Get the whitepaper!
The Test Data Imperative: Towards SAP Autonomous Enterprise

Format · Clinical notes

Clinical notes and medical documents, de-identified for testing

Discharge summaries, lab reports, referral letters and SOAP notes are the hardest data to test with. Under HIPAA's Safe Harbor method, 18 kinds of identifier have to go, from the free text as well as the structured fields.

Get a 48-hour proofSynthetic medical samples
soap-note.docxMasked in your VPCIllustration
Before
S: 34F, Maria Lopez, MRN 448210, seen 03/09/2026 at Riverside Clinic. Chest pain since Tuesday. Husband Carlos present.
After
S: 34F, PATIENT_2C91, MRN MRN_0007, seen [DATE] at [FACILITY]. Chest pain since Tuesday. Husband [RELATIVE] present.
Found in this file
Treatment
Patient name×1Token
Record number×1Token
Visit date×1Redact
Facility×1Redact
Relative×1Redact
Policy: Safe Harbor v2 Labelled-sample check passed

Identifiers to remove

A selection of the 18 Safe Harbor identifiers, which cover the patient and their relatives, employers and household members. HHS guidance

NamesPlaces smaller than a stateDates except the yearAges over 89Phone, fax and emailSSNs and record numbersHealth plan and account numbersDevice identifiers

Where it lives

  • Notes in electronic health records
  • Discharge summaries and referral letters
  • Lab and pathology reports
  • Clinical trial documents
  • Claims attachments

What you can do

Engineer-ledMedical documentsMask clinical documents in PDF and DOCX with document masking, in your own environment.
Engineer-ledSynthetic medical documentsLab reports, SOAP notes and discharge summaries for synthetic patients. See samples.
Engineer-ledNotes in EHR fieldsDe-identify free-text notes stored inside clinical databases, consistent with the masked patient record.
Engineer-ledEvidence for an expertCounts of what was found and treated per document, for a statistician working under Expert Determination.

Why clinical text is hard

  • Drug and condition names can look like surnames, and surnames like drugs.
  • Relatives, initials and dates written as "Tuesday" all need judgement.
  • Ages over 89 must be grouped, not just left as numbers.

Used for

Testing document AI and OCREvaluating clinical AI safelyTesting PII and PHI detectionSharing data with partners

Questions about clinical data

Is this HIPAA compliant?

De-identification is a process your organisation is responsible for, not a certificate a tool can give. Synthesized provides the masking and the evidence of what was treated, for either Safe Harbor or Expert Determination.

Safe Harbor or Expert Determination?

Safe Harbor removes a fixed list of 18 identifiers. Expert Determination has a qualified expert judge that the risk of re-identification is very small, which can keep more useful detail. Test data usually starts with Safe Harbor.

What about UK and EU health data?

Under UK and EU GDPR, health data is special category data, and pseudonymised data is still personal data. Masked test data lowers risk; whether it counts as anonymous depends on how identifiable what remains is.

The platform underneath, in production

Clinical documents run on the same platform health companies already trust with sensitive health data.

Documents and text use the same policies, the same engine and the same deployment as these results.

Health · masking20bn+rows masked and subsetted in hours, not weeks, with all manual configuration removed.Global HealthTech leaderCase studyHealth · lab systemsMinutesto mask 30 to 200 GB per environment for a digital pathology lab system, so patient data never reaches test.HealthTech lab system providerCase study

Published results from database and synthetic data work on the Synthesized platform.

Test clinical software without patient data

Start with synthetic documents, and mask the real ones you can't avoid.

Get a 48-hour proof