PaperlayerView exact revision on arXiv

Source-linked AI summary

TIDE 2.0: an open, model-agnostic engine for keyed de-identification of clinical notes

Jose D. Posada, Somalee Datta, Priya Desai

arXiv:2610.07224v1cs.CLcs.AI

TL;DR

Clinical notes contain care information that structured records can miss, but research use requires removing PHI without discarding clinical content or longitudinal links. TIDE 2.0 separates an interchangeable recognizer from keyed anonymization; its default configuration detected 0.88 of Stanford PHI spans and 0.77 on a second institution's corpus.

  • Problem

    Research use of clinical notes requires PHI removal, while redaction, date blanking, and independently randomized surrogates can discard clinical content or longitudinal links.

    Source: Introduction · pp. 1–2

  • Method

    TIDE 2.0 separates an interchangeable recognizer from a keyed, table-free anonymizer that uses consistent surrogates and interval-preserving date shifts.

    Source: Introduction · p. 2, Discussion · p. 8

  • Results

    Recall was 0.88 on the Stanford corpus and 0.77 on the second institution's corpus; corresponding precision was 0.88 and 0.87.

    Source: Discussion · p. 7

  • Takeaways & Limitations

    The released engine and recognizer can be run, inspected, and extended by other sites within their own environments.

    Source: Discussion · p. 8

    Short-identifier encryption uses padding and truncation to enforce a domain of at least 10^6, making the resulting map many-to-one.

    Source: Anonymizer and cryptographic… · p. 13

Abstract

from arXiv · show

Clinical notes capture most of what is documented about a patient's care, but they cannot be used for research until protected health information (PHI) is removed. De-identification is often treated as a detection problem. Detection alone is not sufficient: redaction strips clinical content along with identifiers, date blanking destroys the temporal intervals needed for longitudinal analysis, and assigning a fresh random surrogate at each occurrence breaks links between a patient's notes. We present TIDE 2.0, an MIT-licensed engine with two separable stages: an interchangeable recognizer and a keyed anonymizer. Both run on hardware the institution owns. Surrogates are generated cryptographically with no stored linkage table. Dates shift by a per-patient, interval-preserving offset; each value receives the same surrogate across all occurrences under a given key; and a release produced under a new key cannot be linked to earlier releases. We also release TIDE2-Sentry, a recognizer distilled from a large language model. On two gold-annotated corpora from two institutions, the default configuration reached span-level recall of 0.88 in-domain and 0.77 on the second institution's corpus, at precision 0.88 and 0.87. We report recall and precision per category alongside these aggregates. The engine is open source, and the recognizer is available under a gated research-use agreement, so institutions can run, inspect and extend both within their own environments.

Introduction

Clinical notes preserve care details and temporal histories missing from structured data, but research use requires PHI removal. TIDE 2.0 separates recognition from keyed anonymization to preserve clinical content and cross-note utility while running on institutional hardware.

Introduction

  • Clinical notes contain care details, including diagnoses and treatment reasoning, that are absent from structured research-warehouse tables.Source: Introduction · p. 1
  • PHI must be removed before research use, while access restrictions can limit the assembly of large note corpora.The passage identifies 18 HIPAA Safe Harbor PHI categories and notes that missed identifiers can result in reportable disclosure.Source: Introduction · p. 1
  • Redaction can remove clinical content, date blanking loses longitudinal intervals, and independent random surrogates break cross-note linkage.False-positive detections changed clinical meaning in a physician review, and detection F1 did not reflect that loss.Source: Introduction · p. 2
  • TIDE 2.0 combines an exchangeable recognizer, institutional-hardware execution, and realistic surrogates consistent across a patient's notes.The passage contrasts this combination with prior tooling gaps, including coupled stages and cloud services that send clinical text outside the institution.Source: Introduction · p. 2
  • The MIT-licensed framework separates recognition and anonymization, with cached spans reviewable before text changes and stages that can be replaced independently.The stages run on Ray and can read from and write to warehouse note tables; the paper does not report a warehouse-scale deployment.Source: Introduction · p. 2, Figure 1 · p. 3
  • The keyed, table-free anonymizer preserves date intervals and gives each value the same surrogate under one key, while a new key prevents linking releases.The default recognizer pairs a distilled token classifier with regex; its evaluation covers two gold-annotated corpora from two institutions.Source: Introduction · p. 2

