Reference · PHI handling in Webbeon Co-Pilot

What HIPAA protects, and what happens to each part of it.

Protected Health Information is health information that can be tied to a person. It takes two things: an identifier, and clinical content attached to it. Co-Pilot removes the first and keeps the second.

That is the whole mechanism, and everything below is the detail of it — which identifiers, found by what, replaced with what, reversible by whom. This page is written to be checked rather than believed. Where a claim depends on how you configure the system, it says so.

v1.0 · July 2026 · de-identification method: Safe Harbor · engineering reference, not a legal opinion

01· What counts as PHI

Neither half is protected on its own.

A name in a phone book is not PHI. A blood pressure reading with no name on it is not PHI. Put them in the same record and the record is PHI — and stays that way through every copy, export and prompt.

This is why de-identification is the mechanism rather than access control. A record with every identifier removed is no longer PHI under the Privacy Rule, so the question of whether a model vendor may hold it does not arise. The clinical content — the part a model is being asked about — survives intact.

Co-Pilot uses the Safe Harbor method: the eighteen enumerated identifier categories are removed or generalized, dates are cut back to the year, and ages above 89 are collapsed. Expert Determination is not claimed, and no statistical re-identification-risk certificate is issued.

Half one · the identifier

Anything that points at a person

Name, date of birth, address, phone, email, medical record number, insurance member number, account number, exact appointment date. Eighteen categories, enumerated in §02.

Half two · the health information

Anything about their care

Diagnoses, lab results, prescriptions, appointment history, treatment plans, billing records. Retained in full, because it is what the AI is being asked about. Detailed in §03.

What the model receives

Half two, plus stable markers where half one used to be

The same person is the same marker in every file and every year, so records still link. The link just no longer resolves to a name outside your machine.

02· The identifier register

All eighteen Safe Harbor categories, and what each becomes.

Four readers look for identifiers, independently and without consulting each other. Four opinions on the same text is the point — a name missed by one is usually caught by another.

Reader · structure

Reads column headings and field names. A column called Patient DOB tells it what every value beneath is, with no guessing.

Reader · model

A language model that recognizes names, places and organizations from sentence context. The only reader that handles free-text prose well.

Reader · patterns

Knows the shape of record numbers, phone numbers, policy numbers, license plates, URLs and IP addresses. Deterministic, and the strongest reader on structured junk.

Reader · roster

Your own encrypted patient and staff list. It is not matching name-shaped words — it is recognizing specific people, which is why it catches bare cells the others cannot.

Safe Harbor category	Found by	What the AI receives	Reversible by
01Names — patient, relatives, employers, household members	model · roster · structure	<PERSON a91f>	vault · your machine
02Geography below state level — street, city, county, precinct, ZIP	model · patterns	<ADDRESS 77d1> — ZIP: first three digits kept only where that area exceeds 20,000 people	vault · your machine
03All date elements except year — birth, admission, discharge, death, service	structure · patterns	2024 [D1] — year, plus an order tag so intervals stay computable	vault · your machine
03·bAges over 89, and all date elements for those ages	structure · derived from date of birth	90+	nobody — generalized, not replaced
04Telephone numbers	patterns · structure	<PHONE 2be8>	vault · your machine
05Fax numbers	patterns · structure	<FAX 5c19>	vault · your machine
06Email addresses	patterns	<EMAIL 4a10>	vault · your machine
07Social Security numbers	patterns · structure	<SSN 8d42>	vault · your machine
08Medical record numbers	structure · patterns	<MRN 4c07>	vault · your machine
09Health plan beneficiary numbers — member, group, plan	structure · patterns	<POLICY 1c48>	vault · your machine
10Account numbers — patient account, guarantor, invoice	structure · patterns	<ACCOUNT 6f21>	vault · your machine
11Certificate and license numbers — including clinician licenses	patterns · structure	<LICENSE 0e55>	vault · your machine
12Vehicle identifiers, serial numbers and license plates	patterns	<VEHICLE 3b70>	vault · your machine
13Device identifiers and serial numbers	patterns · structure	<DEVICE b284>	vault · your machine
14Web URLs — including patient portal links	patterns	<URL 7a93>	vault · your machine
15IP addresses	patterns	<IP c61d>	vault · your machine
16Biometric identifiers — finger, retinal and voice prints	file-type stage, before any reader runs	nothing — refused	n/a · never left the machine
17Full-face photographs and comparable images	file-type stage, before any reader runs	nothing — refused	n/a · never left the machine
18Any other unique identifying number, characteristic or code	roster · patterns · model	<ID e70b>	vault · your machine

