A de-identifier that runs entirely in the browser, tested on 1,381 real clinical narratives, that learns from the corrections clinicians already make.
Scrub this note · the real tool, in this browser tab
Fictional text only. Never paste a real patient's note.
Pick a sample, or paste your own fictional text. This is the real Quick De-ID component from the prerounding app, with its real model, not a word list: type a name it has never seen and that is the normal case. Whatever it misses, the review queue is where you catch it.
Model: Stanford clinical deidentifier, 110 MB, downloads once, then runs offline on this device. Pack: onnx-community/stanford-deidentifier-base-ONNX, 109,651,017 bytes in 14 pieces, served from this site and loaded only when you press Scrub. First load takes a moment; it runs best on a laptop.
Sent to a server: 0 bytes Note text is never put in a request. After the pack is on this device, a run makes no network calls at all.
Structured only runs the component’s own rule layer with no model download. It is the fallback the model error message names. It catches less than the model run, and review stays mandatory either way.
Input changed. The output below is out of date: it shows the last run, not the text now in the box. Press Scrub to run the current text.
The clinic sample is loaded. Press Scrub to run the real model on it.
This evaluation is neither Safe Harbor nor Expert Determination conformance, and the output must be treated as still containing PHI until one is separately done.
The honesty beat. The trap note above is loaded and scrubbed. In the manuscript, the strongest setup still left at least one missed identifier in 30.7% of notes. Read the scrubbed note: if you can see something the tags missed, highlight it in the note and mark it. That correction, not the count, is why review stays mandatory.
See how it learns runs the app's real rule proposer on synthetic notes: make the same correction a few times and it proposes a plain-English rule for your approval. In the study behind this, 40 corrections lifted a browser model from F2 0.5348 to 0.6362. The full app, with its vault and every model pack, is at the prerounding checklist.
Every clinical note is two documents at once. One is the reasoning, the part another clinician or a researcher actually needs. The other is a trail of names, dates, phone numbers, and record numbers that can point straight back to a person. Before a note can be shared, the second document has to come out. The usual way to do that is to send the note to a company's server and let their software take the identifiers out, which always bothered me: to protect the note, you first have to hand the whole identified note to someone else. So we built a de-identifier that runs in the browser, on the same machine as the note, and sends nothing anywhere. Then we tested, honestly, how far that constraint lets you get.
The setup
This grew out of prerounding work with Dr. Nitin Seam: notes that needed to be shareable for research and teaching, under a constraint set fixed on day one. No identified text leaves the device. A clinician reviews every redaction. Any later use, like an AI chat, starts only from reviewed, de-identified text.
Presenting problem
Cloud de-identification carries a contradiction: the top-scoring service in the benchmark the paper cites got there by receiving the full identified note. A contract, a business associate agreement, is an assurance, not a control a clinician can verify.
The second problem is size. The models small enough to run in a browser start out much weaker than the one strong clinical model.
What I built
A prototype with four parts: a neural de-identification model that runs on the device, a deterministic rule layer on top, a mandatory clinician review step, and an encrypted browser-local vault for accepted drafts.
Plus the two learning ideas the paper tests: a batch rule layer that mines readable rules (propose, suppress, relabel) from a model's own errors, and an incremental engine that learns rules continuously from clinician corrections, promotes them only after confirming votes, and retires its own bad rules.
The identifiers are scored across nine categories: AGE, DATE, DOCTOR, HOSPITAL, ID, LOCATION, PATIENT, PHONE, and WEB.
Workup
The evaluation ran on 1,381 SHIELD notes, real Stanford STARR-OMOP narratives whose identifiers were replaced with surrogates, holding 10,229 gold identifier spans across the nine categories. Scoring used F2, because a missed identifier costs more than a false alarm.
The demo at the top of this page is that pipeline: the same Quick De-ID component and the same model pack as the full app, running in this tab. Find each identifier, tag its type, replace it, and keep the clinical text around it readable.
Discharge summary
- The strong clinical model (the Stanford website model) reached F2 0.8287 on all 1,381 notes. No adaptation method improved it (rule layer: +0.0004).
- The rule layer lifted all eight browser models, with a mean gain of +0.1009 F2. The weakest model went from 0.0558 to 0.3262, and GLiNER from 0.5348 to 0.6858.
- The incremental engine, learning only from corrections, raised GLiNER from F2 0.5348 to 0.6362 after 40 corrections, and held up under noisy corrections in the runs the paper reports.
- The limit, stated as plainly as the gains: even the strongest setup still left at least one missed identifier in 30.7% of notes, so nothing here is safe to release without clinician review.
- Zero-egress validation: the report shipped with the app (docs/benchmarks/de-identification/validation/ws2-zero-egress) captured every request in cold and warm browser sessions against the deployed tool and found zero requests to remote hosts and zero POSTs during de-identification.
The evaluation is neither a HIPAA Safe Harbor nor an Expert Determination conformance check, and every configuration's output must be treated as still containing PHI until one is separately done.
The manuscript, “Browser-Local De-identification of Clinical Text: Automatic Rule Adaptation, Its Limits, and Learning from Clinician Corrections,” is held as a reserved draft on Zenodo (DOI 10.5281/zenodo.23372242). That DOI is a reserved draft identifier: it does not yet resolve, and will when the draft is published.
What I’d do differently
Lead with the paper's own main negative result: the recall floor that vets every learned rule passed on the small gate set and then failed on unseen notes for six of the eight browser models, because the floor was checked on the same notes that produced the rules. The fix named in the paper is to gate the floor on held-out corrected notes.
Two debts the manuscript names itself are still open: measure how often clinician reviewers actually catch the misses, which has not been measured yet, and get timing on low-end devices. The paper's timing, 0.95 seconds per note on average, comes from a server-class VM.