Results

The default configuration reached micro-averaged recall of 0.88 on SHIELD and 0.77 on i2b2 2014, with precision of 0.88 and 0.87, respectively. The study also reports cross-corpus category differences, distillation fidelity, anonymizer checks, and throughput conditions.

Study design

  • 0.88 micro-averaged recall at 0.88 precision on SHIELD and 0.77 recall at 0.87 precision on i2b2 2014 were achieved by the default configuration.Table 1 covers recognizers on both corpora at a span-overlap threshold of 0.8.Source: Study design · pp. 3–4, Table 1 · p. 4
  • AIMI v1 reached 0.72 micro-averaged recall at 0.67 precision on SHIELD, while TIDE 1.0 reached 0.39 recall at 0.48 precision.AIMI v1 was trained on i2b2 2014, so that corpus was not held out for it.Source: Study design · pp. 3–4, Table 1 · p. 4
  • The six external open-source taggers had micro-averaged recall ranges of 0.30–0.51 on SHIELD and 0.18–0.48 on i2b2 2014.They were trained on non-clinical or non-US identifier distributions and were used as out-of-distribution probes, not tuned baselines.Source: Study design · p. 4
  • The regex layer's net effect on detection was small across the two corpora, with micro-averaged recall changes of -0.001 on SHIELD and +0.003 on i2b2.Scoring choices also mattered: without crosswalk boundary alignment, i2b2 recall was 0.69 rather than 0.77; the other checks were run only for the default configuration.Source: Study design · pp. 4, 6
  • 0.11 of TIDE2-Sentry's micro-averaged recall was lost from SHIELD to i2b2 2014, falling from 0.88 to 0.77.Precision changed from 0.89 to 0.87.Source: Study design · p. 4
  • HOSPITAL, ID, and PHONE contributed 56% of the cross-corpus recall drop, while DATE contributed 33%.HOSPITAL recall fell from 0.79 to 0.39, PHONE from 0.85 to 0.56, and ID from 0.90 to 0.64; the authors describe local vocabulary and format differences as hypotheses, not analyzed causes.Source: Study design · pp. 5–6

Distillation, anonymizer and throughput

  • 0.81 macro-averaged recall was reached by the student, compared with 0.90 for its teacher, and the student had lower recall in every category.The student and teacher both had their lowest recall on LOCATION: 0.55 and 0.66, respectively.Source: Distillation, anonymizer and throughput · p. 6
  • 100.0% of trials met each of four structural checks: determinism, cross-note consistency, remapping under a new key, and interval preservation.These were unit-level checks on a seeded synthetic set containing no PHI, not a re-identification or linkage attack; name collisions measured 0.4% among 2,000 names and 3.3% among 20,000.Source: Distillation, anonymizer and throughput · pp. 6–7, Table 2 · p. 6

Discussion

The default configuration achieved span-level recall of 0.88 on Stanford and 0.77 at a second institution, while per-category results and untested downstream utility qualify the findings.

