Catalyst redaction options · For site privacy and IT leads

Three ways to redact identifiers, and the site approves every redaction

Version 2.2 · Updated 16 October 2026

Source documents carry names, dates of birth and record numbers that a study does not need. The site chooses where they come off, before or after upload.

  1. Site redaction tool

    Before upload. The site redacts with a tool it already has, such as Adobe Acrobat Pro.

  2. In the browser Coming soon

    Before upload. The Castor Catalyst redaction engine runs on the site's own computer. The original never leaves the device.

  3. Castor redacts

    After upload. The engine redacts typed and printed identifiers in the Catalyst Source Gateway, in the site's country.

Before redactionFictional patientLab report before redaction, showing the patient's name, IDs, address, phone, physician and dates, and the first metabolic panel results.
After redactionThe same lab report after redaction: the identifiers are blacked out, dates are reduced to month and year, and age, sex and all results are kept.
Castor Catalyst redaction engine on a lab report: identifiers removed, clinical values kept. In this example, dates are reduced to month and year.

  • No large language models in redaction

    The redaction engine finds identifiers with rules and small purpose-built recognisers trained only on synthetic documents; no large language models and no external services.

  • The site approves every redaction

    No document goes to the Catalyst pipeline until the site approves the redactions, in every path, also when Castor's engine redacted.

  • Catalyst Source Gateway

    No large language models · No other subprocessors

    Study-isolated, encrypted, in the site's country.

The three paths

How each path works, step by step

Paths A and B redact at the site before upload. Path C redacts in the Catalyst Source Gateway straight after upload. Every path ends with the site approving the redactions.

  1. Site redaction tool

    Before upload

    The site can redact any of its own source documents, for example in Adobe Acrobat Pro.1

    1. Work on a copy, never on the source the site keeps. 2. Redact the identifiers with "Sanitize and remove hidden information" switched on. 3. Check every page.

    Redaction needs Acrobat Pro; Acrobat Reader cannot redact.

    The site uploads the redacted copy to the pseudonymised participant ID and approves it for submission.

  2. In the browser

    Coming soonBefore upload

    The Castor Catalyst redaction engine runs on the site's own computer. The original never leaves the device. Same engine as path C.

    1. Load the engine once. IT can run a built-in browser check and a self-test without patient data. 2. Redact in the browser. Nothing is uploaded yet.

    The site checks and approves the redactions, then uploads the redacted copy. The original stays at the site.

  3. Castor redacts

    After uploadNo large language models · No other subprocessors

    The site redacts any handwritten identifiers itself, then uploads; the engine redacts the typed and printed identifiers in the Catalyst Source Gateway, in the site's country.

    1. Upload to the pseudonymised participant ID. 2. Identifiers are redacted from a list based on the Safe Harbor method of the US Health Insurance Portability and Accountability Act (HIPAA).2

    For French sites, Castor redacts (C) only once health data hosting (HDS) is confirmed for the study.

    The site checks and approves the redactions before the document is submitted.

What gets redacted

Identity comes off. The clinical story stays.

The same aim on every page, in every path: redact the identifiers and keep the clinical content readable. The site checks every page before it approves.

  • Redacted everywhere it appears

    Patient names, dates of birth, record and account IDs, phone numbers, email addresses, street addresses and relatives' names.

  • Clinical content kept

    Diagnoses, history, medications and doses, results, units and reference ranges are left unredacted.

  • Dates generalised

    Dates can be generalised to month and year, so 9/22/2026 becomes 9/2026.

Before redactionFictional patientAn electronic medical record office visit note with the patient's name, record number, date of birth, address, phones, email, insurance IDs, emergency contact, and the sister's name in the narrative.
After redactionThe same note redacted: identifiers covered by black boxes, dates shown as month and year, the visit reason and history readable.
Encounter note. Redacted: name, medical record number (MRN), date of birth, address, phones, email, insurance IDs, the emergency contact and the sister's name in the narrative. Dates become month and year.
The benchmark

How well the engine finds patient identifiers

On our benchmark, the engine removed 3,084 of 3,099 patient identifiers. Automatic redactions are then checked by human review.

Castor's benchmark · 146 documents, 585 pages
99.5%

Of patient identifiers removed: 3,084 of 3,099.

98.3%

On 57 held-out documents.

Clinical content
97.1%

Clinical content preserved.

Speed
~5 s

About 5 seconds per page on a standard laptop.

By identifier type, on our benchmark

Castor's benchmark
    • Patient names · 986 of 986100%
    • Dates of birth · 456 of 456100%
    • Phone numbers · 237 of 237100%
    • Email addresses · 38 of 38100%
    • Street addresses · 473 of 47699.4%
    • Relatives' names · 174 of 17599.4%
    • Record and other IDs · 689 of 69998.6%

Share of patient identifiers removed. How this compares with people redacting by hand: manual redaction vs the redaction engine.

Castor's benchmark: 146 documents (585 pages, including 12 real patient records). Castor figures are internal benchmarks, not peer-reviewed.

Manual redaction vs the redaction engine

How people do at finding identifiers, and where they miss them

Published studies measured how many identifiers trained people find in typed clinical notes. The results depend on the documents and the definitions used, so manual redaction is a reference point, not a fixed standard.

  • Published studies · people

    Manual redaction

    Clinicians read typed intensive care unit (ICU) nursing notes and marked the identifiers [Douglass 2004; the same data is reported in Neamatullah 2008].

    • A single clinician, average (range 63 to 94%)81%
    • Two clinicians together94%
    • Three clinicians together98%

    Even three clinicians together did not remove every identifier. Across studies, a single reviewer found from about 66% [South 2014] to about 96% [Dorr 2006], depending on the documents.

