HIPAA PHI Scrubber: Remove Patient Data Before AI

HIPAA PHI Scrubber: Remove Patient Data Before AI

PHI violations cost healthcare organizations millions. The average HIPAA breach fine exceeds $1.2 million¹, and OCR enforcement in 2026 has focused specifically on organizations that allowed PHI to reach AI tools without a Business Associate Agreement². A clinician pasting patient notes into ChatGPT for summarization is a HIPAA violation, unless the PHI is removed before the notes reach the AI provider's servers.

The scrubber removes identifiable health information fields before they leave your device. Because CapyToolkit is a local browser tool that never receives PHI, no BAA with CapyToolkit is needed, and the scrubbing step is HIPAA-neutral. Only the scrubbed, de-identified output reaches the AI provider, which then does not require a BAA for that specific content.

The 18 HIPAA Safe Harbor identifiers

HIPAA de-identification method requires removing 18 specific identifiers from patient data before it can be shared freely³. The scrubber detects and tokenizes 8 of these directly using pattern matching: email addresses, phone numbers including fax, Social Security Numbers, account numbers detected via IBAN patterns, IP addresses, device identifiers caught through JWT and credential detection, geographic subdivisions identified via internal domain detection, and certain health-system contact information embedded in clinical text. Furthermore, the scrubber catches credit card numbers validated by the Luhn algorithm and authentication tokens that appear in healthcare administrative data such as billing records and insurance forms. The remaining 10 HIPAA identifiers, including patient names, detailed geographic data, biometric identifiers, and most dates associated with care events, require manual review and removal since these do not follow predictable text patterns that regex can reliably detect.

Healthcare data types the scrubber covers

In healthcare workflows, the most commonly AI-assisted tasks involve clinical documentation, billing queries, and patient communication drafting. Clinical notes pasted for AI summarization often contain patient email addresses, phone numbers, and embedded SSNs from intake forms. Billing data includes insurance member IDs, credit card information for copay collection, and IBAN references for international healthcare providers. Building on this, staff emails and internal clinical system hostnames appear in IT tickets and helpdesk queries. The scrubber detects all these patterns, reducing the identifiable content before it reaches any AI provider.

Prior authorization documents deserve special attention because they combine diagnosis codes, medication names, and clinical justification narratives with the patient contact fields that make the document PHI. When a revenue cycle team uses an AI tool to draft or review a prior authorization letter, the scrubber removes the email, phone, and SSN fields while preserving the clinical codes and procedure descriptions that the AI needs to generate an accurate narrative. This selective removal keeps the document useful for AI assistance without transmitting the identifiers that create HIPAA exposure.

BAA requirements and local tools

A Business Associate Agreement is required with any vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity. CapyToolkit's scrubber does not receive PHI, as it processes text locally in your browser memory, and consequently no BAA with CapyToolkit is required for the scrubbing step. The AI provider you send scrubbed text to may still require a BAA if any residual PHI remains in the scrubbed output, so scrubbing before transmission reduces residual PHI exposure but does not guarantee complete de-identification under HIPAA's expert determination method.

How the scrubber avoids the BAA requirement

A cloud-based PII scrubbing service that receives your text on its servers is itself a business associate under HIPAA and requires a BAA before any PHI reaches its infrastructure. Understanding this distinction matters when healthcare organizations evaluate their AI tool chain and choose where to draw the BAA boundary, because the browser-based scrubber avoids the BAA requirement entirely by ensuring that PHI processing happens only within the clinician's browser tab. This architectural difference has direct implications for how covered entities manage their vendor risk and BAA negotiation workflows.

The 18 HIPAA Safe Harbor identifiers and which the scrubber addresses

HIPAA's Safe Harbor de-identification standard requires removing all 18 identifier categories before health data can be shared freely without a BAA³. The 18 categories are names, geographic subdivisions smaller than a state, all dates except year, phone numbers, fax numbers, email addresses, Social Security Numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate and license numbers, vehicle identifiers, device identifiers, web URLs, IP addresses, biometric identifiers (fingerprints, voiceprints), full-face photographs, and any other unique identifying number or code. The scrubber directly addresses 7 of these 18 through pattern detection: phone numbers, fax numbers, email addresses, Social Security Numbers, account numbers via IBAN detection, IP addresses, and device identifiers via JWT and API key detection.

