BASALT · JOURNAL
Redacting medical records without leaving the identifiers behind
A medical record is the hardest common document to de-identify, because the obvious identifiers are the easy half. Knowing how to redact medical records means knowing which fields identify a person indirectly, and knowing where a PDF keeps copies of them that the rendered page never shows you. This article covers removal and verification, not regulatory judgment, and nothing in it is legal advice.
The identifiers that are not names
Anyone catches a patient name, an address, a phone number, and a Social Security number. What survives a careful pass are fields that identify by combination.
Dates more precise than a year. Date of birth, admission and discharge, service, and death. An admission date plus a named facility plus an approximate age often narrows a population to one person, which is why dates are usually reduced to a year rather than deleted.
Geography below the state level. Town, county, and postal code are identifiers when the population of that unit is small. A postal code that is harmless in a dense metro is close to a name in a rural county.
Record and account numbers. Medical record, encounter, accession, beneficiary, and claim numbers. These are stable pseudonyms across every document a system produces, so one leaked pairing of MRN to name compromises them all.
Device and biometric identifiers. Pacemaker and pump serials, implant identifiers, instrument identifiers on lab reports, fingerprints, voice prints, and retinal patterns.
Full-face photographs and comparable images. Clinical photography, wound images including a face, and scanned licenses or insurance cards filed in the chart.
Any other unique code. Wristband and specimen barcodes carry an identifier no reviewer reads by eye and every scanner reads.
HIPAA gives two routes, and neither is a software feature
De-identification can be reached by Safe Harbor, which requires removing a defined set of identifier categories and having no actual knowledge that what remains could still identify the individual, or by Expert Determination, in which someone with appropriate statistical expertise applies accepted methods, concludes the re-identification risk is very small, and documents the analysis.
Safe Harbor is mechanical and over-removes; Expert Determination is contextual and harder to defend. Which applies, and which categories you strip, is your determination with counsel, working from the regulation text rather than any summary. De-identifying PDFs under HIPAA goes further. Both routes assume the identifiers are genuinely absent from the artifact you hand over, and a chart showing a black box while the name sits in the content stream satisfies neither.
Where identifiers hide in a chart PDF
The same patient name can exist in six places in one file, and clearing the page clears exactly one of them.
The content stream. Page text is painted by operators whose operands are character codes. A filled rectangle drawn on top is one more instruction and changes nothing underneath, so extraction returns the name.
The OCR text layer. A scanned or faxed chart run through OCR carries invisible text positioned under the image. Destroy the pixels without destroying that layer and the name stays fully searchable while looking redacted, which is the most common failure on medical records. See redacting scanned documents.
Letterhead, footers, and fax headers. The practice block carries an organization name, address, and provider numbers. The fax strip carries the sending number, the sending organization, a timestamp, and often a patient name from the cover sheet. Both repeat on every page and both get read past.
Metadata and XMP. Health systems export files named after the patient, and the information dictionary and XMP packet routinely retain the original file path, so Smith_John_MRN0012345.pdf sits in the file long after the visible name is gone. See removing PDF metadata on a Mac.
Annotations, form fields, and attachments. Comments store text independent of the page, intake forms store field values separately from the appearance, and an attached lab file is untouched by any page edit.
Hidden layers and earlier revisions. A switched-off optional content group is still present, and a PDF saved as an incremental update keeps the earlier page. Hidden data in PDFs covers each carrier.
How to redact medical records, in a working order
Inspect first, because the invisible carriers are the ones you forget once you are deep in page work. Then clear the file-level structures: strip metadata and XMP, remove attachments, resolve annotations and form field values, and remove hidden layers.
Then build a value list before touching a page: the patient name in every form, including initials and the transposed Last, First used in headers, plus record and encounter numbers, date of birth, every service date, phone numbers, address, employer, guarantor, and relatives named in the history. Search and redact each value across the whole document, which is how you catch tables and running headers.
Handle the repeated furniture next, then the images: photographs, ID card scans, signature blocks, and barcodes all need pixels destroyed and the image re-encoded rather than covered. Read the narrative last, because free text identifies by description in ways no search finds.
Verifying the removal
Verification means opening the produced file with something other than the tool that wrote it. Extract the text with an independent parser and search for every value on your list, extract the embedded images and open them to confirm the region is destroyed rather than covered, read the metadata separately, and check whether the file holds more than one revision. Verifying a PDF redaction gives the commands.
Frequently asked questions
How do I redact medical records without missing anything?
Work from a written value list and search the whole document for each value rather than reviewing page by page, because names and record numbers appear in running headers, tables, and OCR layers that visual review skips. Strip metadata, attachments, annotations, form field values, and hidden layers first, since those carry copies the page never displays.
Is a black box over a patient name enough to redact a medical record?
No. A black box is a drawing instruction added on top of the page, and the characters underneath remain in the content stream where any extraction tool reads them. Selecting the covered area and pasting it into a text editor often reveals the name immediately. A real redaction removes the glyphs entirely.
Do I need to redact dates in a medical record?
Dates more precise than a year are treated as identifiers under the Safe Harbor route, which is why admission, discharge, service, birth, and death dates are usually reduced to a year rather than left intact. An admission date with a named facility and an approximate age can narrow a population to one person.
Does redacting a scanned chart remove the text underneath?
Only if the tool destroys the OCR text layer along with the pixels. A scanned chart that has been through OCR carries invisible positioned text under the image, and many tools that black out an image region leave that layer intact, so the result looks redacted and extracts perfectly. Check by extracting text from the finished file.
Is a medical record number safe to leave in if the name is removed?
No. A medical record number is a stable pseudonym, not anonymity, and it links every document the same system produced about one person. If a name and MRN appear together in any disclosure, every document carrying that MRN becomes attributable. Treat record, encounter, accession, claim, and beneficiary numbers as identifiers in their own right.
Do I have to redact the letterhead and fax header?
They carry identifiers, so review them deliberately rather than treating them as decoration. A letterhead names an organization, an address, and often provider numbers, and a fax header carries the sending number, the sending organization, a timestamp, and frequently a patient name from the cover sheet.
Can I use a free online tool to redact medical records?
Uploading a record discloses the unredacted record to whoever operates the service, and the upload happens before any redaction is applied. Whether that is permissible depends on the agreements in place, and most consumer PDF sites are not set up for it. Working locally on a machine you control removes the question entirely.
How do I prove a medical record was de-identified?
Prove it by re-opening the produced file with a parser independent of the tool that wrote it and showing that every value on your list is absent from the text, metadata, annotations, form fields, and embedded images, then keep a record of what was removed and why. A confirmation message from the redacting application is not evidence.
Doing it in Basalt
Basalt inspects a chart before you mark it, reporting the metadata, XMP, embedded files, hidden layers, annotations, and OCR layers it still carries, and search and redact finds every instance of a name or MRN across a long record. Redaction destroys content rather than covering it: glyphs excised from the content stream, image pixels destroyed and re-encoded, the OCR text under a mark destroyed, and metadata, attachments, and hidden layers stripped as the file is written in one generation. A verifier then re-opens the written bytes with an independent parser and proves the content is gone before anything is saved, and if it cannot prove that, nothing is written. Each mark records a reason, including HIPAA, and those reasons export to CSV or XLSX. The engine has no network entitlement, enforced by macOS at the code signature level, so a chart never leaves your Mac, and it is $29 once, lifetime, up to three Macs, free for 24 hours.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.