Data Sanitizer · Blog

HIPAA and ChatGPT: what you can (and can't) paste

AI can help summarize notes, draft letters and analyze data in healthcare — but protected health information (PHI) must not go into a general AI tool. The safe path is de-identification before anything is shared.

The HIPAA Safe Harbor identifiers

The Safe Harbor method calls for removing 18 categories of identifiers, including names, all geographic detail smaller than a state, dates more specific than a year, phone and fax numbers, email addresses, SSNs, medical record and account numbers, and any other unique identifying number or code.

What "de-identified" really requires

• Names of patients, relatives and providers.
• Addresses and postal codes.
• Dates — birth, admission, discharge, death.
• Contact details — phone, email.
• Record and account numbers, SSNs and other unique IDs.

Remove those and the text can be reasoned about without exposing a person.

Why browser-only de-identification is the safest option

If a tool uploads your data to a server to process it, that transfer is itself a disclosure. A tool that runs entirely in your browser never transmits the data at all — there's no processor to trust and no transfer to log. De-identify locally, review the output, then paste only the cleaned text into your AI tool.

Important: automated redaction is a best-effort aid, not a certified compliance product or legal advice. Always have a qualified person review de-identified output before it is used or shared.