Discussion

  • Span-level recall was 0.88 on Stanford and 0.77 at the second institution, with precision 0.88 and 0.87, respectively.These results are for the default configuration.Source: Discussion · p. 7
  • Recall and precision are reported separately because missed identifiers risk disclosure while false positives replace clinical content; F1 conflates these consequences.Recall is the primary outcome; precision indicates how much clinical content survives replacement.Source: Discussion · p. 7
  • TIDE2-Sentry micro-averaged recall was 0.88 versus AIMI v1’s 0.72 on SHIELD and 0.77 versus 0.67 on i2b2, which was not held out for AIMI.The external taggers were robustness probes, not clinical-note systems.Source: Discussion · p. 8
  • The open engine separates exchangeable recognition from keyed anonymization; key rotation remaps surrogates but does not change releases already issued.A party holding a disclosed key could recompute surrogates in prior releases, which would need withdrawal or re-issue.Source: Discussion · p. 8
  • At the second institution, HOSPITAL, PHONE, and ID contributed 56% of recall loss, while DATE contributed 33%; local-format explanations remain unconfirmed.The authors did not analyse missed spans, and cross-corpus differences also include note types, surrogate identifiers, and label crosswalks.Source: Discussion · pp. 8–9
  • No downstream phenotyping or temporal-reasoning experiment, linkage attack, or re-identification attack was run, so downstream equivalence is not demonstrated.Utility preservation is argued by construction and verified structurally.Source: Discussion · pp. 9–10

Methods

The evaluation compares Stanford SHIELD with the i2b2 2014 corpus from a second institution, using a gold-label crosswalk to align their different taxonomies and span boundaries. The setup also documents label exclusions and training-data overlap risks that qualify interpretation of the comparison.

Corpora

  • SHIELD contains 1,381 Stanford notes and 10,229 spans; crosswalked i2b2 contains 1,304 notes and 27,298 spans from a second institution.The original i2b2 annotation has 28,867 spans before crosswalking; its PHI values are realistic surrogates, which may affect recall relative to real identifiers.Source: Corpora · pp. 10–11
  • The i2b2-to-SHIELD crosswalk was applied to gold labels at scoring time, and its decisions were made with access to both evaluation corpora.The mapping does not affect SHIELD scoring; i2b2 recall without boundary alignment is also reported.Source: Corpora · p. 10
  • i2b2 DATE and AGE map unchanged to SHIELD categories, despite differences in date conventions and age-span boundaries.Both corpora annotate ages at every value, while the age-span extent disagreement is handled through boundary alignment.Source: Corpora · p. 10
  • i2b2 PROFESSION and ORGANIZATION gold spans are excluded because they lack SHIELD counterparts and are not Safe Harbor identifiers.External taggers' company_name output maps to HOSPITAL, so a non-hospital organization can count as a false positive without a matching gold span.Source: Corpora · p. 10
  • Boundary alignment extends 1,390 age spans and merges 950 adjacent address components before producing the 27,298-span i2b2 gold set.Age numerals gain following units, while adjacent LOCATION components within two characters of whitespace or punctuation are merged.Source: Corpora · p. 11
  • The distilled recognizer's training notes are disjoint from both corpora at note level, but patient-level disjointness from SHIELD was not verified.AIMI recognizers were trained on i2b2 2014, so that corpus is not held out for them; SHIELD note or patient overlap with their Stanford radiology training data was also not verified.Source: Corpora · p. 11

System architecture

TIDE 2.0 separates recognition from anonymization, with a cached span representation that supports review and independent changes to either stage. Its keyed anonymizer preserves selected identifier formats and patient-level date intervals, while key rotation changes surrogates across releases.

System architecture

  • A cached span representation separates recognition from anonymization, letting reviewers audit detections before text changes and replace either stage independently.Sites can run, audit, and rerun recognition without re-anonymizing previously processed notes.Source: System architecture · p. 11
  • Token classifiers, LLM recognizers, regular expressions, and Aho–Corasick gazetteers share one recognition interface.Aho–Corasick can match a site's facility names and identifier formats in one pass without GPU work.Source: System architecture · p. 11
  • Ray runs GPU inference alongside CPU windowing, reassembly, matching, and anonymization, splitting and retrying batches after out-of-memory errors.Token windows use a 512-token budget with 40-token overlap to realign span offsets after reassembly.Source: System architecture · p. 11
  • The library provides command-line pipeline execution, side-by-side human verification, and a warehouse ETL path that the paper does not evaluate at warehouse scale.The visualizer presents original and de-identified text together; the described ETL writes notes and span metadata back to the source schema.Source: System architecture · p. 11

