Protecto replaces patient names, record numbers and member IDs with tokens before a prompt reaches any model. Real values come back only for staff your policy allows.
SOC 2 Type II · ISO 27001 · HIPAA, BAA available
The care manager asks
Summarize the last three visits for Grace Whitfield, MRN 4471-209-88, born 03/14/1949, and draft a check-in message.
The model receives
Summarize the last three visits for <PERSON>Hv8Np3</PERSON>, MRN <MRN>7730-185-42</MRN>, born <DATE_OF_BIRTH>09/02/1953</DATE_OF_BIRTH>, and draft a check-in message.
The care manager sees
Grace Whitfield had three heart failure follow-ups since August. Draft: “Hi Grace, checking in after your last visit…”
Use a privacy layer between your clinical data and the AI model. It finds patient identifiers in each prompt, file and retrieved record, swaps them for tokens before the text leaves your environment, and puts real values back in the answer only for people allowed to see them. Protecto is built for this job. It works with any model, including ChatGPT, Gemini, Claude or a model you host.
Every prompt, uploaded document and retrieved record passes through Protecto before it reaches the model.
Names, MRNs, member IDs, dates, phone numbers and other supported identifiers, including those written inside clinical sentences.
The same patient gets the same token every time, so the model can follow one person through a chart.
Diagnoses and medications your policy leaves readable stay in the text, so answers stay useful.
Real values return only for roles your policy allows, and each reveal is logged. Everyone else, and the model provider, sees tokens.
Inovalon built a secure, HIPAA-compliant analytics product on sensitive healthcare data with Protecto
Documents Inovalon tested in under a week
Entity types across PII, PHI and PCI, plus custom entities
Than AWS Comprehend and Microsoft Presidio in the UT Dallas benchmark
“Protecto enabled our team to harness the full power of AI and analytics while maintaining strict HIPAA compliance and data privacy.”
A nurse in a care management team asks the hospital’s AI assistant to summarize a patient’s last three visits and draft a check-in message. The assistant pulls the visit notes and sends them to a hosted model. Each note carries the patient’s name, date of birth, MRN and phone number inside ordinary sentences. All of it reaches the model provider, and copies sit in prompt logs and the assistant’s chat history.
The EHR controls who opens a chart. It does not see what an AI assistant does with the text afterward. Redacting every identifier stops the leak but breaks the work: the summary reads “[REDACTED] was seen on [REDACTED]”, and the assistant can no longer tell two patients apart.
This is the PHI exposure problem in AI answers: the data must stay private, and the answer must still make sense.
Name, date of birth, MRN and phone number sit inside ordinary clinical sentences, not in labeled fields.
The hosted model, its prompt logs and the assistant’s chat history each keep a copy of the text.
Without a policy on the answer, the care manager and a reviewing analyst see the same patient details.
Four common choices, compared on what reaches the model provider and what staff get back.
| Approach | What the model provider receives | Answer quality | Real values back for allowed staff |
|---|---|---|---|
| Send PHI under the model provider’s BAAOpenAI API or Azure OpenAI with a signed BAA | Real PHI, under contract | Full | Yes, for everyone who can use the tool |
| Redact or de-identify firstAzure Health Data Services de-identification, Amazon Comprehend Medical, Microsoft Presidio | Redacted text or surrogates | Varies by tool and setting. Blanket redaction loses who-is-who. | No reveal by role. You build and secure any re-identification yourself. |
| Host a model inside your own network | Nothing leaves, but PHI reaches the model, its logs and every connected tool | Depends on the model you can run | Yes, with no per-role control unless you build it |
| Protecto in the path, with any model | Tokens only | Kept. Consistent, format-preserving tokens keep who-is-who. | Yes, by role, with each reveal logged |
A BAA governs what a provider may do with PHI. It does not stop PHI reaching the provider. Many teams use both: a BAA where counsel requires it, and tokens so far fewer identifiers ever leave.
Based on each vendor’s public documentation, November 2026. Detection accuracy: an independent UT Dallas and DataXpert benchmark measured a higher F1 for Protecto than for AWS Comprehend and Microsoft Presidio.
Protecto sits between your clinical data and the model. It checks what goes in, what tools receive, and what comes back.
Messages, uploaded documents and passages retrieved from EHR exports or document stores are scanned. Each identifier becomes a token before the text leaves your environment.
You choose what is masked. Names, MRNs and member IDs are tokenized. Diagnoses and medications can stay readable, so the clinical meaning survives.
