Local PHI Scrubber: On-Device PHI Redaction for Clinical LLM Workflows

The best external AI tools for medicine can’t legally see a patient’s data. So clinicians either give up the tools — or paste the data in anyway. The Local PHI Scrubber removes that choice.

It is the applied piece of my doctoral dissertation on privacy-preserving deployment of large language models in clinical workflows, advised by Peter McCaffrey, MD (Chief AI Officer, UTMB), and the subject of an oral presentation at AMIA 2026 Amplify.

The boundary problem

Healthcare AI can run under a HIPAA Business Associate Agreement (BAA). But most of the genuinely useful external tools — web search, current-literature retrieval — are not BAA-covered. That creates a hard boundary condition: any query carrying protected health information must be reliably de-identified before it leaves the secure environment.

When de-identification is weak or awkward, people are forced into a bad trade: expose PHI, or lose access to the tool. In practice that trade is a primary driver of unsanctioned “shadow AI” in hospitals — clinicians quietly pasting patient details into consumer chatbots because the sanctioned path is too slow.

The idea: redact on the device, not in the cloud

The obvious fix — send the text to a cloud de-identification service first — doesn’t actually work, because sending PHI to that service is itself the disclosure you were trying to prevent. The only way to satisfy “before it leaves the secure environment” is to do the redaction where the data already is: on the clinician’s machine.

So the Local PHI Scrubber runs as a Chrome extension with a small (3–4B parameter) language model running locally. It sits between the clinician and the outside tool, catches PHI in the text on its way out, and lets the clinician confirm the redaction — all without a single byte of the original leaving the device.

How it works

1. Detect — locally. As the clinician composes a query, the on-device model flags the protected health information in it (names, dates, identifiers, and the rest).
2. Review — human in the loop. The proposed redactions are surfaced in the browser for the clinician to confirm or correct. The model proposes; the human decides.
3. Send — redacted only. Only the scrubbed text is passed to the external tool. The original, un-redacted query never leaves the machine.

  Clinician's draft (contains PHI)
    "65M, John Q. Sample, MRN 000-12-3456, admitted 03/02 with chest pain..."
           │
           ▼
  On-device model (3–4B)  ──►  flags PHI  ──►  clinician reviews & confirms
           │                                     (in the browser, nothing sent)
           ▼
  Redacted query leaves the machine:
    "65M, [NAME], MRN [ID], admitted [DATE] with chest pain..."
           │
           ▼
  External tool  (web search · literature retrieval)
           ▲
           └── the original identifiers were never transmitted

Grounded in the research

The Scrubber isn’t a hunch — it’s the third leg of a dissertation whose other two legs are peer-reviewed papers that tell you why it’s built this way:

• ASQ-PHI — an adversarial synthetic-data benchmark that evaluates rule-based, cloud, vector, and on-device (Ollama) de-identification head to head. It’s what makes the on-device choice evidence-based rather than assumed. Data in Brief, 2026.
• K-anonymity decay — a study showing how re-identifiability erodes across multi-turn clinical conversations, not just single messages. It’s why redaction has to be continuous and local, applied to every turn. Frontiers in Digital Health, 2026.

Full summaries and citations are on the research page.

Where it’s presented

“Local PHI Scrubber: A Chrome Extension for On-Device PHI Redaction in Clinical LLM Workflows” — oral presentation, AMIA 2026 Amplify, Session CI25: Guardrails, Governance, and Getting It Right (Amplify 25×5 Track), Grand Hyatt Denver, May 19, 2026.

Why it matters

Privacy tools fail when they make the safe path slower than the unsafe one. Putting redaction on-device and inside the browser the clinician already uses means the compliant option is also the convenient one — which is the only version of “secure” that survives contact with a busy hospital.

The Local PHI Scrubber is a research prototype and dissertation contribution. On-device de-identification is decision-support with a human in the loop, not a guarantee of complete de-identification; deployment in any clinical setting would require validation against local policy and the applicable HIPAA framework.