Redacting Medical Records: Removing PHI from Scanned Documents

Redact Medical Records: Remove PHI from Scanned Health Documents

Medical records contain the most sensitive personal data possible. Improper redaction of scanned health records, specifically adding a black rectangle on top of a PDF while leaving the underlying text layer intact, is one of the most frequently cited HIPAA violations in civil enforcement cases¹. The OCR Redactor exports raster images with no underlying text layer, eliminating this specific risk category from any document it processes.

Processing happens entirely in the browser. No file leaves your device at any point during OCR or redaction. For healthcare professionals, compliance staff, and patients requesting copies of their records before sharing them with third parties, this zero-upload approach removes the need for a business associate agreement with any tool vendor.

What PHI requires redaction in scanned records

HIPAA's Safe Harbor de-identification method defines 18 protected health information identifiers that must be removed before a health document can be shared without patient authorization². These include name, address, all date elements more specific than year except for ages over 89, phone numbers, fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate or license numbers, vehicle identifiers, device identifiers, URLs, IP addresses, biometric identifiers, full-face photographs, and any other unique identifying number or code.

Systematic page-by-page identifier review

Scanned records often contain all 18 identifier categories across multiple pages. Consequently, drawing redaction rectangles over each identifier in the image removes the corresponding words from the exported text file simultaneously. CapyToolkit's OCR Redactor processes each page individually, so you can methodically work through a multi-page record one sheet at a time, confirming every identifier category is covered before moving to the next page.

Why standard PDF redaction fails for medical records

Most PDF editors that offer a redaction feature add an opaque rectangle to the visual layer of the document. Yet the text layer remains intact in the PDF structure¹. Opening the redacted PDF in a text editor or using a PDF parser extracts the covered text in seconds. Several publicized HIPAA breaches resulted directly from this type of improper redaction. Building on this documented failure pattern, the safe approach for any health record shared outside a covered entity is a flat raster image that contains only pixels, no text layer, no metadata carrying patient identifiers, and no structure that any parser can traverse to recover covered content.

Workflow for medical record redaction

Scan or photograph the medical record and export it as a JPEG or PNG. Drop it onto the OCR Redactor drop zone. After OCR completes, draw rectangles over each of the 18 PHI identifiers visible in the scan. Pay particular attention to small-font identifiers in page headers, footers, and patient ID boxes that OCR may have partially missed. Visually inspect the redacted image before exporting to confirm no identifiers remain visible. Export using Download PNG, which produces a clean raster image. Yet the tool is a technical aid; organizational HIPAA compliance requires documented policies, staff training, and audit trails beyond what any single tool provides. Document each redaction decision for your compliance records.

HIPAA's two de-identification methods and their document requirements

HIPAA's Privacy Rule at 45 CFR §164.514(b) provides two recognized paths to de-identification³. Safe Harbor requires removing all 18 enumerated identifiers and any other information the covered entity has reason to believe could identify the individual. Expert Determination allows a qualified statistician to certify that re-identification risk is very small, without necessarily removing all 18 identifiers, provided the analysis is documented and retained.

Safe Harbor identifier categories for document redaction

The 18 Safe Harbor identifiers include names, geographic subdivisions smaller than a state, dates other than year for individuals over 89, telephone and fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate or license numbers, vehicle identification numbers, device serial numbers, URLs, IP addresses, biometric identifiers, full-face photographs, and any other unique identifying code. When redacting a medical record scan, walk through each category systematically before export. A single missed identifier such as a fax number in a page header or a beneficiary number in a routing field means the document does not meet Safe Harbor standard.

Multi-page medical record redaction and final document assembly

Medical records frequently span multiple pages: a face sheet, physician notes, lab results, and a discharge summary may each be a separate scanned page. Export each page as an individual PNG from the OCR Redactor after completing all redactions, using a consistent naming convention such as patient_record_p01.png and patient_record_p02.png so pages assemble in order.

Assembling redacted pages into a single PDF

After exporting all pages as PNGs, bundle them into a single PDF using a local tool. ImageMagick's convert command accepts a glob of PNG filenames and produces a multi-page raster PDF in filename sort order. Alternatively, macOS Preview accepts multiple PNGs dragged into the thumbnail sidebar and exports a PDF via File > Export as PDF. The resulting PDF contains only raster image data with no searchable text layer, preserving the redaction guarantee established by each individual OCR Redactor export.

Assembling locally preserves the privacy benefit of the per-page redaction. CapyToolkit's OCR Redactor keeps each page a flat raster image, so the combined PDF carries no recoverable text layer even after you merge the pages into one file, the approach behind redacting PHI one scanned page at a time. Choose whichever bundling tool you already trust on your machine, because the merge step introduces no new upload and never sends the pages to a remote server. The redaction guarantee therefore holds through to the final shared document.

When to use this

Use this tool when disclosing health records in response to legal requests, when sharing records for research under a limited data set authorization, or when preparing de-identified records under the Safe Harbor method.

Examples