HIPAA redaction software for PHI in real-world medical records.
Protected health information rarely sits in tidy form fields. It hides in physician narratives, scanned referrals and faxed lab results. DocArmor reads those documents in context, applies the HIPAA Safe Harbor identifiers, and puts every finding in front of a reviewer before anything leaves your hands.
Free 7-day trial, 20 pages. No credit card required.
Safe Harbor de-identification, item by item
The HIPAA Safe Harbor method (45 CFR 164.514(b)(2)) lists 18 identifiers that must be removed for health information to count as de-identified: names, geographic subdivisions smaller than a state, dates other than the year, ages over 89, medical record numbers, health plan beneficiary numbers, device identifiers and serial numbers, and more.
DocArmor's HIPAA Safe Harbor template maps each of those identifiers to a detection rule, so your team works from a checklist instead of memory. Tailor it to your own policies, then apply the same rule set to every file.
Context, not just patterns
Regex finds a social security number. It doesn't know that “92-year-old” is an identifier while “67-year-old” is not, or that the attending physician's name may stay while the patient's sister's name must go. DocArmor's context-aware AI makes those distinctions, and catches identifiers written in plain prose, such as a CPAP serial number buried in an equipment note.
Built for scans and faxes
Much of healthcare still runs on fax. DocArmor's OCR reads crooked scans, degraded faxes and image-only PDFs, and visual detection covers face photos, biometrics and barcodes that text search can't see.
Release records with confidence
Every AI finding goes through a human-in-the-loop review before export. Redacted content is removed and checked on every page, metadata, attachments and form values are stripped, and documents are deleted when you finish, or kept for later only until the time you choose. They are never used to train models.
From the blog
- 42 CFR Part 2 records, and where substance use details leak in medical files
42 CFR Part 2 guards substance use disorder treatment records more tightly than HIPAA. Here is what it covers, and where SUD details leak in medical files.
- HIPAA limited data sets, and where direct identifiers hide in real records
A HIPAA limited data set may keep dates and ZIP codes but must drop 16 direct identifiers. Here is the rule, and where those identifiers hide in real records.
- The 18 HIPAA identifiers, and where they hide in real documents
HIPAA's Safe Harbor method lists 18 identifiers to remove before health data counts as de-identified. Here is each one, and where they slip past a text search.
FAQ
Healthcare redaction FAQ
Does DocArmor support the HIPAA Safe Harbor method?
Yes. The HIPAA Safe Harbor template is mapped item by item to the identifiers in 45 CFR 164.514(b)(2), and you can adjust it to your organization's own policies before running a job.
Can it redact PHI from handwritten or faxed documents?
DocArmor's OCR pipeline reads scanned and faxed pages, including image-only PDFs. Visual detection also finds face photos, biometrics and barcodes. A reviewer confirms every finding before export, which matters most on low-quality pages.
Is patient data stored after processing?
Only until you're done with it. A document and everything made from it are deleted when you finish or sign out. If you keep one for later review, for example a long record you'll come back to, it stays until you finish with it or until the time you chose, whichever comes first. The longest anyone can choose is 72 hours, and an Owner or Admin can set a shorter limit or turn keeping off for the whole organization. Documents are never used to train AI models.