Anonymizer and cryptographic construction

  • Under a fixed key, the same input receives the same surrogate; a rotated key remaps it without a stored linkage table.The architecture routes resolved spans to an anonymizer applying keyed surrogates, encryption, hashing, and per-patient date jitter.Source: Anonymizer and cryptographic… · pp. 11–12, Figure 4 · p. 12
  • A new study or tenant key deterministically remaps surrogates, preventing linkage between releases made with different keys.A salt and working key are both required to reproduce a surrogate; rotation does not alter releases already issued under the old key.Source: Anonymizer and cryptographic… · p. 12
  • The same patient-specific date offset applies to every date, preserving intervals; its magnitude ranges from 3 to 180 days in either direction.The offset uses HMAC-derived magnitude and sign, with a minimum three-day shift and domain separation.Source: Anonymizer and cryptographic… · p. 12
  • FF3 preserves identifier length and character class, but padding and truncating short identifiers makes the mapping many-to-one; longer inputs fall back to keyed SHA-256.The implementation pads numeric identifiers to six digits and alphanumeric identifiers to four characters before encryption; inputs beyond 56 numeric or 32 alphanumeric characters use the fallback.Source: Anonymizer and cryptographic… · p. 13

Threat model

TIDE 2.0 keeps the original clinical narrative while replacing identifier spans with synthetic PHI, rather than generating synthetic notes or leaving visible placeholders. Its protection is bounded: it addresses single-release identifier exposure and cross-release linkage, but not residual quasi-identifier re-identification or disclosed keys.

Threat model

  • TIDE 2.0 preserves the original note narrative and replaces only identifier spans with synthetic PHI, unlike a generated synthetic note or visible placeholders.MIMIC-IV is cited as an example of a release where readers can see where identifiers used to be.Source: Threat model · p. 13
  • The design makes name and opaque-identifier surrogates one-way and shifts dates, but does not prevent re-identification from residual quasi-identifiers or protect old releases after key disclosure.The paper makes no k-anonymity or HIPAA Safe Harbor compliance claim for released text.Source: Threat model · p. 13

Distillation procedure

TIDE2-Sentry is distilled from LLM-generated span labels into a DeBERTa token classifier, then assessed alongside transformer, rule-based, and external recognizers. The evaluation does not compare other LLMs because the extraction prompt was developed for Gemini alone.

Distillation procedure

  • TIDE2-Sentry is a DeBERTa-v3-large token classifier distilled from Gemini 2.5 Flash using hard span labels from about 13,000 unannotated notes.The teacher API returned extracted spans but no logits; the student learns BIO tags with token-level cross-entropy over 512-token windows.Source: Distillation procedure · p. 13
  • Identified notes were sent to the teacher through a cloud API under a business associate agreement; no other study step sent identified text outside Stanford Medicine.The recognizer covers nine scored categories plus an unscored OTHER catch-all.Source: Distillation procedure · p. 13
  • The teacher prompt was developed on a few dozen notes outside SHIELD and i2b2, then scored on all 1,381 SHIELD notes for distillation fidelity.The prompt is reproduced in Supplementary Note 1.Source: Distillation procedure · p. 13

Comparator recognizers

  • The comparison includes three fine-tuned clinical transformers, regex and gazetteer configurations, TIDE 1.0 on SHIELD, and six external taggers on both corpora.TIDE2-Sentry plus regex is the default; the external taggers serve as an out-of-distribution probe and are not tuned baselines.Source: Comparator recognizers · p. 14
  • No LLM other than Gemini 2.5 Flash is evaluated, because the extraction prompt was developed for that model and cross-model scores would measure prompt fit.Gemini is scored on SHIELD only to measure distillation fidelity.Source: Comparator recognizers · p. 14

Throughput measurement

Throughput was measured for TIDE2-Sentry on one GPU-equipped cloud VM across the full SHIELD corpus and a long-note subset. The benchmark used chained stages and single end-to-end runs, not a production deployment.