Numbering follows the enumerated categories at 45 CFR 164.514(b)(2)(i). Ages over 89 sit inside category 03 in the statute and are split out as 03·b here because they are generalized rather than replaced. Category 18 is the catch-all, and the roster reader does most of the work on it — so its accuracy is set by the list you supply.

Markers are stable

The same person is the same marker, everywhere, forever

A marker is derived from the value with a keyed hash held on your machine, so it is deterministic for you and meaningless to anyone else. That is what preserves record linkage across files and across years — the model can tie a June lab result to a March visit for the same patient without ever holding a name.

Findings propagate

Found once in a document, gone from all of it

Once any reader identifies a value anywhere in a file, every other occurrence of that value in the same file is replaced too. This is what catches the hard cases: a surname sitting alone in a referral cell, an MRN in a filename, a phone number in a footer — places where no reader has enough context to be sure on its own.

03· Clinical content that is kept

Removing the clinical content would remove the point.

Health information with no identifier attached does not identify anyone. It is also the entire substance of what a clinical AI is asked about, so it is retained — with two exceptions, both noted below.

PHI element	Handling	Why
Diagnoses	retained verbatim · codes and free text	A diagnosis with no identifier attached does not identify a person. Free-text impressions are scanned like any other prose, so a name inside one is replaced in place.
Lab results	retained verbatim · values, units and reference ranges unchanged	Trends only mean something if the numbers survive exactly. Rounding or bucketing them would break the analysis without improving privacy. Specimen and accession numbers are identifiers and are replaced.
Prescriptions	drug, dose, route, frequency retained · prescriber name and license replaced	Clinician names are identifiers under the same rule as patient names, and are handled identically. Prescriptions also carry pharmacy addresses and phone numbers, which are replaced.
Appointment history	retained · every date reduced to year plus order tag	The clinically useful part is sequence and gaps — three visits, then nine months of nothing. The identifying part is the exact calendar day. Order tags keep the first and drop the second.
Treatment plans	retained verbatim	Plans are the densest free text in a chart and the most likely to name a family member, an employer or a home town in passing. All three are identifier categories, and all three are replaced in place.
Billing records	procedure codes, amounts and payer class retained · account, member and guarantor numbers replaced	Revenue and denial analysis needs the amounts and the codes. It never needs to know whose account they sit on.

04· How a record crosses

Six stages, and a gate that fails closed.

The guard is the AI's only route to a file. There is no second path, no cache, and no direct filesystem access — so de-identification is not a step anyone can forget to run.

The gate at stage five is the part worth reading twice. It asks two questions, and either answer of no stops the whole file — including the paragraphs that came through cleanly.

Stage 01

Identify the file by its contents

Not by its extension. A file named notes.txt that is really a spreadsheet is read as a spreadsheet. Anything not confidently readable as text is refused here — which is where images and biometric formats stop.

Stage 02

Split it into pieces that remember their origin

Every paragraph, cell and field carries the position it came from — page, table, row, column, character offset. This is what makes the audit record in §07 possible.

Stage 03

Four readers pass over every piece

Structure, model, patterns, roster — independently, without consulting each other. Every piece is seen by all four.

Stage 04

Propagate every finding document-wide

A value caught once is removed everywhere it appears in that file, including places no reader had the context to catch.

Stage 05 · the gate

May this leave the machine?

