Redact Medical Records PDF — Free HIPAA-Style Redaction
Remove PHI from medical record PDFs: names, DOB, MRN, diagnoses, provider info. True redaction in browser, no upload.
Drop a PDF here or click to upload
Files stay on your device. Max 50 MB.
Why this needs true redaction
HIPAA defines 18 identifiers that turn a medical document into protected health information: names, dates, medical record numbers (MRN), account and certificate numbers, email addresses, device identifiers and more. When records are shared — for a second opinion, an insurance appeal, litigation or research — the identifiers that are not needed must be removed, not just hidden.
Medical PDFs are hostile to casual redaction: identifiers repeat in headers and footers of every page, lab reports mix searchable text with scanned images, and handwriting rides on top of forms. Search handles the repeated typed identifiers in one pass; manual rectangles handle scans, stamps and handwriting.
Because the file never leaves your device, the PHI is never exposed to a third-party server during redaction — a meaningful property when the whole point is limiting who sees the data.
Step by step
- 1
Drop the medical records PDF
Records open locally in the browser. For PHI this matters: no server ever receives the file.
- 2
Search for each identifier
Search the patient name, MRN and date of birth one by one — search runs document-wide, so repeating headers and footers are caught in one pass.
- 3
Draw over scans, stamps and handwriting
Anything without a text layer — scanned forms, physician signatures, stamps — is covered with manual rectangles.
- 4
Apply redactions
Confirm the dialog. Content is deleted from the PDF structure; metadata, annotations and embedded files are scrubbed too.
- 5
Verify and download
The result is re-opened and re-searched for every term you used. 'Verified: 0 matches remain' means nothing extractable is left.
Checklist: what to redact, what to keep
Redact this
- Patient name, date of birth and address
- Medical record number (MRN) and account numbers
- Social Security and insurance member IDs
- Provider names and facility identifiers, if the recipient does not need them
- Dates tied to the patient (admission, discharge, birth) when de-identifying
- Signatures, stamps and handwritten notes that identify anyone
Keep this visible
- Diagnoses and treatment details that are the reason for sharing
- Dates of service, if the recipient needs the timeline
- Lab values and clinical content — redact identifiers, not the medicine
- Anything the insurer, attorney or physician explicitly asked to see
Frequently asked questions
Which identifiers does HIPAA require to be removed?▼
HIPAA's Safe Harbor list covers 18 identifiers: names, geographic detail below state level, most dates, phone and fax numbers, email addresses, SSNs, MRNs, health plan and account numbers, certificate/license numbers, vehicle and device identifiers, URLs, IP addresses, biometrics, full-face photos and any other unique identifying number. Redact whichever of these the recipient does not need.
Half of my records are scanned images. Can I still redact them?▼
Yes. Search only hits the text layer, but manual rectangles remove whatever is underneath — text or image. Draw over identifiers in scanned pages; the pixels under the region are removed, not covered.
Does using this tool make my process HIPAA-compliant?▼
No tool alone confers compliance — that depends on your policies and agreements. What this tool does provide is a strong technical property: the file is processed entirely on your device, so no PHI is transmitted to or stored by a third party during redaction.
The patient name is in the header of all 60 pages. One pass or sixty?▼
One pass. Search runs across the entire document, so searching the name once marks every occurrence on every page.
Does redaction also clean document metadata?▼
Yes. Every apply also scrubs Info/XMP metadata, annotations, embedded files, JavaScript and bookmarks, then rebuilds the file — metadata often leaks patient names even when pages look clean.
Related
Redact PDF
The main redaction tool: search, regex presets, manual regions and automatic verification for any PDF.
Redact Bank Statement
Permanently remove account numbers, transaction details, names and addresses from bank statement PDFs. Free, in your browser, no upload.
Redact SSN
Remove Social Security Numbers from any PDF permanently. Search by SSN pattern or draw boxes. Browser-based, no upload, no sign-up.
Redact Email Addresses
Find and permanently remove every email address in a PDF with pattern search. True redaction in your browser, no upload, no sign-up.
Redact Legal Documents
Redact court filings, contracts and discovery documents correctly: SSNs, account numbers, minors' names, DOBs. True redaction in your browser, no upload.
Redact for FOIA
Prepare documents for FOIA and public records release: remove personal data under privacy exemptions. True redaction in your browser, no upload.
Guide: how to redact a PDF properly
Why black boxes fail, the attacker's checklist and the full sanitization checklist — with an interactive demo.