Healthcare data needs to move without exposing the people in it.

Built for HIPAA Compliance.

The HIPAA Privacy Rule provides what it calls the Safe Harbor method for de-identifying health information before it is shared. The method requires the removal of 18 categories of identifiers that can identify an individual — wherever they appear, including structured data and free text such as clinical or customer service notes.

Accuracy is measured two ways.

PHI detection has to get two things right at once:

1. Every patient identifier needs to be detected and masked. These are the 18 HIPAA Safe Harbor categories that PDM detects.
2. Values outside those categories, such as doctor names, agent names and drug names, need to survive masking.

Over-masking happens when a value outside the Safe Harbor categories is masked anyway. In testing against a file containing 5,211 look-alike values planted to trick the detection engine, PDM left 5,061 of them alone.

Many data masking tools report accuracy as a single overall number, which can give a general sense of performance but can also hide what matters for PHI. A tool may perform extremely well on Social Security numbers but poorly on names. Some identifier categories may not be tested at all. And over-masking can disappear into the overall result.

See our Safe Harbor detection results →

Sharing with PDM is safe.

AI can be very effective at identifying sensitive information. But sending a file containing PHI to an external AI service means the original, unprotected data has to leave your control before it can be protected.

Your file is not sent to an external AI service for processing. PDM processes it inside a closed cloud project protected by organization-level security controls, with no public access to the detection model or the database, and encryption in transit and at rest.

For healthcare data, processing is covered by a Business Associate Agreement (BAA), as required when a business associate handles PHI on your behalf.

PDM does not need access to your systems, your data is not used to train models, and uploaded files are deleted by policy within 48 hours.

See how we protect your data →

See PDM work on a sample file.

To help your evaluation, see how PDM processes a sample healthcare file.

View the sample →