Local de-identification
PHI Scrubber
Patient note input
Paste a note or upload a .txt file.
Scrubbing occurs locally in your browser. No text is sent to a server.
De-identified output
Scrubbed note ready to copy or download.
Created and maintained by Yasmine Abbey, MD, MSc · Last reviewed:
Educational decision-support for clinicians. Not medical advice — verify all outputs against your clinical judgment, institutional protocols, and current guidelines.
How this PHI scrubber de-identifies a note
The PHI Scrubber removes protected health information from clinical text entirely inside your browser. Paste a note or upload a .txt file, press Scrub, and the de-identified version appears beside it, ready to copy or to download as .txt, .docx, or .pdf. No text is sent to any server: the page works with the network disconnected, and nothing is stored.
It exists for the everyday reasons clinicians need de-identified text — a teaching case, a morbidity and mortality presentation, a question to an AI tool, a research abstract, a quality-improvement review — and it is the same engine that de-identifies notes before inReview reads them.
What gets removed and what gets shifted
- Hard redaction: patient and relative names (replaced with [REDACTED_NAME]), medical record numbers, account and SSN-style numbers, phone and fax numbers, email addresses, street addresses and ZIP codes, and other direct identifiers from the HIPAA Safe Harbor list.
- Date shifting: dates are not deleted. Every date is moved by the same random offset for the session, so intervals ('creatinine rose over 3 days', 'PCI 6 weeks ago') stay correct while the real dates of service are hidden.
- Provider and facility names are handled the same way as patient names, because a named attending plus a date can re-identify a patient.
- Clinical content — diagnoses, medications and doses, lab values, vital signs, imaging findings — is left intact. The scrubber is tuned to tell a dose ('25 mg') from an address number and a lab date from a birthday.
Why it runs in the browser
Most de-identification services require you to upload the identified note first, which is itself a disclosure. Here the detection and replacement run as JavaScript on your device: the page can be loaded, the network turned off, and the scrub still works. That is also why there is no account and no history. If you refresh the page, the text is gone.
What a pattern-based scrubber can and cannot catch
The scrubber finds identifiers by patterns and context — a capitalized name after 'Mr.', a ten-digit number labeled MRN, a date in any common format. It does not understand meaning. It can miss a name used without a title in the middle of a sentence, a rare identifier format, or free-text details that identify a patient without being an identifier (a one-of-a-kind occupation, an unusual combination of events). It can also over-redact: an eponymous disease or drug name that looks like a surname may be replaced. Always read the output before you use it. For research datasets or regulated disclosures, a reviewed, validated de-identification process is required; this tool is a workflow aid, not a certification.
Using the output
Copy the scrubbed text, or download it as .txt, .docx, or .pdf. The placeholders are deliberately visible ([REDACTED_NAME], [REDACTED_MRN]) so that a reader knows something was removed rather than reading an incomplete sentence. If you are preparing text for inReview, you do not need to scrub it first — inReview runs the same scrubber automatically — but doing so lets you check the result before it is sent.
Frequently asked questions
Does the PHI scrubber send my note anywhere?
No. Detection and replacement run in your browser. You can load the page, disconnect from the network, and the scrub still works. Nothing is stored, and there is no account.
Which identifiers does it remove?
Names of patients and relatives, medical record and account numbers, SSN-style numbers, phone and fax numbers, email addresses, street addresses and ZIP codes, and provider and facility names. Dates are shifted by a random per-session offset rather than deleted, so the clinical timeline stays intact.
Is the output HIPAA de-identified under Safe Harbor?
It is designed around the Safe Harbor list of identifiers, and date shifting is a recognized technique for preserving intervals. But no automated tool guarantees that a note is de-identified: free-text details can still identify a patient. Review the output and follow your institution's policy before any disclosure.
Why are dates changed instead of removed?
Because intervals carry clinical meaning. 'Creatinine 1.1 on day 1 and 2.4 on day 3' is useful; 'creatinine 1.1 on [DATE] and 2.4 on [DATE]' is not. Shifting every date by the same offset keeps the timeline while hiding the real dates of service.
Can I use this to prepare a note for ChatGPT or another AI tool?
That is one of its main uses. Scrub first, read the output, then paste the de-identified text into the AI tool. Remember that an AI tool's own privacy terms still apply to whatever you send it.
Does it work on PDFs or Word documents?
The standalone scrubber accepts pasted text and .txt uploads, and downloads the result as .txt, .docx, or .pdf. inReview accepts .pdf and .docx directly and runs the same scrubber on them, including browser-side OCR for scanned PDFs.
What does it get wrong?
It can miss names used without a title mid-sentence, unusual identifier formats, and identifying free-text details; it can over-redact eponyms or drug names that look like surnames. Always read the output.
References
- U.S. Department of Health and Human Services. Guidance regarding methods for de-identification of protected health information in accordance with the HIPAA Privacy Rule.
- Meystre SM, Friedlin FJ, South BR, Shen S, Samore MH. Automatic de-identification of textual documents in the electronic health record: a review of recent research. BMC Med Res Methodol. 2010;10:70.
- scopeMD Patient Privacy & PHI De-Identification Policy.