BASALT · JOURNAL
Redacting medical billing and claims data
Billing records are shared with insurers, employers in some arrangements, collections agencies and auditors, and they carry clinical information in a form people underestimate.
The identifiers
Names, addresses, dates of birth and record numbers are obvious and usually handled.
Less obvious: policy and group numbers, provider identifiers that narrow the field to a single practice, dates of service, and account references that appear in headers on every page.
Codes are clinical information
A diagnosis code is a diagnosis. A billing record with names removed and codes intact still reveals what someone was treated for, and for a rare condition that can identify the person on its own within a small population.
The same is true of procedure codes and of certain drug identifiers. Treating codes as neutral because they are numbers is a recurring error.
Dates as identifiers
A date of service combined with a facility narrows to a small set of people, and in a small facility to one. Date shifting and generalisation are standard techniques for exactly this reason.
Where identifiers hide in these documents
Page headers and footers repeating an account number on every page, which is easy to miss when reviewing page by page.
Barcodes, which encode the record number in a form no text search finds and no reviewer reads.
Metadata from the billing system, frequently carrying a patient identifier entirely separately from the page content.
Remittance advice attached to the file, which carries its own identifiers.
Checking
Extract the text and search for every identifier, including the account number that appears in headers.
Look at barcodes specifically. If the document has one, assume it encodes something and redact it as an image.
Read metadata and list attachments.
Minimum necessary
Most health privacy regimes expect disclosure limited to what the purpose requires. In practice this means extracting the relevant pages rather than redacting an entire record, which is both safer and faster.
This is a description of common practice rather than legal advice. Obligations vary by jurisdiction and by the terms you are working under, and the authority that governs your work is the one to check with.
Frequently asked questions
What identifiers are in medical billing records?
Names, addresses, dates of birth and record numbers, plus policy and group numbers, provider identifiers, dates of service, and account references repeated in page headers.
Do diagnosis codes need redacting?
Often yes. A code is clinical information, so a record with names removed and codes intact still reveals what someone was treated for, and a rare condition can identify a person on its own within a small population.
Where do identifiers hide in billing documents?
Page headers and footers repeating an account number, barcodes that encode a record number in a form no text search finds, metadata from the billing system, and attached remittance advice carrying its own identifiers.
Is it better to redact a full record or extract pages?
Extracting the relevant pages is usually both safer and faster, and it aligns with the expectation in most health privacy regimes that disclosure is limited to what the purpose requires.
Doing it in Basalt
Basalt is a native macOS PDF toolkit built around redaction that removes content rather than covering it. After writing a file it re-opens its own output with an independent parser, searches for the material again, and refuses to save if anything is found. It also strips metadata, XMP, attachments, embedded scripts and hidden layers as part of the same operation, and a separate Inspector reports what any PDF still hides, including documents Basalt did not create. Everything runs on your Mac: the engine holds no network entitlement at all, which macOS enforces at the code-signature level. A one time $29 licence covers up to three Macs, free for the first 24 hours. basaltformac.com, or brew install --cask chipmunk1101/tap/basalt.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.