HIPAA De-identification for LLM Training

The most valuable text a health system owns is written by clinicians: discharge summaries, progress notes, operative reports, prior-authorization letters. It's also protected health information. Before those notes train a language model outside the narrow uses HIPAA permits for PHI, many organizations want them de-identified, and the Privacy Rule offers two ways to get there under 45 CFR 164.514(b): Safe Harbor and Expert Determination.

Both were designed for tables and data extracts. Language models change two things. The data is free text, where identifiers hide in sentences rather than columns. And the recipient is a model that can memorize: Carlini and colleagues extracted hundreds of verbatim training sequences from GPT-2, including names, phone numbers and email addresses, some present in a single document. What follows describes how each method works on clinical text. Which route fits your program is a decision for your privacy officer and counsel.

What each route requires

	Safe Harbor	Expert Determination	Limited data set
Standard	Remove 18 identifier types for the patient and their relatives, employers and household members, with no actual knowledge that what remains could identify anyone	A qualified expert finds the risk "very small" that an anticipated recipient could identify someone, and documents the methods and results	PHI with 16 direct identifiers removed
Dates	Year only; ages over 89 grouped as 90 or older	Whatever the expert's analysis supports	May remain
Geography	State; first three ZIP digits only if that area holds more than 20,000 people	Whatever the analysis supports	Town or city, state and ZIP may remain
Result	De-identified; no longer PHI	De-identified; no longer PHI	Still PHI: data use agreement required, uses limited to research, public health and health care operations

HHS guidance adds two points that matter for planning. There is no explicit numerical level of risk that universally counts as "very small"; the expert defines it for the recipient and environment. And the rule attaches no expiration date to a determination, though HHS notes that some practitioners issue time-limited determinations because the data available for linkage keeps changing.

Free text is where Safe Harbor gets hard

Safe Harbor reads like a checklist, and on a claims extract it nearly is one. On notes it isn't. HHS is explicit that the standard makes no distinction between structured fields and free text: a listed identifier has to come out wherever it is recognizable, including mid-sentence in a nursing note.

The actual-knowledge clause reaches further. HHS's own example is a note recording that the patient is the executive vice president of the state university; that detail must be removed even though job titles aren't on the list of 18. Clinical narratives are full of these: the county's only large-animal veterinarian, a patient whose son is the sheriff, a rare diagnosis in a town of 900. The guidance also flags plain ambiguity, asking whether "5/97" is a date or a ratio.

Dates are where Safe Harbor costs the most for model training. Keeping only the year turns "admitted 3/14, discharged 3/19, readmitted 4/2" into three mentions of the same year. Length of stay and time to readmission vanish, and for a model learning to summarize a hospital course, time is the plot. Quasi-identifiers are why the rule is strict: HHS cites an estimate that date of birth, sex and five-digit ZIP code together are unique for over 50% of U.S. residents.

Recall is never 100%, so count what's left

Every de-identification pipeline misses something, so the useful question is how much. Philter, an open-source tool built for clinical notes, reported 99.46% recall on a UCSF test corpus at 78.28% precision. That is strong performance, and it still leaves a residue worth computing.

Take an illustrative corpus of 2 million notes averaging 25 PHI tokens each: 50 million PHI tokens. At 99.46% recall, about 270,000 remain. At 99.9%, about 50,000 remain. Each one sits in text a model may memorize. The precision figure has a cost too: about 22 of every 100 tokens removed weren't PHI, and in clinical text those are often drug names and eponyms the model needed.

Measure recall on your own notes, not a benchmark. We hand-label a sample of at least 1,000 records before any redaction run ships and report recall by identifier type, because names, dates and contextual details fail differently. Bootstrap the confidence interval by note rather than by token; misses cluster in the same templates and the same authors.

Surrogates help with what slips through. Replacing detected identifiers with realistic fakes, rather than with tags like [NAME], makes a leaked real name hard to tell from the fakes around it. A pilot of this "hiding in plain sight" approach concealed approximately 90% of residual identifiers. A later study is the necessary caution: an attacker who trained their own tagger on half of a resynthesized corpus correctly flagged 68% of real leaks. Surrogates reduce exposure; they don't replace recall. For training data they have a second benefit if applied consistently: the same patient keeps the same fake name throughout a record, so the model doesn't learn that names change mid-note.

