Your health system has written millions of discharge summaries. A model could learn to draft the next one.
Clinical text is the richest training data most health systems own and the hardest to use. We de-identify it inside your environment, turn it into task-specific training and evaluation sets with your clinicians, and measure whether the model improved before it goes anywhere near a patient.
What is already in your systems
Every inpatient stay leaves a trail: admission H&P, daily progress notes, medication administration records, consults, and a discharge summary that tries to compress all of it into two pages. Behind the EHR sit other archives that rarely get counted as data at all: prior authorization letters and payer denials, faxed referrals scanned into document management, radiology and pathology reports, coding queries, patient portal messages, and contact-center recordings.
Most of it is free text, and that is where both the value and the risk sit. A discharge summary paired with the notes it was written from is a ready-made training example: the input a model would see, and the output a physician actually produced. It is also full of names, dates, record numbers and places.
HIPAA's Safe Harbor method lists 18 types of identifiers that must be removed, and HHS guidance is explicit that free-text fields are not exempt. So de-identification is not a step you add at the end. It decides which records can be used at all, and how much clinical meaning survives.
Where clinical AI projects start
Use cases we see most often in health systems, payers and life sciences teams, and the service that carries each.
Discharge-summary drafting
Pair de-identified source notes with the summaries physicians signed, filter for quality, and hold out a test set graded by hospitalists for omissions and invented medications.
Prior authorization and appeals
Under CMS's interoperability rule, Medicare Advantage, Medicaid and CHIP payers must answer expedited requests within 72 hours as of 2026. We parse payer policies and past letters into a retrieval index and a labeled set of denial reasons.
A de-identified clinical corpus
Pseudonymize notes with consistent surrogates and shifted dates so timelines survive, then measure recall on a hand-labeled sample your privacy officer can inspect.
Coding and documentation queries
Credentialed coders and CDI specialists score model-suggested codes and queries against the chart, producing rubric scores and preference pairs for tuning.
Evaluating ambient documentation tools
Before you sign with a scribe vendor, test it on your own encounters: a golden set, a clinician rubric, and a judge model calibrated against your physicians.
Contact-center and portal triage
Transcribe recordings and classify messages at volume inside your cloud, with nurse-reviewed labels for routing and urgency.
What you have, and what it becomes
Each row passes through the Six Gates; the third column shows where most of the effort goes.
| What you have | What it becomes | Where the work is |
|---|---|---|
| Discharge summaries with their source notes | Input–output pairs for a drafting model, plus a frozen test set of admissions graded by hospitalists | Protect and Label: date shifting that preserves the hospital course; physician grading |
| Prior-auth letters, denials and payer policies | A retrieval index over policy language and a labeled set of denial categories with the evidence each cites | Parse: scanned faxes, tables inside policy PDFs |
| Faxed referrals in document management | Field-extracted referral records with confidence scores and a human-review queue for low-confidence fields | Parse: handwriting, rotated pages, cover sheets |
| Radiology reports | Labeled findings and follow-up recommendations for classification and tracking models | Label: radiologist-written rubric for ambiguous findings |
| Portal messages | Triage labels for routing and urgency, reviewed by nurses | Clean: duplicates, auto-replies, proxy messages |
| Clinicians' edits to AI drafts | Preference pairs and error categories for the next round of tuning | Prove: tracking whether edits shrink release over release |
HIPAA, Part 2 and the other rules around clinical AI
We work as your business associate under a business associate agreement, inside your environment by default. HIPAA allows two de-identification methods, Safe Harbor and Expert Determination (45 CFR 164.514(b)); we implement either and report measured recall, but the choice of method, and any expert determination, belongs to you and your privacy officer.
Substance use disorder treatment records may fall under 42 CFR Part 2, which restricts their use and disclosure separately from HIPAA. We flag and segregate those records during the Source gate. If a model will support patient care decisions, the Section 1557 rule at 45 CFR 92.210 gives covered entities an ongoing duty to make reasonable efforts to identify tools that use race, color, national origin, sex, age or disability as inputs; our evaluation reports break results out by those variables when a tool uses them. State privacy and medical-records laws can add more.
Benner House is not a law firm and does not provide legal advice.
Questions from health systems
Will you sign a BAA?
Yes. We sign business associate agreements for any engagement that touches PHI, and our default is to work inside your environment so the agreement covers access rather than transfer.
Can free-text notes be de-identified well enough to train on?
Often, yes, but you should decide on evidence. We measure redaction recall on a hand-labeled sample of at least 1,000 records that was not used to tune the redaction rules, report it by identifier type, and show you every miss. If you need Expert Determination, we prepare the documentation your chosen expert will ask for.
Who reviews clinical outputs?
Licensed clinicians from our expert network, matched to the task: hospitalists for discharge summaries, nurses for triage, credentialed coders for coding queries, pharmacists for medication questions. Each works to a written rubric, and at least 10% of every batch gets a second reviewer.
Does any data leave our environment?
Not by default. We work through named accounts in your tenant or on a workstation at your site. Our reports contain counts, scores and short excerpts you approve, never bulk copies of records.
Do you work with life sciences companies?
Yes. Protocols, case report forms, clinical study reports and adverse-event narratives raise the same parsing, de-identification and expert-review problems, with a different set of reviewers.
Related services and reading
Bring us one messy data source and one question.
Tell us what the data is and what you want a model to do with it. A data engineer, not a salesperson, will reply within one business day with questions and a proposed first step.