When the assistant calls a system that needs the real value, such as a claims lookup, Protecto resolves the token at the tool boundary for an authorized user.
Real values are restored for roles your policy allows. Other roles see tokens. Each reveal is logged.
The representative types
Summarize open claims for Daniel Reyes, member ID HB-44718-02, born 02/11/1961, and draft a reply about the denied MRI.
The model receives
Summarize open claims for <PERSON>Lm4Tq8</PERSON>, member ID <HEALTH_BENEFICIARY_NUMBER>QW-81530-77</HEALTH_BENEFICIARY_NUMBER>, born <DATE_OF_BIRTH>07/23/1958</DATE_OF_BIRTH>, and draft a reply about the denied MRI.
The answer, by role
Hi Daniel Reyes, we reviewed the denied MRI claim on member ID HB-44718-02. Here is what happens next…
Hi <PERSON>Lm4Tq8</PERSON>, we reviewed the denied MRI claim on member ID <HEALTH_BENEFICIARY_NUMBER>QW-81530-77</HEALTH_BENEFICIARY_NUMBER>. Here is what happens next…
Unmasked: this role handles the member’s claim. The reveal is logged.
Stays masked: this role reviews the reply, not the member.
Everyone else in the flow
The same member gets the same token in every prompt and session, so the model can follow one case across a long conversation.
Yes, if identifiers are replaced before the data reaches the model and the mapping stays in your environment. For claims archives and EHR exports, Protecto runs in batch as well as in real time, so the same patient keeps the same token across millions of documents and search, summaries and analytics still line up.
Case study
~750M
A healthcare data platform prepared about 750 million claims documents for AI. Broad redaction had made notes useless for search and summaries. Protecto Vault processes the archive in batches and logs every mask, reveal and access.
A healthcare insurer has also handled 50M+ records with Protecto.
Protecto’s asynchronous API processes large record sets. It also runs in data pipelines through a Snowflake UDF, Databricks, Kafka or Spark.
Claims tables, EHR exports, clinical notes, discharge summaries and call transcripts.
Reversible tokens for AI work where an approved team must re-identify. Identifiers removed with no mapping kept for analytics and training sets that must be de-identified. Whether a data set meets Safe Harbor or Expert Determination is your expert’s or counsel’s call.
Reviewers want to know which AI received which PHI, and why. Protecto logs each detection, mask and reveal, so your team can show which identifiers a flow touched, what each model, index and tool received, and who saw real values.
Tokenized PHI is pseudonymized, not de-identified, so it may still be PHI. Protecto reduces what reaches each recipient, and your counsel decides which agreements you still need.
HIPAA rule by rule for AI →
Healthcare AI by provider, payer and health tech →
Is redaction enough for HIPAA when using ChatGPT or an LLM? →
A BAA lets the provider handle PHI under contract. The PHI still reaches the provider and sits in its systems under its retention terms. With Protecto in the path, the provider receives tokens instead, and real values stay in your environment. Many teams keep the BAA as well.
It can be. Protecto’s default tokens are consistent and reversible by whoever holds the vault, which makes them pseudonyms, not de-identified data. For data sets that must be de-identified, Protecto can remove identifiers with no mapping kept.
That depends on who runs it. When Protecto hosts or manages the service, or can access your instance for support, upgrades or monitoring, Protecto is a business associate and signs a BAA before any PHI flows. When Protecto runs in your environment with no Protecto access, Protecto does not receive PHI and is not a business associate.
Protecto detects 50+ entity types across PII, PHI and PCI, including names, dates of birth, MRNs, health plan and beneficiary numbers, phone numbers, addresses and Social Security numbers, plus custom entities such as your member ID format. It finds them inside free text, not only in database columns.
Consistent, format-preserving tokens keep who-is-who intact, so the model can follow one patient through a note and across documents. Clinical facts your policy leaves readable, such as diagnoses and medications, stay in the text.
Yes. Staff chat runs through Protecto AI Privacy Gateway; applications and pipelines call Protecto Vault through its API. Protecto AI Privacy Gateway is designed to detect and mask supported entity-based sensitive data, including common personal, health, payment, account, government, and customer identifiers, before protected chat content reaches the model provider.
SaaS, on-premises, in your private cloud or air-gapped. Protecto is model agnostic: ChatGPT models, Gemini, Claude or a model you host.
Bring a sample of your clinical notes or claims. We will show what the model receives and what each role sees.
A third-party study compares how accurately Protecto, Microsoft Presidio, and AWS Comprehend find personal and health data in unstructured text.
By submitting you agree to Protecto’s privacy policy.
