiers become tokens such as <MRN>905-36-14</MRN> before the model. The mapping stays with you.
Redaction is a method, not a HIPAA status. Sending clinical text to ChatGPT or any hosted LLM is allowed only if one of two things is true, and blacking out names usually proves neither.
That means Safe Harbor (all 18 listed identifier types removed and no actual knowledge that what is left could identify the person) or Expert Determination (a qualified expert documents that the risk is very small). De-identified data is no longer PHI.
The provider signs a business associate agreement (BAA) for the exact product you use, and you still share only the minimum necessary.
The text is PHI going to a party with no BAA, whatever was redacted.
Protecto replaces identifiers with tokens before text reaches the model, keeps the mapping in your environment and logs every reveal, so far less PHI leaves. Your counsel still decides whether a flow is de-identified or needs a BAA.
Inovalon built a secure, HIPAA-compliant analytics product on sensitive healthcare data with Protecto
Documents Inovalon tested in under a week
Entity types across PII, PHI and PCI, plus custom entities such as your MRN format
Than AWS Comprehend and Microsoft Presidio in the independent UT Dallas / DataXpert benchmark
Clinical notes carry identifiers inside ordinary sentences, and a name filter only sees names.
A quality team wants ChatGPT to summarize 200 discharge notes. An analyst runs a script that swaps patient names for “[NAME]” and uploads the batch. One note still reads: “seen 03/14/2026 at the Elk River clinic, MRN 448-21-07, retired fire chief, wife Linda will drive him home.” The name is gone. The visit date, the MRN, the town, the occupation and the spouse’s first name are not.
Under Safe Harbor, the date, the MRN and a town smaller than a state all have to go, and so do names of relatives. Even after that, if the team knows that “retired fire chief” in a town that small points to one man, the actual knowledge rule means the note is still not de-identified. This is why HHS treats de-identification as a standard to meet, not a tool to run.
What the model receives after a name filter
[NAME] seen 03/14/2026date at the Elk Rivertown clinic, MRN 448-21-07record no., retired fire chiefcontext. Wife Lindarelative will drive him home.
What the model receives with Protecto in the path
<PERSON>Rk7Lm2</PERSON> seen <DISCHARGE_DATE>09/27/2026</DISCHARGE_DATE> at the <CITY>Qx4Ta9</CITY> clinic, MRN <MRN>905-36-14</MRN>, retired fire chief. Wife <PERSON>Jw2Nc8</PERSON> will drive him home.
Each outlined detail is one of the 18 Safe Harbor identifiers, except the job, which fails the actual knowledge test.
Tokens keep one patient recognizable to the model. Your expert decides whether context such as a rare job stays.
HIPAA recognizes two ways to de-identify. Safe Harbor removes 18 identifier types, including names, geography smaller than a state, every date element except the year, record and account numbers, and contact details, and requires that you have no actual knowledge the rest could identify the person. Expert Determination lets a qualified expert apply statistical methods and document that the risk of identifying someone is very small for the intended recipient. Free text is where both methods get hard: identifiers sit inside sentences, and context like a rare job or a small town can identify someone on its own.
If the text is still PHI, the AI provider is a business associate and needs a signed BAA that covers the specific product. A BAA governs what the provider may do with PHI. It does not stop PHI reaching the provider, and it does not cover every plan.
Per OpenAI’s help center, as of November 2026
| OpenAI product | BAA |
|---|---|
| ChatGPT Enterprise, including ChatGPT for Healthcare | Yes, on eligible accounts through OpenAI sales |
| OpenAI API with Modified Retention | Yes, self-serve for eligible organizations in the API Platform, or through sales |
| ChatGPT Free, Plus, Pro and Business | No |
Other providers, including Microsoft, Google and Anthropic, offer BAAs on some products. Check the exact product and features your team uses.
Five common ways to handle clinical text before an LLM, scored on both tests.
| Method | Test 1: de-identified? | Test 2: provider needs a BAA? | What the AI can still do |
|---|---|---|---|
| Remove names only | No. Dates, record numbers, places and context remain | Yes | Most of the task |
| Safe Harbor: remove all 18 identifier types, no actual knowledge | Yes, if done fully | No | Loses who-is-who. Dates become years only |
| Expert Determination | Yes, for the documented use | No | Depends on what the expert allows |
| Tokenize identifiers, keep the mapping in your environmentProtecto | No. Pseudonymized, may still be PHI | Your counsel decides. Far fewer identifiers reach the provider | Keeps who-is-who. Real values back for allowed staff |
| Send full PHI under a BAA | No | Yes, BAA required | Everything, and the provider holds all of it |
Many teams combine rows: tokens before the model, a BAA where counsel requires one, and removal with no mapping kept for data sets that must be de-identified.
Not legal advice. HIPAA rules summarized from HHS guidance on 45 CFR 164.514. Vendor facts dated where stated.
Protecto sits between your clinical text and the model, and records what each recipient received.
Protecto finds identifiers in prompts, files and retrieved records, including those written inside clinical sentences. 50+ entity types, plus custom entities such as your MRN format.
Each identifier becomes a consistent token. The same patient gets the same token every time, so summaries still track one person. Clinical facts your policy leaves readable stay in the text.
The token mapping stays in your environment. The model provider, prompt logs and chat history hold tokens.
Real values come back in the answer only for roles your policy allows. Every detection, mask and reveal is logged, so you can show which PHI each flow touched.
For data that must meet Safe Harbor, Protecto removes the identifiers it detects with no mapping kept. Your expert or counsel signs off on the result.
No. Safe Harbor requires removing 18 identifier types, including dates more specific than the year, record numbers, geography smaller than a state, and names of relatives. You also must have no actual knowledge that the remaining text could identify the person. Names alone cover one of the 18.
It can be. Protecto’s tokens are consistent and reversible by whoever holds the mapping, which makes them pseudonyms, not de-identified data. Your counsel decides how a tokenized flow is treated. For data sets that must be de-identified, Protecto can remove identifiers with no mapping kept.
Only for its enterprise products. As of November 2026, OpenAI signs a BAA for ChatGPT Enterprise, including ChatGPT for Healthcare, and for the OpenAI API with Modified Retention. ChatGPT Free, Plus, Pro and Business have no BAA.
A BAA makes the disclosure permitted. It does not make it small. HIPAA’s minimum necessary standard still applies to most disclosures to a business associate, and every identifier you send sits in the provider’s systems under its retention terms. Tokenizing first means far fewer identifiers ever leave.
That depends on who runs it. When Protecto hosts or manages the service, or can access your instance for support, upgrades or monitoring, Protecto is a business associate and signs a BAA before any PHI flows. When Protecto runs in your environment with no Protecto access, Protecto does not receive PHI and is not a business associate.
Yes. Protecto supports HIPAA Safe Harbor by removing the identifiers it detects in text, including those inside clinical sentences, with no mapping kept. Whether a data set meets Safe Harbor, including the actual knowledge test, is your expert’s or counsel’s call.
Bring a sample of clinical notes. We will show what the model receives, what stays with you and what the log records.
