De-Identified Text Isn’t Always Safe to Paste Into AI

Many teams follow a simple rule before using AI on clinical writing: remove the names, then paste. If the text meets HIPAA’s de-identification standard, it is no longer protected health information, so the rule feels reasonable.

But a legal standard and real-world safety are not the same thing. A February 2026 position paper from NYU researchers argues that scrubbed clinical notes can still point back to individual patients, and HHS guidance acknowledges that de-identified data keeps a small, non-zero risk. Here is what to check before you paste.

What HIPAA Means by “De-Identified”

The Privacy Rule recognizes two methods under 45 CFR 164.514(b). Safe Harbor means removing 18 categories of identifiers, covering the individual as well as relatives, employers, and household members, with no actual knowledge that the remaining information could identify someone. Expert Determination means a qualified expert documents that the risk of identifying an individual is very small.

Once either standard is met, the data is no longer protected health information under the Privacy Rule. Neither method removes risk entirely, and HHS guidance says as much.

Why Narrative Text Is Harder Than Data Tables

Safe Harbor was built with structured data in mind: fixed fields that can be deleted or generalized. Clinical and research writing is different. A draft study report, case narrative, or safety summary is free text, and identifying details can appear anywhere in it.

Beyond names and ID numbers, watch for exact dates, small geographic details, rare diagnoses, unusual treatment sequences, site names, and quotes from patients or investigators. Any one of these may look harmless. Together they can narrow a pool of possible patients to one.

Safe Harbor also requires that you have no actual knowledge that what remains could identify someone, so the checklist alone is not the whole test. Redacting free text, whether by hand or with software, is easy to get wrong.

What the NYU Paper Adds

In February 2026, researchers at NYU posted Paradox of De-identification: A Critique of HIPAA Safe Harbour in the Age of LLMs to arXiv. It is a position paper. The authors argue that Safe Harbor was designed for categorical, tabular data and ignores correlations between identity and quasi-identifiers that language models can capture.

In their tests, a model re-identified individual patients from scrubbed clinical notes at a low rate, at most 0.34%. In a separate test, a model predicted a patient’s neighborhood from the diagnosis alone, after all other information was removed, though only modestly better than chance (about 58.6% AUC). The authors’ point is structural: even small rates show a gap that the Safe Harbor checklist does not close.

Keep the limits in view. This is not a regulatory finding, and it does not change what HIPAA requires. It suggests that “de-identified” is a compliance status, not a promise of anonymity.

What De-Identification Does Not Protect

HIPAA de-identification is about patient privacy. It does not cover unpublished study results, sponsor-confidential information, unreleased protocol details, regulatory strategy, or other intellectual property. A fully scrubbed clinical study report can still be commercially confidential.

It also does not answer a separate question: what the AI tool does with your text. Many tools store prompts, and some use them to improve their models, depending on the plan and settings. Contracts, institutional policies, and state or international privacy laws may set stricter rules than HIPAA.

A Quick Check Before You Paste

Before pasting clinical text into an AI tool, ask:

• Could the dates, locations, rare conditions, or site details link back to a person?
• Was the text de-identified under Safe Harbor or Expert Determination, or did someone just remove the names?
• Is anything in it confidential beyond patient data, such as unpublished results or sponsor information?
• Do your organization’s policy and contracts allow this tool for this content?
• Is the text stored, logged, or used for training by the tool?

If any answer is unclear, do not paste yet.

When the Tool Itself Should Be the Safeguard

De-identification protects the patient. The tool should protect the text. Trinka’s Confidential Data Plan does not store your content and does not use it to train AI models. Its Offline Grammar Checker works without an internet connection, and healthcare organizations that need formal HIPAA documentation can request a Business Associate Agreement.

Trinka Confidential Data Plan does not replace de-identification or your compliance process. It adds a second layer, so that if a detail slips through, the text is not retained or used for training.

Conclusion

Removing identifiers is a necessary step, not a finish line. Narrative text can still point to a person, and de-identification says nothing about confidential study content or where a tool sends your text. Check the text, check the tool, and paste only what the task needs.

Key Takeaways

• Meeting HIPAA’s de-identification standard is a legal status, not proof of anonymity.
• Free text carries more identifying risk than data tables.
• A 2026 NYU position paper suggests language models can exploit details that remain after Safe Harbor scrubbing, though at a low rate in its tests.
• De-identification protects patients, not unpublished results or IP.
• Check a tool’s data handling separately, and treat a privacy-first tool as a second layer, not a replacement.