Redacta
Pseudonymise medical and clinical documents before they're processed by AI or
shared. Redacta replaces patient identifiers with labelled tokens —
[PATIENT_NAME_1], [NHS_NUMBER_1], [DATE_OF_BIRTH_1], … — while leaving the
clinical meaning intact, and returns a redaction report alongside the cleaned
text.
It started as an Agent Skill and is now one engine shipped across eight surfaces — an iOS app, agent skill, MCP server, a self-hosted HTTP service with a Kubernetes deployment, two libraries, a CLI, and a FigJam whiteboard plugin.
Running this in production? Redacta offers a small number of fixed-price design-partner integrations for teams shipping AI agents on clinical or patient data — deployment in your environment, one real workflow integrated, and a data-flow document written for your DPO. Details →
One engine, many surfaces
The detection logic lives in one place — the TypeScript engine
(@pharmatools/redacta, in npm-package/), which the MCP server and the
FigJam plugin consume, and which the iOS app runs on-device via JavaScriptCore.
The Python package mirrors it for pip users; the agent skill adds LLM reasoning
for free-text names on top of the deterministic patterns.
How it works
Two layers:
- Patterns (deterministic). A bundled script (
scripts/redact_structured.py, Python standard library only, no network) matches fixed-format identifiers: NHS numbers (Modulus-11 validated), UK National Insurance numbers, dates of birth, UK postcodes, phone numbers, emails, and hospital/MRN numbers. US SSN and ZIP codes are also handled. - Reasoning (judgement). The skill then has the agent handle what patterns can't: patient names (told apart from the clinicians treating them), relatives and carers, postal addresses, and identifying ages.
- Self-check. A final pass re-reads the output for any identifier that slipped through before the report is written.
It also works in reverse. Re-identification (scripts/reinstate.py) takes the
token map from an earlier redaction and restores the original values — so you can
redact a document, run it through another AI tool, and put the real details back
locally. Redact → process → re-identify is a complete round trip, and identifiers
only ever exist on your machine.
Safe Harbor mode. Ask for HIPAA Safe Harbor (or "US de-identification") and Redacta applies a stricter pass: all dates (not just the date of birth), all specific ages, and the remaining HIPAA identifiers — fax, certificate/licence, device serial, VIN, and health-plan beneficiary numbers.
Self-hosting on Kubernetes
Organisations that can't let identifiable text leave their environment can
run Redacta inside their own infrastructure: a small HTTP service
(gateway-service/) deployable into an existing
Kubernetes cluster with plain YAML — two stateless replicas behind a
Service for redact/reinstate, an optional single-replica session boundary
for the protect → release loop, health probes, resource limits, restrictive
security defaults, and no-PHI logging. Text is pseudonymised before it
reaches any external AI service, and the processing boundary stays under
your control. Walkthrough (local kind cluster included):
gateway-service/k8s/README.md ·
concepts: docs/KUBERNETES.md.
Deploying somewhere a DPO will ask questions? There's a one-page security &
data-protection summary at
pharmatools.ai/redacta-security.
Install
Claude Code
git clone https://github.com/nickjlamb/redacta ~/.claude/skills/redacta
Then invoke it with /redacta, or let it trigger automatically when you ask to
redact or de-identify clinical text.
Claude apps / API
Zip the repository folder and upload it as a skill.
Contents
Run the tests:
python3 scripts/test_redact_structured.py
python3 scripts/test_reinstate.py
A note on limits
Redacta is a strong first line of defence, not a guarantee. It won't catch every possible identifier and isn't a substitute for formal data-protection processes. Always review the redaction report before sharing text.
License
MIT-0 (MIT No Attribution). Built by PharmaTools.AI.
