Redact personal details from records MEDISCRUB

What it masks, and what it deliberately keeps

The identifiers go and the clinical meaning stays. That is the whole design: a record with every value replaced is no use to the colleague, supervisor, insurer or researcher you were trying to share it with.

• Masked: names, addresses, postcodes, phone numbers, email addresses, NHS and Medicare and insurance numbers, hospital and practice record numbers, policy and claim references, and national identifiers.
• Kept: the diagnosis, the findings, the medication and dose, the procedure, the wording of the clinician's reasoning.
• Your choice: dates. Off by default because a date is frequently clinically meaningful (the interval between an onset and a presentation is often the point) and simultaneously one of the strongest identifiers in a record. Nobody else can make that call for your document.

Why masking is not anonymising

Worth being blunt about, because the words get used interchangeably and they are not the same thing.

Removing the direct identifiers leaves a record that is de-identified, not anonymous. A rare diagnosis, an unusual procedure, an age, a hospital and a month between them re-identify a person far more often than people expect, and the smaller the population the easier it gets. A single case in a district is identifiable to anybody who works there whatever you masked.

So this reduces risk; it does not remove it, and it is not a safe-harbour determination or a legal opinion. If the record is leaving your organisation under a rule (research, a subject access request, a court), the rule decides what is required and this tool does not know what the rule says.

Read it before you send it

Pattern matching finds what has a shape. It does not find a name in a sentence that no list contains, a nickname, an initial, an employer, or "the patient's daughter who works at the school", and free text is where those live. Read the masked version through once, as a stranger would, looking for anything that would let you place the person.

And the letterhead is part of the disclosure: a letter from a named specialist service says what it is about before a word of the text is read. For a PDF rather than text you can paste, SEAL rebuilds the page from pixels so nothing survives under the boxes, and sending a medical letter covers who is entitled to what.