Throughput measurement

  • Throughput was measured on one GCP VM with an NVIDIA L4 GPU, 16 vCPUs, and 64 GB RAM.TIDE2-Sentry used a 512-token window budget and 40-token overlap.Source: Throughput measurement · p. 14
  • The benchmark covered the full SHIELD corpus (359,779 content-tokens) and a longest-notes subset (2,096,828 content-tokens) exercising the long-note path.Content-tokens exclude model special tokens and are counted once per note.Source: Throughput measurement · p. 14
  • Stages ran as one automatically chained job, with each configuration timed end to end once; this is a one-machine benchmark, not a production-deployment measurement.The CPU comparison used a single untuned actor, while GPU batch size differed for short and long notes.Source: Throughput measurement · p. 14

Outcomes and statistical analysis

The evaluation prioritizes category- and corpus-level span recall, with precision and throughput as secondary outcomes. It specifies span matching, sensitivity analyses, a recall-drop decomposition, and document-level bootstrap procedures for uncertainty and comparisons.

Outcomes and statistical analysis

  • Span-level recall per category and corpus is primary; secondary outcomes are precision, sustained throughput, and the anonymizer’s structural guarantees.The authors prioritize recall because missed identifiers have legal consequences, while false positives cost clinical words; F1 cannot express that trade-off.Source: Outcomes and statistical analysis · p. 14
  • A predicted span matches a gold span when categories agree and character-offset overlap reaches at least 0.8 of their union.The graded overlap criterion avoids scoring differing corpus boundary conventions as detection errors.Source: Outcomes and statistical analysis · p. 14
  • Matching occurs per document, with each gold span matched at most once; recall and precision are computed from the resulting TP, FP, and FN counts.Recall is TP/(TP + FN), and precision is TP/(TP + FP).Source: Outcomes and statistical analysis · p. 14
  • Micro-averages pool counts across categories, while macro-averages average the nine category metrics equally; sensitivity analyses include recall at τ = 0.5 and character-level recall.Character-level recall measures gold PHI characters covered by any predicted span, regardless of category.Source: Outcomes and statistical analysis · p. 14
  • The SHIELD-to-i2b2 micro-recall drop is decomposed into category-specific recall changes weighted by category share and changes in category mix.The equation’s category-share and recall terms are averaged across the two corpora.Source: Outcomes and statistical analysis · p. 15
  • Uncertainty uses 95% bootstrap intervals from 2,000 document-level resamples; paired resamples test teacher-student and regex-layer differences, with category tests Bonferroni-adjusted across nine categories.The regex effect is reported with 95% percentile intervals; the random seed is fixed at 42.Source: Outcomes and statistical analysis · p. 15

Data availability

Corpus access follows each dataset’s own release terms, while the clinical notes used for distillation cannot be shared. Per-span predictions may be requested from the corresponding author subject to corpus terms.

Data availability

  • SHIELD is available under the release terms stated in its corpus paper.The passage identifies the corpus paper with marker 15.Source: Data availability · p. 15
  • The i2b2 2014 de-identification corpus is available through the n2c2/DBMI data portal under its stated data use agreement.The passage identifies the agreement with marker 20.Source: Data availability · p. 15
  • Distillation notes containing PHI cannot be shared, but per-span predictions on both corpora are available from the corresponding author subject to each corpus’s terms.Source: Data availability · p. 15

Code availability

The core engine is released under MIT, while the TIDE2-Sentry recognizer has gated non-commercial research access without redistribution. The recognizer’s approval is separate from SHIELD dataset approval.

Code availability

  • tide2-core is released under the MIT license.Source: Code availability · p. 15
  • TIDE2-Sentry is gated under Stanford Medicine’s Data Research Use Agreement for non-commercial research, with no redistribution.The recognizer is released on Hugging Face.Source: Code availability · p. 15
  • Approval for TIDE2-Sentry is separate from approval for the SHIELD dataset.Source: Code availability · p. 15

Additional information

The supplementary information follows the references and includes Supplementary Notes 1–3, Fig. S1 and Tables S1–S14.

