Keep patient data on the clinician's device.
Redact notes, records, and dictation before they are shared or fed to AI.
Where sensitive data leaks out
Clinical notes, referrals, and billing records are dense with protected health information. When staff paste them into online tools to save time, that data leaves systems the practice can audit.
Omit apps for healthcare
De-identification is a defined standard, not a judgement call
HIPAA does not ask you to remove whatever looks sensitive. It gives two named routes to de-identified data, and knowing which one you are on matters more than how thorough the redaction feels. Safe Harbor, set out at 45 CFR 164.514(b)(2), is a checklist: strip eighteen specified identifiers and confirm no remaining information could identify the individual. Expert Determination is the alternative, where a qualified statistician certifies that the re-identification risk is very small and documents the methods used. Safe Harbor is mechanical and auditable. Expert Determination preserves more analytical value, which is why research teams reach for it when Safe Harbor would strip the detail the study depends on.
The eighteen identifiers are enumerated, not inferred
Names, geographic subdivisions smaller than a state, contact details, account and record numbers, biometric identifiers, full face photographs and more. Omit maps entity types onto this list directly, so the policy can be set once and applied consistently rather than re-decided per document.
Dates are removed except the year
Safe Harbor strips all date elements more precise than a year, including admission, discharge and date of birth. Omit ships a YEAR_ONLY operator for exactly this: it reduces 14 March 1978 to 1978 rather than deleting the field, so the record stays analytically useful and Safe Harbor compliant at once.
Geography stops at the three digit ZIP, and only sometimes
Subdivisions smaller than a state come out. The three digit ZIP prefix may stay only where that area holds more than twenty thousand people, and must be zeroed where it does not. This is the rule teams most often get wrong, because it looks like a formatting choice rather than a threshold test.
The documents this actually applies to
Clinical notes and discharge summaries
PERSON, DATE_OF_BIRTH, MEDICAL_RECORD_NUMBER, ADDRESS, PHONE
The hardest category, because identifiers sit inside running clinical prose rather than in structured fields. A patient can be named in the history, again in the plan, and once more as a relative. Consistent pseudonymisation matters here: the same person should become the same token throughout, or the note stops making clinical sense.
Research and secondary use datasets
All eighteen Safe Harbor identifiers, dates reduced to year
Where the choice between Safe Harbor and Expert Determination actually bites. Safe Harbor is faster to defend and needs no statistician, but it removes granularity a longitudinal study may require.
Billing, claims and insurance correspondence
PERSON, POLICY_NUMBER, IBAN, ADDRESS, national ID numbers
Financial identifiers sit alongside clinical ones, and the file is routinely emailed to a payer. Redacting before it leaves the practice is far easier than retrieving it afterwards.
Dictation and consultation recordings
PERSON, ADDRESS, spoken dates and identifiers
Clinicians say identifiers aloud without thinking, because dictation is a clinical act rather than a records one. Omit Voice transcribes on the device and redacts the transcript, so the audio never needs to reach a cloud transcription service.
Safe Harbor applied to a clinical line
Before
Mrs Eleanor Prentice, DOB 14 March 1978, MRN 4471902, of 22 Fielding Road, was admitted on 3 June 2026 with atrial fibrillation.
After
[PERSON_1], DOB 1978, MRN [MRN_1], of [ADDRESS_1], was admitted in 2026 with atrial fibrillation.
The diagnosis survives untouched, because a condition is not an identifier. The dates are reduced to years rather than deleted, which is what Safe Harbor requires and what keeps the record useful for audit and research. Note that this is de-identification, not deletion: the clinical content is the point of the record and it is still there.
Evidence that the checklist was applied
Safe Harbor is a standard you have to be able to demonstrate you met, not merely one you intended to meet. Every Omit run writes a report listing each detection, its identifier type and the operator applied. Read against the eighteen categories, that report is the working paper showing which identifiers were found and what was done with each. It is produced automatically at the time of the run, which is materially more defensible than a reviewer attesting afterwards that they were careful.
What records teams ask first
Further reading
- The 18 HIPAA Identifiers and Safe Harbor
Safe Harbor is a list of eighteen things to remove, and three of them are partial rather than deletions: dates keep the year, ages over 89 collapse into one bucket, and the three-digit postal prefix survives only where the area is large enough. Here is the full list, the other route, and an honest account of which identifiers Omit finds.
- What Is PII? Definition, Examples, PII vs PHI
PII means information that identifies a person, but four different laws draw that line in four different places, and the same email address can be in scope under one and arguable under another. Here is each definition, what counts as an example of each, and where PII ends and PHI begins.
- How to Redact PII From Images
Omit redacts PII inside PNG, JPEG, TIFF and BMP files the same way it redacts documents: OCR reads the text, the same detector finds the PII, and the matching regions get blacked out in the image itself, entirely on your machine.
- How to Unredact a PDF, and How to Prevent It
Most recovered redactions come back the same trivial way, because a black rectangle is a drawing and the text is still underneath it. Here is why it happens, how to tell which kind you are holding, and what actually removes a value.
Because detection and redaction never touch the network, protected health information stays on-device, which supports HIPAA-minded handling and GDPR obligations. Omit is candid about what is certified versus inherent by design.