  • Castor's benchmark · the engine

    The redaction engine

    The Castor Catalyst redaction engine on our benchmark: 146 documents, 585 pages, including 12 real patient records.

    • All patient identifiers, on our benchmark99.5%
    • Patient names100%
    • Street addresses99.4%
    • Record and other IDs, including record numbers98.6%

Different documents and definitions; not a head-to-head test. The engine and the people in these studies were never measured on the same documents.

Where people miss identifiers

Two annotators each checked 350 paediatric hospital notes [Deleger 2013]. They were strongest on phone numbers, dates and names, and weaker on ID numbers, institutions, locations and other identifiers.

Share of identifiers of each type found: the solid bar is the lower of the two annotators' results, the lighter part reaches the higher one.

  • Phone numbers98%
  • Dates98%
  • Names95–98%
  • ID numbers85–87%
  • Institutions86–87%
  • Locations83–94%
  • Other identifiers66–81%
  • A process failure, not a recall measurement

    When the black box isn't a redaction

    In a review of US court filings, 194 documents had text still readable under redaction boxes, including medical information, addresses and dates of birth [Lee 2011]. A box drawn over text is not a redaction: that is why path A uses Acrobat Pro redaction with hidden information removed, and why drawn boxes are on the list of things to avoid.

  • Time, in typed notes

    Manual redaction takes time

    About 87 seconds per note [Dorr 2006], and about 18,000 words per clinician-hour [Neamatullah 2008].

Where redaction sits

Redaction is a separate service from the AI pipeline

The Catalyst Source Gateway redacts, with no large language models. Hosted on Microsoft Azure; no other subprocessors. The Catalyst pipeline extracts. Only redacted copies pass from one to the other. The providers used in a study, such as Google for AI extraction, are in Castor's sub-processor list.

Catalyst Source Gateway No large language models · No other subprocessors Study-isolated, encrypted, in the site's country.
Data flow for US and EU studies; UK-hosted studies: coming soon. Patient and site: the patient consents to the study and the original record stays at the site. The site redacts a document before upload with a site redaction tool (path A) or in the browser (path B, coming soon); both arrive in the Catalyst Source Gateway as a redacted copy, shown as one arrow. Or the site uploads it unredacted and the Castor redaction engine redacts it in the Gateway (path C). The Catalyst Source Gateway is a separate service with no large language models. Hosted on Microsoft Azure; no other subprocessors. Study-isolated, encrypted, in the site's country. The site approves the redactions before any upload goes to the pipeline. US only: the patient can authorise retrieval of their own health records; these participant-consented records go through the same redaction engine and skip site approval. In the Catalyst pipeline, the service of the sponsor or CRO, AI extracts values from redacted copies only, then review by Castor under the review policy of the sponsor or CRO. AI processing runs in the US for US studies and in the EU for EU studies; UK-hosted studies are coming soon, ask your Castor contact. The EDC holds no personal identifiers.
Data flow for US and EU studies. UK-hosted studies: Coming soon
Decision guide

Which path fits which document

The site can redact any of its own documents itself before upload. Each document type below fits paths A, B and C. Handwritten notes are redacted by the site only.

  • Imaging or lab report

    Check every page, including headers and footers.

  • Typed PDF export

    Check headers, footers and file properties. In path A, sanitise to remove hidden text.

  • Fax

    Check the fax header line on every page and the "Re:" line on the cover sheet.

  • Medical record screenshot

    Check the patient banner, window title, tabs and any second patient. In path A, redact the banner; cropping is not enough.

  • Scanned worksheet

    Check faint or skewed pages, the back of every page, and handwriting: the site redacts handwritten identifiers itself on every path. In path A, mark image areas by hand.

  • Phone photo

    Check page edges and anything else in frame, such as wristbands. Rescan flat if possible.

Handwritten notes: path A only

The site redacts them and checks every page: names, signatures, initials and margin notes. Reviewers check redacted copies.

Path B, in-browser redaction: Coming soon

Site steps

What the site does, in every path

Five steps the site can copy into its own procedure.

  1. Step 1

    Check the approvals

    The study's approvals cover the upload, for consented participants.

  2. Step 2

    Choose the path

    The one the site's privacy officer and standard operating procedure (SOP) allow.

  3. Step 3

    Keep study dates readable

    Where the electronic case report form (eCRF) needs them.

  4. Step 4

    Upload only what the study needs

    Under the right participant ID. In the Catalyst pipeline, an automated check on the redacted copy confirms each document matches the participant.

  5. Step 5

    Approve the redactions before submission

    In every path. A wrong upload can be deleted before it is processed.

Avoid

Patient names, initials, record numbers or birth dates in file names. Drawn boxes or highlighter in a PDF viewer: the text stays underneath. Redacting the original source record. Emailing unredacted documents outside the upload screen.

Agreements

Agreements for path C

Paths A and B are the site's own step. If Castor redacts uploads for the site (path C), a separate agreement with the site may be needed, such as a business associate agreement (BAA) in the US or a data processing agreement (DPA) in the EU. Ask your Castor contact.

  • A redacted copy is still protected data

    The redacted copy Catalyst works on is still protected health information (PHI) under HIPAA and personal data under the General Data Protection Regulation (GDPR). The study's agreements and approvals are on the data journey page.

  • Path C for French sites

    Health data hosting certification (hébergeur de données de santé, HDS) applies to hosted health records of French patients, including redacted copies. For French sites, Castor redacts (C) only once HDS is confirmed for the study.a

Who to ask

Three people to talk to first

Before the site's first upload, settle the path and the paperwork.

  • The site's privacy officer

    Which path and which local tool the site's SOP allows.

  • The study monitor

    How source verification runs for the path the site chooses.

  • Your Castor contact

    Questions about path C for the site.