HIPAA Safe Harbor de-identification, in the browser
Why "no BAA" is an architecture, not a promise
Every cloud de-identification vendor asks you to trust them with PHI, which is exactly why HIPAA requires a Business Associate Agreement, SOC 2 reports, and breach-notification terms before you can use them. ZeroEgress removes the question instead of answering it: the entire application runs in the user's browser. There is no upload, no server-side processing, and no data path through our infrastructure. The usual vendor controls don't apply because there is nothing on our side to audit.
You don't have to take that on faith. Open DevTools > Network, process a document, and watch: zero outbound requests during processing. The page's Content-Security-Policy makes external connections impossible at the browser level.
Safe Harbor identifier coverage
HIPAA's Safe Harbor method (45 CFR § 164.514(b)(2)) requires removing 18 categories of identifiers. ZeroEgress detects and redacts the majority of them:
- Names (patients, physicians, family members), via AI (NER) with second-pass propagation: found once, redacted everywhere, including ALL-CAPS variants in scanned text
- Dates (birth, admission, discharge, appointments)
- Telephone and fax numbers (fax identified by context, e.g. “Fax:” preceding the number) and email addresses
- Social Security Numbers
- Medical record numbers (MRN) and account numbers
- Health plan beneficiary numbers (member, subscriber, policy, group and plan IDs, identified by context)
- License and certificate numbers
- Geographic subdivisions and ZIP codes (5-digit and ZIP+4)
- URLs, IP addresses, and vehicle identifiers (VIN)
Not currently covered: biometric identifiers and full-face photographs. Human review of results is recommended before relying on any automated de-identification, no system, cloud or local, is 100% accurate.
Scanned records and faxes
Scanned PDFs and images (JPG, PNG, TIFF) are detected automatically and processed with in-browser OCR. The image never leaves the device either.
Audit trail for compliance documentation
Every processing session produces a tamper-evident, HMAC-SHA256-chained audit trail, exportable as JSON or CSV, and a redacted PDF with an integrated compliance report. Anyone can verify the chain's integrity with one click. Each session can also export a signed evidence pack, a signed audit export, the redaction map and a signed compliance certificate, that your compliance team or an outside auditor verifies offline with standard tools, including a verifiable earliest bound on when the records were created; and the AI model itself is signature-verified before use, with that verification part of the record.
Typical uses
- De-identifying patient files for research datasets
- Preparing case notes for consultation with AI tools, see the AI workflow
- Sharing records with non-covered entities without triggering a disclosure