Redact a Medical Record Before Sharing It
Medical records are the document type where a partial redaction is most likely to be a reportable incident. Identifiers are spread across headers, footers, and margins, and the sensitive part is often the diagnosis rather than the name.
Free, no account, and the image never leaves your browser.
Health information is the most heavily regulated category here
In the United States, a photograph of a medical record containing a name plus a diagnosis, treatment, or date of service is protected health information. Sharing it outside a permitted purpose is a disclosure event with legal consequences, not just an embarrassment. Comparable regimes exist in the EU, the UK, Canada, and Australia, and most of them treat health data as a special category requiring a higher standard of protection.
The identifiers that trigger that classification are broader than people expect. Under the US standard, the list includes names, dates more specific than a year, geographic subdivisions smaller than a state, phone and fax numbers, email addresses, Social Security numbers, medical record numbers, health plan numbers, account numbers, certificate and licence numbers, vehicle identifiers, device serial numbers, URLs, IP addresses, full-face photographs, and any other unique identifying code.
This is why medical records are the one case where the usual advice — cover the name and move on — is clearly insufficient. A discharge summary with the name covered still carries the record number, the admission and discharge dates, the attending physician, the facility, and the diagnosis. Several of those are direct identifiers on their own.
The identifier list, practically applied
Work through this before you decide the document is clean. The items people cover first are rarely the ones that carry the most risk.
- Patient name in every position
- Header, footer, page numbers, specimen labels, and any stamp. Medical records repeat the name on every page, which is good for safety and bad for redaction.
- Medical record number and account number
- A direct identifier, and it resolves to the full record in the provider's system. Usually printed in the header of every page.
- Dates more specific than a year
- Date of birth, admission and discharge dates, date of service, and appointment dates. These are identifiers under the standard, not merely context.
- Insurance and health plan identifiers
- Member ID, group number, and policy number. These are financial and identify the person precisely.
- Provider names and facility details
- Attending physician, referring physician, clinic name, and address. Identifying the provider plus a date plus a condition often identifies the patient by elimination.
- Diagnosis and procedure codes
- ICD and CPT codes are short, structured, and often enough to identify a rare condition. Cover them if the condition itself is sensitive.
- Photographs and imaging
- Clinical photographs may include a face or a distinguishing feature. Imaging studies frequently carry burned-in patient details in a corner of the frame.
- Barcodes and QR codes
- Specimen labels and wristband printouts encode the record number. Covering the text and leaving the barcode leaves a direct lookup key visible.
- Free-text notes
- Clinician notes often restate the name, mention family members, or describe circumstances that identify the patient even with the header removed.
What detection will find, and why it is not enough here
Detection can help with the numeric identifiers. It cannot help with the field that matters most, and it is important to be clear about that before relying on it for a document of this kind.
Found automatically
- Social Security numbers in the separated form, which appear on some intake and billing documents
- US phone numbers in patient and provider contact blocks
- Email addresses
- Card numbers of 13 to 19 digits that pass the Luhn checksum, on billing statements
- IPv4 addresses, which appear in some system-generated reports
Needs a box by hand
- Patient names. There is no named-entity recognition, so the single most important identifier is never found automatically.
- Medical record numbers and account numbers. Not among the six matched patterns.
- Dates of birth and dates of service.
- Insurance member and group IDs.
- Provider names, facility names, and addresses.
- Diagnosis and procedure codes.
- Faces in clinical photographs.
- Barcodes and QR codes on specimen labels.
A deliberately cautious process
For a document in this category, the goal is not a fast pass. The goal is a document you can defend having shared.
Confirm you are allowed to share it at all
Redaction reduces disclosure; it does not create permission. If the record belongs to a patient, sharing any version may require consent or a permitted purpose. Decide this before touching the file.
Decide the minimum the recipient needs
Covering the diagnosis is often more important than covering the name, depending on who is asking. If the recipient only needs proof of attendance, most of the document can go.
Rasterize the page
A PDF with a black box over text still contains the text. Convert the page to a PNG so the redaction is applied to pixels.
Cover the header and footer of every page
Name, record number, account number, and dates repeat there. On a multi-page record this is the bulk of the work and the bulk of the risk.
Cover the barcodes
Completely, including the quiet zone around them. A specimen label barcode encodes the record number you just covered in text.
Read the free-text notes
Clinician notes frequently restate names, mention relatives, or describe a circumstance that identifies the patient. Read them rather than scanning them.
Export and review at full size
Open the PNG, zoom to actual size, and go page by page. On a document of this kind, a missed identifier in a footer is the failure that matters.
Why this page does not promise a compliant result
It would be easy to write a page that says redacting a medical record with this tool makes it safe to share. That would be false, and on this particular document type the falsehood would be consequential.
De-identification under the US standard has two recognized paths. The first is the safe harbor method: remove all eighteen enumerated identifiers, and confirm that no actual knowledge remains that the information could be used to identify the individual. The second is expert determination, where a qualified statistician determines that the risk of re-identification is very small. Neither path is something a browser tool can certify, and the first one requires a judgement about residual identifiability that depends on the specific document.
What this tool does is narrower and verifiable: it replaces the pixels inside the boxes you draw, and it re-encodes the image so metadata from the source file is not carried across. That is a real contribution to de-identification. It is not the whole of it.
The practical consequence is that a medical record needs a human review pass after the redaction, and probably a second one from someone who knows the regulatory requirement that applies. If that sounds like a high bar, it is the correct bar for this category of document. For a receipt or a screenshot, a careful single pass is reasonable. For a patient record, it is not.
Health documents carry a higher bar than anything else on this site, and the technique is worth understanding before applying it here. You can redact image online with a solid fill, which matters most when the consequence of a miss is legal rather than embarrassing.
Frequently asked questions
- Does redacting a medical record make it HIPAA compliant?
- No, and no browser tool can certify that. De-identification has specific legal standards, including a residual-risk judgement, that depend on the document. Redaction removes what you select; compliance is a separate determination.
- Can I share a medical record if I cover the patient's name?
- Usually not sufficient. Record numbers, dates of service, provider names, facility details, and diagnosis codes are identifiers in their own right.
- Does the tool find patient names automatically?
- No. Detection matches six fixed text patterns and has no name recognition. On a medical record, assume every identifier needs a box drawn by hand.
- Is the image uploaded anywhere?
- No. There is no upload step and no server-side processing. The image is decoded in the tab and the download is created locally. If you reload the page, it is gone.
- What about photographs and scans of imaging?
- Clinical photographs can contain a face, and imaging films often carry burned-in patient details in a corner. Both need manual boxes, and a face is not something pattern matching can address.