Safe Harbor De-identifier

A tool that claims accuracy without a number is marketing. This page carries a small corpus of synthetic notes, invented patients, invented numbers, each one annotated with the correct answer. The button below runs the same code that just processed your text against that corpus and reports what it actually caught. Nothing is sent anywhere; the corpus is in this file and you can read it in View Source.

Recall is the share of real identifier characters the tool masked. A miss is the expensive failure, so recall is what matters. Precision is the share of masked characters that were really identifiers; low precision means the tool is eating your clinical content. Certain only is what the Redact and Surrogate modes do on their own. With review is what you get if you open Review mode and accept every amber candidate too.

Embedded lists

• Surnames 25,000, the most frequent surnames from the U.S. Census Bureau Frequently Occurring Surnames from the Census 2000 file app_c.csv, taken in count order down to a cutoff of 933 bearers. That covers 85.9% of the people in that file. Published by a federal agency; usa.gov states that a government work is one "created by a U.S. government officer or employee as part of their official duties".
• Given names 5,494, every entry in the U.S. Census Bureau 1990 dist.male.first and dist.female.first files. The Bureau's own methodology note limits those files to "the minimum number of entries that contain 90 percent of the population in that data file", and warns that "The fact that a name doesn't appear in these three files does not mean that it is non existent, only that it is reasonably rare."
• Medical collision list 754, words that are in the name lists and appear in the U.S. National Library of Medicine's MeSH 2025 tree file, so they are demoted to amber instead of being masked on sight. This is what stops Parkinson, Bell, Graves, Cushing and Rose from being deleted out of your assessment. Courtesy of the U.S. National Library of Medicine.
• Ordinary-English collision list 4,985, words that are in the name lists and in the Webster's Second International word list shipped with BSD and macOS at /usr/share/dict/web2, whose README states the 1934 copyright has lapsed. Used only to hold fire at the start of a sentence, where Brown sputum and Mr Brown look identical to a machine.
• Eponym followers 814, every word that follows a person-name in a MeSH heading (syndrome, disease, palsy, cells). A name-shaped word followed by one of these is treated as a diagnosis, not a patient, and is left alone entirely.
• Clinical nouns 1,793, words that appear after the first word of a MeSH heading at least three times and are not themselves names. A name-shaped word followed by one of these (Foley catheter) is demoted to amber rather than masked outright. A short list of bedside objects MeSH does not name, sign, catheter, manoeuvre, is written by hand and marked as such in the source.
• Place names 900, the most widely repeated U.S. place names in the Census Bureau 2024 Gazetteer place file, used only to invent fake cities in surrogate mode.
• A short list of ward, department and note-heading words is written by hand for this tool and is not taken from any dataset. It is marked as such in the source.

What the lists cannot do

A gazetteer is a popularity contest. A surname held by fewer than 933 people in the United States is not in it, and no U.S. list carries the world's names. If your patient's name is rare, or not American, the list will not save you, the title, relationship and two-word-name rules are what catch it, and Review mode is where you catch the rest. That is the honest limit of this design, and it is why the output still has to be read by a human.

Redaction advertises its own failures. Every [NAME] in a note tells a reader exactly where to look, so the one name the tool missed sits in the open, surrounded by markers, and it glows. Surrogates do the opposite: a missed name sits among plausible invented names and nothing marks it as special. That is the entire argument for this mode.

What stays consistent

• The same person keeps the same fake name everywhere in the document, and a surname mentioned on its own later still maps to the surname you already saw.
• Every date moves by one single hidden offset, so admission-to-discharge, symptom-onset-to- presentation and every other interval survives intact. That is what a researcher actually needs.
• Record numbers, phone numbers and postcodes keep their shape, same digit count, same punctuation, so anything downstream that validates a format still works.

The dangerous part

The output looks like a real record and is not one. Never file it, never quote a surrogate value back to a colleague as fact, and never let it reach a chart. The warning banner is on by default for that reason.

The linkage key box exists for cohorts: type the same key on two different notes and both get the same date offset and the same fake names, so records about one patient still line up. That key is now a re-identification key. Anyone holding the key and the output can undo the date shift. Treat it like a password, keep it away from the de-identified data, and if you do not need cross-document linkage, leave the box empty, a fresh random offset is then generated per page load and is discarded when you close the tab.