Formats
- Text as JSONL with character offsets for every change
- PDFs and images re-rendered with burned-in redaction
- Audio as WAV or FLAC with silenced spans and aligned transcripts
Keep the story in the record. Take out the people in it.
We remove or replace names, numbers, dates, and voices across clinical notes, claim files, transcripts, scanned forms, and call audio, so the reasoning in the record survives and the identities don't. Every delivery reports recall measured on a hand-labeled sample of your own records, not a vendor's benchmark.
Redaction that destroys the record is barely better than none
There are two ways to get this wrong. Miss identifiers, and you have a privacy incident inside a training set that may be copied, fine-tuned on, and shipped. Redact bluntly, and you get pages of black bars and generic tags: the model can no longer tell the patient from the daughter who called, or learn that the second fall happened three days after discharge.
We aim for the record a careful privacy officer would sign off on and a clinician or adjuster could still learn from. Identifiers are replaced with realistic, consistent surrogates: the same person gets the same invented name in every document in the case. Dates shift by a fixed offset per person, so intervals stay true. Locations are generalized only as far as the chosen method requires.
The work happens inside your tenant or on your premises, by an employed, US-based team working under a business associate agreement when the data is protected health information.
Two routes under HIPAA, and what each costs the model
The HIPAA Privacy Rule allows two de-identification methods. The right one depends on what the model needs to learn. Benner House is not a law firm and does not provide legal advice; your privacy officer and counsel choose the route, and we implement and measure it.
Safe Harbor
- Removes 18 listed types of identifiers, for the individual and for relatives, employers, and household members
- Reduces dates to the year and groups all ages over 89 into one category
- Keeps three-digit ZIP prefixes only where that area holds more than 20,000 people
- Predictable and easy to audit
- Strips the timing and geography many clinical and claims models depend on
Expert Determination
- A qualified expert applies statistical methods and documents that re-identification risk is very small for the anticipated recipient
- Can keep shifted dates, finer geography, or other fields when the analysis supports it
- Specific to a data set, a recipient, and an environment
- A better fit when intervals, seasons, or regions carry the signal
- We prepare the data and run the measurements the expert asks for; an expert you engage makes the determination
The pilot at a glance
You provide
- Up to 25,000 documents or 500 hours of transcripts or audio
- Your redaction policy, or the HIPAA method and identifier list to apply
- Data dictionaries or field maps for any structured columns
We deliver
- Redacted or pseudonymized records in their original structure
- A surrogate map kept in your environment, if you need to re-link records later
- Recall and precision by identifier type, measured on a hand-labeled sample
- A residual-risk memo: what the pipeline handles poorly and how those records were routed
Quality gates
- Recall measured on at least 1,000 hand-labeled records before the full run
- Two independent annotators on the labeled sample, with disagreements adjudicated
- Low-confidence spans routed to a human reviewer
- Surrogate consistency checked across every document in a case or account
Turnaround
Four weeks, including the hand-labeled sample
Team
A privacy engineer, an annotation lead, and US-based reviewers working under a BAA for health data
Starts at
$8,900
Up to 25,000 documents or 500 hours of transcripts redacted or pseudonymized, with recall measured on a hand-labeled sample.
How the pipeline works
Detect with more than one method
Pattern rules catch structured identifiers: Social Security, medical record, policy, and account numbers in their many formats. A named-entity model tuned on your document types catches names, places, and organizations. A context pass catches what both miss, like "the patient in bed 4 whose husband runs the feed store."
Apply the policy per identifier type
Each type is removed, replaced with a surrogate, generalized to an age band or a ZIP prefix, or date-shifted by a consistent per-person offset. The policy is a versioned file, so every output can be traced to the rules that produced it.
Replace consistently
Surrogates are realistic and correctly formatted, so a model doesn't learn that names look like tags. One real person maps to one surrogate across the whole case, and we check that no surrogate collides with a real name elsewhere in the corpus.
Handle scans and audio on their own terms
On scanned forms we redact the image at each word's bounding box, then confirm the image and its OCR text agree, including handwriting in margins. For audio we align transcripts to timestamps and silence identifying spans. A voice can identify a speaker on its own, so when the voice itself is the risk we discuss transcript-only delivery.
Measure, then report the misses
Two annotators label every identifier in a sample of at least 1,000 records. We report recall and precision per identifier type, and we show you the actual misses, because a missed street address and a missed medical record number are not the same risk.
Standards we hold this work to
Self-imposed and written into our statements of work.
1,000+
hand-labeled records per recall sample
Recall is measured on your records before the full run, and again on the output.
2
independent annotators on the sample
Disagreements are adjudicated by a senior reviewer, so the ground truth itself is checked.
30 days
to delete client data after close
With a written deletion record. Surrogate maps stay in your environment, not ours.
72 hours
contractual incident notice
If a security incident touches your data, you hear from us within 72 hours.
Pilot pricing
De-identification pilot
Starts at
$8,900
Up to 25,000 documents or 500 hours of transcripts redacted or pseudonymized, with recall measured on a hand-labeled sample.
Request a scoped quoteProduction volumes are priced per document or per audio hour once the pilot has measured your mix. Business associate agreements are available for protected health information.
Questions about de-identification
Once records are de-identified, can we send them to any model vendor?
De-identification lowers the risk, but it doesn't end the analysis. Residual risk is never zero, and the vendor's terms on retention and training use still matter. We give your privacy and legal teams the measurements; they decide where the data may go.
Why do you emphasize recall over precision?
We report both, but they fail differently. A missed identifier is a disclosure. An over-redacted word costs a little model quality. We tune the pipeline with you to the recall your policy requires, then recover as much precision as we can at that level.
Can a large language model do the redaction?
It can be one detector in the ensemble, run inside your environment; we don't send identifiable data to outside APIs. It is measured on the same hand-labeled sample as every other method, and it earns its place only if it improves recall.
Do you keep the link between real and surrogate identities?
Only if you need it, and only in your environment, encrypted and under your access controls. Codes we assign are random rather than derived from anything about the person. If you don't need re-linking, no map is kept at all.
Do you handle financial and legal records, not just health data?
Yes. The pipeline is the same with a different identifier list: account and card numbers, policy and claim numbers, case numbers, driver's license numbers, and the names of parties and witnesses.
Keep reading
Bring us one messy data source and one question.
Tell us what the data is and what you want a model to do with it. A data engineer, not a salesperson, will reply within one business day with questions and a proposed first step.