What changes when the recipient is a model

Duplication drives memorization. Kandpal and colleagues found that a sequence appearing 10 times in training data is generated about 1,000 times more often than one appearing once. Clinical documentation copies forward, so a missed identifier inside a copied block can appear in dozens of notes for the same patient. Collapsing copy-forward blocks before training cuts exposure and improves the data.

Architecture matters as well. Lehman and colleagues found that simple probes could not meaningfully extract patient names and conditions from a BERT model trained on MIMIC-III notes, while cautioning that more sophisticated attacks might. A generative model differs from a masked encoder in the way that counts here: it emits text.

Expert Determination asks about an anticipated recipient, and for a model that question becomes who can query it, and how. Clinicians behind single sign-on with logged prompts, a patient-facing chatbot, and weights handed to a vendor are three different risk environments for the same training set. HHS lists the methods an expert may apply: suppression, generalization and perturbation. Per-patient date shifting, a consistent random offset that preserves intervals, is a common form of perturbation. Re-identification codes are permitted under 164.514(c) if they aren't derived from information about the individual, and HHS allows cryptographic hashes under Expert Determination as long as the keys aren't disclosed.

How teams choose a route

Situation	Route teams commonly evaluate	Reasoning
Model or weights will leave the covered entity	Safe Harbor with consistent surrogates, sometimes with expert review on top	The recipient is open-ended, so a fixed standard is easier to defend
Internal model where intervals matter, such as hospital course or readmission	Expert Determination with date shifting and generalization	Keeps clinical time; risk assessed for a defined recipient
Research needing dates and geography	Limited data set under a data use agreement	Remains PHI with limited purposes
Model stays inside the covered entity or a business associate	Some organizations evaluate training on PHI as a permitted use	A question for counsel; de-identification still limits what a model can leak

Our de-identification and PII redaction work runs inside the client's environment with a business associate agreement in place, so the choice of route doesn't have to be made on the basis of where data can travel. More on the sector in our healthcare notes.

Record it so a reviewer can follow it

Whatever the route, write down what was done in a form an expert, an auditor or your own successor can check. An illustrative manifest entry:

dataset: discharge-summaries-2019-2025
route: expert_determination
recipient: "internal summarization model, SSO-gated, prompts logged, no weight export"
determination: { issued: 2026-04-20, review_due: 2027-04-20 }
detection:
  ensemble: [rules_v9, clinical_ner_v4]
  recall_sample: { notes: 1200, phi_tokens: 31840, recall: 0.9962, ci95: [0.9953, 0.9970], method: note_bootstrap }
  recall_by_type: { name: 0.9981, date: 0.9990, mrn: 1.0, address: 0.9874, contextual: 0.9640 }
transformations:
  names: surrogate_consistent_per_patient
  dates: shift_per_patient_days_uniform_minus180_plus180
  ages_over_89: grouped_90_plus
  zip: first3_or_000
dedup: copy_forward_blocks_collapsed
post_training_tests: [canary_extraction, membership_probe]

The contextual line is usually the weakest, which is why it gets its own number.

Checklist before notes become training data

Decide the route with your privacy officer and counsel, and write down the anticipated recipient of the model, not just of the dataset.
Inventory the identifier types present in your notes, including contextual ones: occupations, small-town references, rare conditions.
Measure recall on at least 1,000 hand-labeled records from your own corpus, by identifier type, with a note-level confidence interval.
Use consistent, realistic surrogates instead of tags, and treat them as a second layer, not a substitute for recall.
Choose date handling deliberately: year-only under Safe Harbor, or per-patient shifting under an expert's analysis.
Collapse copy-forward text and deduplicate before training.
Plant canaries and run extraction probes on the trained model before anyone outside the project can query it.
Keep the determination, the recall report and the transformation log with the dataset version, and schedule a review date.

HIPAA de-identification for LLM training: Safe Harbor vs. Expert Determination