Supplementary Information

The supplementary information documents the teacher prompt, recognizer selection, teacher–student fidelity, category-level evaluations, implementation settings, and system comparisons. Its tables also examine the SHIELD-to-i2b2 recall drop, the effect of adding a regex layer, and scoring DOCTOR and PATIENT together as NAME.

Supplementary Note 1: teacher extraction prompt

  • The teacher prompt requires exact PHI surface text for offset recovery and was developed on separate notes before one-time scoring on 1,381 SHIELD notes.It emphasizes exhaustive, distinct mentions and exact address and whitespace patterns; the prompt also specifies category definitions and exclusions.Source: Supplementary Note 1: teacher… · pp. 21, 24

Supplementary Note 2: recognizer selection and exclusion

  • Six external PII taggers were selected from leaderboard, model-family, and out-of-distribution checks; other leaderboard entries, GLiNER, and non-transformer models were excluded by pipeline rules.The ekacare model targets Indian names and documents, providing an out-of-distribution check on US clinical notes; AIMI lacks AGE, LOCATION, and WEB labels.Source: Supplementary Note 2: recognizer… · p. 24

Supplementary Note 3: Ray configuration and actor sizing

  • On a 16-vCPU machine, the Ray setup used six two-CPU stage actors plus half a CPU each for reader and writer, while the CPU-only transformer used one untuned actor.More actors over-subscribed the machine and deadlocked the stage; GPU batch size was set separately for short and long notes.Source: Supplementary Note 3: Ray… · p. 25

Supplementary Figures

  • The distilled student trails Gemini 2.5 Flash in recall across every SHIELD category, most for WEB, AGE, and LOCATION and least for DATE.Table S3 reports bootstrap 95% confidence intervals, paired document-bootstrap p-values, and Bonferroni-adjusted values for nine categories.Source: Figure S1 · p. 26, Table S3 · p. 28

Supplementary Tables

  • Tables S1–S2 report per-category precision and recall across recognizers and corpora; external taggers score at or near zero on DOCTOR because their taxonomies lack the patient/provider distinction.The tables also include +regex ablations and an off-distribution probe; Tables S4–S5 provide bootstrap confidence intervals for core recognizers and external taggers.Source: Table S1 · p. 27, Table S2 · p. 28, Table S4 · p. 29
  • Table S3 compares Gemini 2.5 Flash with TIDE2-Sentry by category using 2,000 document-level bootstrap resamples and paired tests, with Bonferroni adjustment across nine categories.∆R is student minus teacher recall, so negative values indicate the student trails.Source: Table S3 · p. 28
  • The i2b2-to-SHIELD crosswalk is applied to gold spans at scoring, yielding 27,298 spans across 1,304 notes after exclusions and boundary alignment.The annotation conventions differ: i2b2 generally marks bare ages and separate address components, while SHIELD includes age units and whole-address spans.Source: Table S6 · p. 30
  • Tables S7–S9 contrast TIDE versions: TIDE 2.0 applies keyed surrogates, format-preserving encryption, or hashes across categories and preserves within-key consistency while remapping under a new key.TIDE 1.0 redacts structured identifiers and uses non-deterministic name and location surrogates; its name surrogate changes at each occurrence.Source: Table S7 · p. 31, Table S8 · p. 31, Table S9 · p. 31
  • Table S12 decomposes the SHIELD-to-i2b2 drop in TIDE2-Sentry micro-averaged recall into weighted category-recall and category-mix terms.The two terms sum to the total drop; a positive value lowers recall on i2b2.Source: Table S12 · p. 32
  • Table S13 reports span-level recall and precision differences for TIDE2-Sentry+regex versus TIDE2-Sentry, with paired-document bootstrap 95% intervals.Micro results pool counts over the nine categories.Source: Table S13 · p. 33
  • Table S14 reports span-level precision and recall when DOCTOR and PATIENT are pooled as NAME, removing the distinction absent from external tagger taxonomies.Results include bootstrap 95% intervals.Source: Table S14 · p. 33
Loading 2610.07224v1…