How to send clinical notes to a cloud LLM without sending the patient

Why not just send the PDF?

A PDF that looks redacted can still leak: the hidden text layer under black boxes, document metadata, embedded attachments, scanned signatures, logos and repeated headers. Sending extracted, sanitized text removes all of those channels at once. If the model needs the layout, send a rasterized image of the already-redacted page, with no text layer or metadata.

Why tokens instead of [REDACTED]?

If every identifier becomes the same placeholder, the model loses the structure of the note: it cannot tell the patient from the attending physician or the son. Consistent tokens keep that structure:

• Mary Frances Rogers becomes NAME_1 everywhere in the document.
• Dr. Louise Meyer becomes NAME_3.
• 03/14/2026 becomes DATE_1.

The model can now reason about "NAME_1's discharge plan" and its answer will use the same tokens.

The pipeline, step by step

1. Ingest: native PDFs are read directly; scanned ones go through local OCR.
2. Detect: rules for local identifiers (SSN, MRN, member ID), a clinical NER model and, optionally, a local LLM second pass.
3. Transform: tokenize or synthesize per entity type; shift dates by one offset per patient so intervals survive.
4. Vault: store the token-to-value map encrypted, on your side only.
5. Send: only the transformed text goes to the cloud model.
6. Re-hydrate: replace tokens in the answer with the real values, locally.
7. Audit: log what was detected and sample outputs for human review.

Is the tokenized text anonymous?

No. As long as a vault can reverse the tokens, what travels is pseudonymized data. Under HIPAA, the Safe Harbor method requires removing 18 identifier types, and full dates other than the year are among them, so date shifting on its own does not meet Safe Harbor; it is usually paired with Expert Determination. The details are in Pseudonymization vs. anonymization under HIPAA, GDPR, LGPD and Colombia's Law 1581. In practice, teams combine the gateway with contractual controls from the cloud provider: a business associate agreement, zero data retention and a defined processing region.

What makes this pass a privacy review?

A number. For example: recall of 99% or higher on direct identifiers, measured on your own annotated validation set, plus periodic human sampling. How to run a de-identification POC: 100 to 200 real documents and recall per entity explains how to get that number.

See it working

The Velo portal shows this exact flow: a discharge summary tokenized under your scroll, the path to the cloud and back, and a hold-to-re-hydrate control. You can also paste your own note; it is processed in your browser.

This article is general information, not legal advice.