Data De-identification and PII/PHI Redaction Services

We redact personally identifiable information (PII) and protected health information (PHI) so individuals cannot be identified from the data. Entity types include faces, license plates, names, dates of birth, addresses, phone numbers, email addresses, national ID numbers, account numbers, medical record numbers, biometric markers, vehicle identification numbers (VINs) and any other client-defined identifiers. This applies across images, video frames, DICOM files, PDFs, and structured data formats.

Faces and license plates are detected using a combination of automated detection models and manual specialist review. Each identified region is redacted using your preferred method: pixelation, blur or solid-fill redaction. Edge cases such as partially visible faces, occlusion, low-light frames and non-standard plate formats are handled by trained specialists with project-specific guidelines. Every redaction is logged per record, so it can be traced in an audit.

Our workflows support both the HIPAA Safe Harbor method (removal of the 18 PHI identifiers) and the Expert Determination method, depending on the project. European datasets are handled under GDPR-aligned workflows, and Canadian data in line with PIPEDA. Our security controls are aligned with ISO 27001. Everyone with project access signs an NDA, and every record has an audit trail.

We de-identify images (JPEG, PNG, TIFF, BMP), video (MP4, AVI, MOV, frame sequences), medical imaging (DICOM), documents (PDF, DOCX, scanned records), structured data (CSV, JSON, XML, EHR exports) and call transcripts. For DICOM we scrub both the pixel layer and the embedded PHI tags in the metadata fields, following the DICOM PS3.15 standard.

We score audited samples by the share of identifiers correctly redacted. Each batch goes through specialist and peer review, an automated re-scan and a QA Lead audit, with 100% sampling on PHI and medical imaging projects. The accuracy target is written into the contract. The QA section above has the full breakdown.

Large or continuous projects run in batches with agreed QA checkpoints and a dedicated team for each client. For ongoing work, such as a live EHR feed or a recurring AV dataset, we usually set up a monthly retainer with a fixed team and agreed SLAs. All batches include redaction logs, entity-type breakdowns and delivery confirmations.

Data moves over encrypted, client-approved channels such as SFTP, secure cloud storage or VPN. Specialists work through role-based, permission-scoped systems, and downloads to personal devices are not permitted. Security monitoring runs continuously on project environments. When the project ends, source data is deleted as you instruct and we confirm it with a destruction certificate. See our security and compliance practices for more detail.

De-identification pricing depends on media type, entity density, volume and review depth. We price per image or frame, per record or page, per hour, or on a monthly retainer, as described in the pricing section above. Send us your dataset type and volume to get a quote.

Yes. This is one of the most common setups for healthcare AI and autonomous vehicle teams. De-identification runs as a preprocessing step before annotation (e.g., DICOM face blurring before radiology region-of-interest labeling, or dashcam plate removal before bounding box labeling). Both run under the same contract terms and compliance framework. For more on the labeling side, see our bounding box annotation and wider data labeling pages.

Automated tools on their own often miss edge cases, unusual PII formats and context-dependent identifiers. Our human-in-the-loop approach combines automated detection with trained specialist review and 3-tier QA. We handle low-contrast images, handwritten records, partially visible identifiers and multi-language documents that automated tools miss. Every project begins with a free pilot, so you can check quality against your own dataset before committing to full-scale processing.