Data redaction is when you permanently remove pieces of information from a document or email before others can view it. This could be a name, date, or account number. Redaction is just a method under HIPAA and does not have meaning on its own. Once those identifiers are removed, you can no longer consider it protected health information (PHI) if you follow the Safe Harbor or Expert Determination rules from HHS on de-identifying data.

When redacting an email, you will need to apply this to free text as well. Most of an email will consist of free text. If you are manually redacting an email, you are making a HIPAA decision with every piece of information you delete. According to Paubox's 2026 Healthcare Email Security Report, 170 breaches were associated with email in 2025. 53% of these breached organizations used Microsoft 365. Redacting your email will affect the content of your email. Using HIPAA compliant email ensures your email is safely delivered.

 

Treat redaction as a method, not a legal status

As mentioned above, there are two ways to have your data de-identified. You can have an expert make that determination for you, or you can remove all identifiers with no actual knowledge that the data could be used to identify an individual. After one of these steps is completed, the privacy rule does not apply to that data because it is no longer considered PHI.

If you only redact some information, you will not fall under this. Maybe you redact a patient's name in an email regarding their lab work. However, the date they collected the sample, location of the facility, and their diagnosis are still included. You are limiting the amount of PHI being disclosed, but you should still consider this PHI.

 

Check redacted content against the Safe Harbor list

You will need to remove all 18 identifiers of a patient, family member, employer, and household member. There are many identifiers on this list that you may not know about. All date elements besides the year; date elements on lab reports. All partial identifiers also do not meet the safe harbor requirements.

You would need to redact a patient's initials and last 4 digits of their SSN. Safe Harbor does not require you to redact the name of a physician or employee. There may still be reasons to redact this information, but it's not a HIPAA requirement. You could include a cardiologist's name in an email that is being sent to a training company after the patient information is removed.

 

Use Expert Determination when dates and locations matter

Some of this information is useful when you want to de-identify data for a secondary purpose. You may want to know what date a patient received services to look at readmissions. An expert who knows statistical and scientific methods can make this determination for you. They will need to state that the chance of someone identifying a patient is very small and provide their methodology and results.

There is no number that HHS defines as very small. There is also no requirement that this person have any credentials. If OCR were to question this determination, they would look at the expert's qualifications. Since you are determining this based on the recipient, the information may meet this requirement for one group and not another. Make sure you have documentation from your expert if you are emailing this information to others.

 

Plan for free text, where most identifiers hide

According to a study published in the Journal of the American Medical Informatics Association, they used automated systems to redact 3,503 clinical notes from Cincinnati Children's Hospital Medical Center. These notes were taken from over 5 million notes and contained over 22 types of note documentation. They found that automated systems could achieve 91.92% sensitivity and 95.08% precision. The study went on to say "rivals the performance of human annotators". They had two other human annotators that achieved 92.15% and 94.55% sensitivity on a 10% sample.

Human oversight varies greatly when manually redacting. Another JAMIA study on using neural networks to de-identify data found humans had a recall of .63 to .94 when 14 clinicians reviewed approximately 130 patient notes. These clinical notes were all from one children's hospital, so you will need to test on your organization's email.

 

Apply minimum necessary before redacting an email

Minimum necessary requires you to only disclose the amount of PHI that is needed for that task. There is an exception when disclosing to a health care provider or if they are requesting the information. You would not need to redact your email when referring to another specialist.

Minimum necessary still applies to payments and operations. If you are contacting an insurance company about a denied claim,, you can likely redact diagnoses, notes, and any other information that isn't related. You should also review your subject lines and attachment file names for PHI. According to a Paubox survey, 86% of healthcare IT leaders stated that they feel their email security software creates friction in their workflows. Users admit to going around these tools to get their jobs done.

Read also: When do you have to use deidentified data sets?

 

Recognize what redaction cannot establish

You will never know if someone can identify that patient after you redact. HHS says, "Although the risk is very small, it is not zero" when following either of these methods. Remember there is also a clause about actual knowledge. If you know that a case was made public or someone can identify a family member, you are not de-identifying the data. Automated systems are not perfect. The best system in the study above missed 138 out of 410 identifiers in the "other" category. It identified the name of a device ("Sheehy tube") and pain scores ("2/10") as names or dates. You will also lose some functionality by de-identifying your data. If you are sending an email for a secondary purpose, you will want to redact. If the recipient does not need to know who the patient is, then redaction can help. If you are trying to notify a patient or provider about their care, you will not want to redact. That's where email encryption can come in handy.

See also: The difference between anonymization and de-identification

 

FAQs

Does removing a patient’s name make an email de-identified?

No, because Safe Harbor requires removal of eighteen identifier types, including date elements other than year, and any remaining detail may still identify the patient.

 

Can a covered entity send a redacted email without encryption?

Information properly de-identified under either method falls outside the Privacy Rule, but a partly redacted message is still PHI and needs transmission safeguards such as encryption.

 

Does the minimum necessary standard require redaction in referral emails to a specialist?

No, because HHS excludes disclosures to or requests by a health care provider for treatment from the standard.