Has anyone any experience of this?

Every week another health system announces an AI pilot — clinical notes summarised, claims data mined, patient records fed into models to spot risk earlier. Genuinely exciting. Also, if the underlying data isn't anonymised first, a serious liability.

Here's the problem most teams miss:

Structured fields are easy to strip. Name, DOB, MRN — any compliance checklist catches those. But the real PHI exposure lives in the unstructured data: physician notes, discharge summaries, call transcripts, scanned referral letters. That's where identifying detail hides in plain sentences — "the patient's daughter, a nurse at St. Mary's" is enough to re-identify someone even with the name redacted.

Basic redaction doesn't solve this either. Blacking out a name while leaving age, rare diagnosis, suburb and employer intact still leaves a re-identifiable person. True anonymisation has to account for the combination of details, not just the obvious ones.

Why this matters more once AI is in the loop:

→ Every prompt, every fine-tuning run, every vector embedding is a new place PHI can leak or persist
→ HIPAA's minimum necessary standard doesn't relax for AI workflows — it tightens the bar
→ Once patient data trains or informs a model, you can't simply "delete" it back out

The organisations doing this well anonymise before the data ever reaches the model — not as a compliance afterthought, but as the first step in the pipeline. It's the difference between AI adoption that survives an audit and one that becomes the audit's headline finding.

If your AI roadmap includes clinical or patient data, the anonymisation strategy isn't a nice-to-have. It's the foundation everything else sits on.

Free webinar with a leading UK Professor John Macintyre, who will discuss the following topics.

How to Protect Your Business Data

• Risks of sharing business data with public AI
• Common mistakes organizations make when adopting AI
• Regulatory implications under GDPR and EU AI Act

We've built a great solution, but we're a small start up prerevenue, so paying for ads is tricky, do people find Reddit is good for generating leads or interest? I'd be interested in learning from folks that have done this succesfully.

Thanks!