# Local PHI Scrubber: On-Device PHI Redaction for Clinical LLM Workflows

**Doctoral dissertation contribution · James Weatherhead, advised by Peter McCaffrey, MD · AMIA 2026 Amplify oral, Session CI25**

A Chrome extension that strips protected health information out of a query *on the clinician's own machine*, with a human in the loop — so the external AI tools doctors actually want to use stay usable, and no patient identifier ever leaves the secure environment.

- **On-device:** 3–4B models, run locally
- **Zero:** PHI transmitted off the machine
- **Human-in-loop:** every redaction reviewed
- **Chrome:** fits the existing workflow

The best external AI tools for medicine can't legally see a patient's data. So clinicians either give up the tools — or paste the data in anyway. The Local PHI Scrubber removes that choice.

It is the applied piece of my doctoral dissertation on **privacy-preserving deployment of large language models in clinical workflows**, advised by Peter McCaffrey, MD (Chief AI Officer, UTMB), and the subject of an oral presentation at AMIA 2026 Amplify.

## The boundary problem

Healthcare AI can run under a HIPAA Business Associate Agreement (BAA). But most of the genuinely useful external tools — web search, current-literature retrieval — are **not BAA-covered**. That creates a hard boundary condition: any query carrying protected health information must be reliably de-identified *before it leaves the secure environment*.

When de-identification is weak or awkward, people are forced into a bad trade: expose PHI, or lose access to the tool. In practice that trade is a primary driver of unsanctioned **"shadow AI"** in hospitals — clinicians quietly pasting patient details into consumer chatbots because the sanctioned path is too slow.

## The idea: redact on the device, not in the cloud

The obvious fix — send the text to a cloud de-identification service first — doesn't actually work, because sending PHI to that service *is itself* the disclosure you were trying to prevent. The only way to satisfy "before it leaves the secure environment" is to do the redaction where the data already is: on the clinician's machine.

So the Local PHI Scrubber runs as a **Chrome extension** with a **small (3–4B parameter) language model running locally**. It sits between the clinician and the outside tool, catches PHI in the text on its way out, and lets the clinician confirm the redaction — all without a single byte of the original leaving the device.

### How it works

1. **Detect — locally.** As the clinician composes a query, the on-device model flags the protected health information in it (names, dates, identifiers, and the rest).
2. **Review — human in the loop.** The proposed redactions are surfaced in the browser for the clinician to confirm or correct. The model proposes; the human decides.
3. **Send — redacted only.** Only the scrubbed text is passed to the external tool. The original, un-redacted query never leaves the machine.

```
  Clinician's draft (contains PHI)
    "65M, John Q. Sample, MRN 000-12-3456, admitted 03/02 with chest pain..."
           │
           ▼
  On-device model (3–4B)  ──►  flags PHI  ──►  clinician reviews & confirms
           │                                     (in the browser, nothing sent)
           ▼
  Redacted query leaves the machine:
    "65M, [NAME], MRN [ID], admitted [DATE] with chest pain..."
           │
           ▼
  External tool  (web search · literature retrieval)
           ▲
           └── the original identifiers were never transmitted
```

*The on-device, human-in-the-loop flow. The patient details shown are fabricated for illustration.*

## Grounded in the research

The Scrubber isn't a hunch — it's the third leg of a dissertation whose other two legs are peer-reviewed papers that tell you *why* it's built this way:

- **ASQ-PHI** — an adversarial synthetic-data benchmark that evaluates rule-based, cloud, vector, and on-device (Ollama) de-identification head to head. It's what makes the on-device choice evidence-based rather than assumed. Data in Brief, 2026: https://doi.org/10.1016/j.dib.2026.112586
- **K-anonymity decay** — a study showing how re-identifiability erodes across *multi-turn* clinical conversations, not just single messages. It's why redaction has to be continuous and local, applied to every turn. Frontiers in Digital Health, 2026: https://doi.org/10.3389/fdgth.2026.1832168

Full summaries and citations are on the research page: https://james.jcweatherhead.com/research/

## Where it's presented

**"Local PHI Scrubber: A Chrome Extension for On-Device PHI Redaction in Clinical LLM Workflows"** — oral presentation, **AMIA 2026 Amplify**, Session CI25: *Guardrails, Governance, and Getting It Right* (Amplify 25×5 Track), Grand Hyatt Denver, May 19, 2026.

## Why it matters

Privacy tools fail when they make the safe path slower than the unsafe one. Putting redaction on-device and inside the browser the clinician already uses means the compliant option is also the convenient one — which is the only version of "secure" that survives contact with a busy hospital.

---

*The Local PHI Scrubber is a research prototype and dissertation contribution. On-device de-identification is decision-support with a human in the loop, not a guarantee of complete de-identification; deployment in any clinical setting would require validation against local policy and the applicable HIPAA framework.*

---

- Back to James: https://james.jcweatherhead.com/
- Research & papers: https://james.jcweatherhead.com/research/
- AutoTox write-up: https://james.jcweatherhead.com/autotox/
- Both of us: https://jcweatherhead.com/