De-identify surgical pathology reports under HIPAA Safe Harbor – CCPA/HIPAA-compliant de-identification per 45 CFR §164.514(b)(2)

Surgical pathology reports link patient identifiers — name, MRN, date of biopsy, specimen accession number — to histologic findings and oncologic staging information. anonym.legal removes all 18 §164.514(b)(2) Safe Harbor identifiers from pathology reports while preserving histologic descriptions, cancer staging, surgical margin status, and biomarker results for peer review, oncology audit, and tumor board case studies.

When this applies

Apply this workflow when pathology reports are shared with tumor board members at external institutions, included in oncology registry submissions requiring de-identified data, or prepared as educational case materials, and patient identity must be removed under the Safe Harbor standard.

  1. Upload pathology reports in PDF or DOCX format to anonym.legal.
  2. The engine identifies Safe Harbor identifiers in the report header and body: patient name, MRN, date of birth, date of service, specimen accession number, and ordering and signing pathologist names.
  3. All 18 Safe Harbor categories are removed; specimen accession numbers (certificate or license numbers under category (11)) are replaced with synthetic codes.
  4. Histologic diagnosis, tumor grade, TNM staging, surgical margin findings, and immunohistochemistry results are preserved in full.
  5. Ordering and signing pathologist names are removed; their roles (e.g., 'attending pathologist', 'fellow') are retained.
  6. A de-identification certificate is generated and the de-identified report is delivered for approved secondary use.

What you provide

  • Surgical pathology reports (PDF or DOCX)
  • Specimen accession number list (to verify batch completeness)

Limitations & cautions

  • Pathology reports for rare tumor histologies in small regional populations may remain re-identifying even after Safe Harbor de-identification; supplement with Expert Determination review for rare-entity cohorts.
  • The tool de-identifies the narrative report but does not process associated tissue blocks or glass slides — physical specimen handling remains the responsibility of the pathology department.
  • Molecular pathology reports containing CLIA laboratory identifiers (certificate numbers) must include those identifiers in the de-identification scope; confirm field coverage with the laboratory informatics team.

FAQ

Are specimen accession numbers treated as identifiers under Safe Harbor?

Yes. Specimen accession numbers are certificate or license numbers within the meaning of §164.514(b)(2)(i)(K) when they can be linked back to an individual patient. They are replaced with synthetic codes in the de-identified output.

Can de-identified pathology reports be submitted to the National Cancer Database (NCDB)?

NCDB submissions are governed by the Commission on Cancer data-use agreement and typically require identified data for the initial registry submission. De-identified pathology reports under this workflow are more appropriate for secondary analytical or educational uses rather than primary registry submissions.

Are molecular biomarker results (e.g., HER2, PD-L1, KRAS) preserved in the de-identified report?

Yes. Molecular biomarker results, IHC scores, and mutation status fields are clinical data, not identifiers, and are preserved in full in the de-identified output.

Healthcare Records

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our servers live in Falkenstein, Germany.

We use Hetzner. They hold ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.