For clinics, hospitals and practices
Take the patient’s name off it before it goes anywhere
A referral, a teaching slide, a second opinion, an insurance claim — every one of them starts with removing the identifiers, and every free tool that offers to help wants the scan uploaded first. That is the disclosure you were trying to avoid, performed in order to avoid it.
Identifiable patient data has a property that makes it unlike almost any other sensitive file: once it has been sent somewhere it should not have gone, there is no version of putting it back. Deletion by the recipient is a promise, not a remedy, and the duty that was breached was breached at the moment of sending.
Which is why the ordinary workflow is quietly alarming. To anonymise a scan for a teaching set, the usual route is to upload the identifiable version to a website nobody in the organisation has assessed, so that it can hand back a version with the identifiers removed. The unredacted file is the one that travels.
Here the file does not travel at all. The page does the work in the tab that is already open, which you can confirm without taking anyone’s word for it: turn off the wifi and try it. It keeps working, because there was never anything on the other end.
What to use
- Redact a reportDeletes the name, the hospital number and the date of birth from the text itself rather than covering them. Search the output afterwards to confirm.
- Strip image metadataA photograph taken on a ward carries the time, often the location and sometimes the device. None of that is visible in the picture and all of it travels with the file.
- Inspect a document’s propertiesA discharge summary written from a template usually still names the author and the practice in its properties.
- Read text off a scanPulls the typed content out of a scanned page so it can be quoted or searched, without the page being sent for processing.
- Make it small enough to sendImaging exports are large, and most clinical systems and insurers cap what they will accept.
What this will not do
Worth reading before you put a client’s file through it.
- — It is not a medical device and produces nothing for diagnostic use. It handles documents, not clinical decisions.
- — It does not read DICOM. Export to PDF or an image first, and be aware that export itself can carry metadata across.
- — Removing what you select is all it does. It cannot recognise an identifier you did not mark, and a name burned into the pixels of a scan is part of the picture — crop or paint it out, do not rely on text redaction.
- — Nothing here constitutes compliance with your jurisdiction’s patient data rules. It removes the obligation to upload; the rest of the obligation stays yours.
Check it rather than trust it
Turn off your wifi and use any tool here. If the work still happens, the file is not going anywhere — that is a proof you can perform in three seconds, and it beats anything we could write. The longer version, with the protocol and the result, is on the proof page.
Everything here is free, MIT-licensed and has no account, quota or watermark. It is maintained by one person, unpaid. If it saves you an afternoon, you can support the work.