What about patient names that aren't in my list?

A regex detector cannot recognise arbitrary names. Supply the patient surnames you know about in "Additional terms"; for general name detection you would need an LLM-based detector, which is out of scope for this no-AI cluster.

Why are some matches false positives?

Regex matches by shape. A 9-digit number formatted like an SSN that's actually a billing code will still match. Review each finding before redacting.

Are the files uploaded?

No — text extraction and regex matching run entirely in your browser.

HIPAA PHI Detector

Scan a PDF for likely PHI (protected health information) — SSNs, dates of birth, phone numbers, email addresses, and MRN-shaped strings — with page numbers and remediation suggestions.

Your files never leave your browser. All processing happens on your device — nothing is uploaded.

1. Upload your file

How does the HIPAA PHI Detector work?

Scan a PDF for shapes that look like Protected Health Information (PHI) — SSNs, dates of birth, phone numbers, emails, MRN-style identifiers, member/policy IDs — and add any patient surnames or specific terms you supply. The result is a per-page list of findings with surrounding context, ranked so you can see exactly what to redact. This is a deterministic regex-based detector, not an LLM — it will catch shaped data (the format of an SSN) but cannot identify a free-text patient name without you supplying it. Once you have the list, use Permanent Redaction (true content removal) or Redact PDF (visual blackout) to actually remove the data from the file.

🔒 Security & Privacy

All processing happens on your device. Your files never leave your browser, never touch our servers, and are not stored anywhere. Close the tab and the file is gone.

📱 Use it on any device

Works in any modern browser — Mac, Windows, Linux, iPhone, Android, and tablets. No installation, no app to download. Just open the page and start.

⚡ Quick & easy

Drag, drop, click. Most files process in seconds, not minutes. No watermarks added to your output, no per-day limits, and the tool always shows the result before asking you to download.

🎁 Always free, no signup

Free to use, every time. No account creation, no email required, no “trial” that converts to a paid plan. We make money from ads so you don’t have to pay.

Frequently asked

No — this is a detection step. You still need to run the actual redaction (Permanent Redaction is the safest) and verify nothing leaked. HIPAA compliance also has procedural and access-control requirements outside the file itself.