Was the entire file extracted, and did all four readers finish on every piece? Either no is a refusal of the whole file. A reader that crashes does not count as having found nothing — it counts as not having looked.

Stage 06

Release markers, log positions, keep values

Marker text goes to the model. The mapping goes to the vault on your disk. The positions and categories go to the audit log. The values go nowhere.

The gate, both ways

Induce a reader failure and watch what the model gets. Software that visibly refuses is worth more here than software that claims never to need to.

gate → extraction complete · 4 of 4 readers finished on 214 of 214 pieces

RELEASED — 7 spans replaced across 5 categories

model receives → de-identified text, markers in place

05· A worked example

One note, before and after.

Nine identifiers across four categories, including a bare surname in a referral row that no reader would catch from context alone — it goes because stage four propagated the finding from the sentence above it. Read the right-hand column and note that the clinical answer is unchanged.

On your machine · intake_note.txt

Patient Ifeoma Chukwuemeka-Bello, age 92, seen 11 March 2024 for follow-up.

Chart MRN 8837261, plan BCBS 4471-882-K. Reachable on 217-555-0143. Lives at 425 Larkspur Avenue.

Swelling unchanged since the last visit. CRP 42 mg/L, down from 61. Continue prednisolone 10 mg daily; review in six weeks.

referral ▸ Chukwuemeka-Bello · orthopedics · 6 wk · dr A. Vasquez

Released to the model · no longer PHI

Patient <PERSON a91f>, age 90+, seen 2024 [D1] for follow-up.

Chart <MRN 4c07>, plan <POLICY 1c48>. Reachable on <PHONE 2be8>. Lives at <ADDRESS 77d1>.

Swelling unchanged since the last visit. CRP 42 mg/L, down from 61. Continue prednisolone 10 mg daily; review in six weeks.

referral ▸ <PERSON a91f> · orthopedics · 6 wk · dr <PERSON 5d2c>

What survived, and why it matters

CRP 42 down from 61, prednisolone 10 mg daily, six-week review, orthopedic referral, patient over 89. Every clinically actionable fact is intact, and the marker is stable — so when the June labs for <PERSON a91f> arrive in a different file, the model links them to this visit on its own. The prescriber became a marker too: clinician names are identifiers under the same rule.

06· What the AI can ask for

Four operations. Everything else does not exist.

Prompt injection works by persuading a system to use a capability it has. The defense here is not a better refusal — it is that the capability was never built. Re-identification is a command a person runs at their own keyboard, and it is deliberately absent from the interface offered to the model.

Offered	What it returns
read a file	The released text of that one file, or a refusal. Never a partial result.
list a folder	Names, sizes and dates — with the names themselves de-identified, because `chukwuemeka-bello-referral.pdf` is an identifier sitting in plain sight.
search	Matches from released text only. A query containing a real name returns nothing — not because the query was blocked, but because that string is not present in anything searchable.
ask what was removed	Counts and categories for a file — `7 spans · 5 categories · 2 propagated`. Enough for the model to know it is reasoning over redacted text. Never a value.

Not offered · no such capability exists

— resolve a marker to its value
— read the vault
— read the patient or staff roster
— write to, rename or delete a file
— reach a path outside the configured folders
— disable a reader or lower the gate

Two attempts, verbatim

model → search files for "Chukwuemeka-Bello"
0 results. That string does not appear in anything the model may look at.

model → reveal the person behind <PERSON a91f>
No such operation. Nothing to refuse, and nothing to be talked out of.

07· The audit record

Every removal has a position. None has a value.

This is what an auditor asks for, and it is the reason stage two tracks provenance. Two rows from one file, then the same rows broken into fields.