The remaining 11 identifier categories, including names, geographic data below state level, dates, medical record numbers, health plan beneficiary numbers, certificate numbers, vehicle identifiers, URLs, biometric identifiers, and photographs, require manual review and removal before the scrubbed text meets Safe Harbor criteria. Meeting the full standard requires both the automated scrubbing pass and a careful human review of the output for these remaining categories. For clinical documents requiring Safe Harbor de-identification, use the scrubber first to remove the pattern-detectable fields, then manually review the output for names, dates, and geographic information.

Manually removing identifiers outside the scrubber's detection scope

A practical workflow is to layer manual redaction on top of the automated pass: replace patient names with initials, replace specific dates with the year only (admitting year 2026 instead of the exact admission date), and replace ZIP codes with the first three digits only. Three-digit ZIP codes represent populations large enough for de-identification in most US counties. After both the automated and manual steps, review the output against the 18-category checklist to confirm all identifiers have been addressed before sharing with any party that does not hold a BAA.

AI platforms with signed BAAs for healthcare workflows

Several AI providers offer signed Business Associate Agreements for healthcare organizations. Microsoft Azure Health AI services (including Azure OpenAI Service for Healthcare) provide a standard BAA through the Microsoft Online Subscription Agreement when Azure is purchased for healthcare use. AWS HealthLake and Amazon Comprehend Medical are HIPAA-eligible services covered under AWS's standard BAA for healthcare customers⁴.

Google Cloud Healthcare API and generative AI services in Vertex AI are available under Google Cloud's BAA for qualifying healthcare customers. General-purpose consumer AI tools, including ChatGPT free and Plus tiers, Claude.ai without an enterprise agreement, and Gemini standard accounts, do not offer BAAs and are not HIPAA-eligible. Healthcare organizations that need AI assistance for clinical tasks should either use a BAA-covered platform or maintain a strict scrubbing workflow that removes all 18 Safe Harbor identifiers.

Verifying HIPAA eligibility for a specific AI service

AWS publishes its list of HIPAA-eligible services at aws.amazon.com/compliance/hipaa-eligible-services-reference. Microsoft publishes an equivalent list at microsoft.com/en-us/trustcenter/compliance/hipaa. Not all services from a HIPAA-eligible provider are themselves covered, so an AWS customer with a BAA must verify that the specific service (for example, Amazon Bedrock versus Amazon Comprehend Medical) is on the eligible services list before using it to process PHI. Relying on a provider's general HIPAA eligibility without service-level verification is a common compliance gap that OCR investigations have identified.

Verifying the service tier and scrubbing before submission are complementary controls, because eligibility alone does not remove identifiers that remain in the prompt. CapyToolkit runs the scrubber locally in your browser with no BAA needed, so the PHI is tokenized before it reaches any provider, and only the variables file maps the tokens back to the real patient values.

Minimum Necessary standard in healthcare AI prompts

HIPAA's Minimum Necessary standard (45 CFR 164.502(b)) requires covered entities to use, disclose, and request only the minimum PHI necessary to accomplish the intended purpose⁵. Applying this standard to AI prompt design means including only the specific identifiers and clinical details the AI needs for the task, not the full patient record. A prompt asking an AI to generate a prior authorization letter for a specific medication needs the patient's insurance plan type, the diagnosis code, and the medication name. It does not need the patient's phone number, SSN, or full medical history.

Designing minimal prompts before adding the scrubber layer eliminates the most sensitive PHI before the scrubber even runs. Structure clinical AI prompts as role-based templates that include categories of information rather than individual patient records. For example, write "Patient is a 65-year-old female with a history of Type 2 diabetes, requesting prior authorization for medication X under insurance plan Y" instead of including the patient's real name and specific dates.

Replace specific ages with ranges, replace specific dates with relative references such as three months ago or during the prior calendar year, and omit names entirely when the clinical task does not require them. Maintain a library of approved AI prompt templates that your Privacy Officer has reviewed against the Minimum Necessary standard, documenting which templates were used in AI-assisted tasks to create an audit trail demonstrating deliberate compliance.

When to use this

Use this before pasting any clinical documentation, patient communication, billing record, or healthcare administrative text into an AI tool when the content contains identifiable patient information.

Examples

Patient: M.T., DOB 1975-03-14, SSN: 321-54-9876. Complaint: chest pain. Contact: [email protected], (555) 321-9876.

Patient: M.T., DOB 1975-03-14, SSN: [SSN_1]. Complaint: chest pain. Contact: [EMAIL_1], [PHONE_1].

Claim for patient [email protected], insurance ID: INS-123456, card: 5500000000000004.

Claim for patient [EMAIL_1], insurance ID: INS-123456, card: [CC_1].