2024-03-11T09:42:18Z · j.okafor · read_file · intake_note.txt · p1/para1/8–33 · PERSON · readers model,roster · replaced · <PERSON a91f>
2024-03-11T09:42:18Z · j.okafor · read_file · intake_note.txt · p1/table1/r3c1 · PERSON · readers roster · propagated · <PERSON a91f>

timestamp · actor

Who asked, and when. The actor is the authenticated person whose session the model was acting in — not the model.

operation · file

Which of the four operations, against which file. Every model action appears here, including the ones that returned a refusal.

locus

Page, paragraph or table cell, and character offsets. Precise enough to point at the exact span in the original document.

category · readers

Which identifier category, and which readers found it. Two readers agreeing is a stronger record than one, and disagreement is visible rather than averaged away.

disposition · marker

Replaced, generalized, propagated or refused — and the marker issued. The second row is marked propagated, which is how you can tell stage four did the work rather than a reader.

the value

Not recorded. A log of what was removed would be a second copy of the thing being protected, and it would live in the one place least likely to be encrypted.

08· Controls around the pipeline

Two layers, and it matters which is which.

Guard-layer controls are properties of the code path — they hold whether or not anyone configures them correctly. Platform-layer controls are administered, which means they depend on your setup and your review discipline. Any vendor listing all ten together is hiding that distinction.

Guard layer

Automatic redaction and masking of PHI

Not a step someone remembers to run. The guard owns the only door to a file, so there is no path that skips it — four readers, document-wide propagation, and a gate that refuses the whole file if coverage was incomplete.

Guard layer

Audit logging of every AI action

Every operation and every removal, with the position it occurred at and the readers that found it. Categories and markers are recorded; values are not. Detailed in §07.

Guard layer

Encryption at rest and in transit

The vault and the roster are encrypted on disk, and their key lives in the operating system keychain — not in a file, not in configuration, not in the software. Transport to the model vendor is TLS and carries marker text only.

Guard layer

Re-identification is not an AI capability

Turning a marker back into a value is a command a person runs, gated by its own permission and logged as its own event. It was left out of the four operations on purpose.

Platform layer

Authentication and role-based permissions

Running a workflow, resolving a marker back to a name, and editing the roster are three separate permissions. The second and third are the ones worth reviewing quarterly — they are the only routes to a real value.

Platform layer

EHR and PMS integrations

Records arriving from a records or practice management system enter through the same guard as a file on disk. An integration is not a side entrance, and a connector cannot request raw text.

Platform layer

Consent and authorization workflows

Where a use of PHI requires a patient's authorization, the workflow will not advance without the record of it. Consent state travels with the record rather than with the operator's memory.

Platform layer

Retention, deletion and Business Associate Agreements

Retention windows are set per record class, and deletion removes the vault entry as well — which makes the marker permanently unresolvable rather than merely hidden. Webbeon signs a BAA with you and holds one with every vendor that could touch PHI.

Platform layer

Continuous monitoring and incident response

The signal worth watching is the refusal rate. A rise means files are arriving in a shape the guard cannot fully read — a data-quality problem surfacing as a safety behavior, and something to investigate rather than tune away. Incident procedures cover breach assessment and the notification timelines set by the Breach Notification Rule.

09· Scope and limits

De-identification of free text is not a solved problem.

No vendor claiming otherwise should be believed, and this page would be less useful if it made that claim. Four limits stated plainly, because they change what you should configure and what you should watch.

This document describes engineering behavior. It is not a legal opinion and it does not replace your own risk assessment, your BAA review, or your counsel's reading of the Privacy Rule.

Limit 01

A name that appears neither on your roster nor in a recognizable sentence structure can be missed. The roster reader exists because of this, and the list you supply sets the ceiling on accuracy — a stale roster is the most common cause of a miss.

Limit 02

A clinical detail rare enough to single out one person is not something the guard can see. Safe Harbor does not address this either — it is a known gap in the method, not in the implementation.

Limit 03

De-identified output is no longer PHI, but it is still a record of somebody's care. Treat it as sensitive, keep it inside your own systems, and do not assume a marker makes a document safe to publish.

Limit 04

Anyone who can resolve a marker can see a name. That permission is the real perimeter, and it is administered by you — which is why §08 separates what the code guarantees from what your configuration does.