Anonymisation software for public disclosure
Clinical documents published under a disclosure regime must have their participants' personal data protected, and software does much of that work. Anonymisation software detects the personal information in a document, measures how identifiable each participant still is, and transforms the text until the measured risk falls below a regulator's threshold, while keeping the document useful to its readers. It also redacts what has to be covered, and vendors offer it under licence or as a service.
What the software protects
One vendor's anonymisation tool supports the protection of both personal information and commercially confidential information.
In that tool the two are treated differently by default: the priority for personal information is anonymisation, and commercially confidential information is redacted. The tool can also redact personal information where that is required or the sponsor prefers it, or where the documents are old scans that are difficult to machine-read.
Why anonymisation is automated
Applicants require software to anonymise efficiently across the breadth of a dossier. A large data set should be anonymised by software, because it cannot be anonymised manually.
In 2018, industry leaders were starting to apply more automated anonymisation methods to their clinical study reports, seeing the value in a more systematic approach. Their aim was to reduce workload and to increase the consistency and value of their output.
With a systematic approach, information technology systems can take over much of the process, leaving medical writing teams only quality assurance checks while they retain control over risk management. Systematic anonymisation is also much easier to audit internally, so teams can keep track of what they have done and have a record they can use to demonstrate that all possible steps were taken to protect patients' identities.
Software in the EMA's published anonymisation reports
Of the 52 anonymisation reports the EMA published from October 2016 to December 2017, 32 mentioned software of some kind and 20 mentioned none. Sixteen referred to automated redaction tools or artificial intelligence systems, of which six, from two marketing authorisation holders, named Privacy Analytics's Lexicon Tool Suite and ten named no product. Another 16 mentioned manual redaction tools, of which six named Adobe Acrobat or Nuance and ten named no product. Among the 12 reports for orphan drug applications, eight mentioned software and four did not; three used the Lexicon Tool Suite, and five used manual redaction tools, one of them naming Adobe Acrobat or Nuance.
The Lexicon Tool Suite let a holder pseudonymise personal data using transformation or recoding algorithms, redacting only where transformation was not possible. Most reports discussed data utility descriptively, and only the six that used the suite described metrics for assessing it after anonymisation: a precision metric measuring data distortion, and subjective criteria on the accuracy of analysis results, assuming a secondary user planned to replicate the trial's original results. On those metrics, transformation combined with redaction gave higher data utility than redaction alone. One holder using the suite also redacted published patient data listings in three procedures.
Access and cost
Medical writers interested in automated anonymisation often cannot get access to the software until the sponsor company and its senior decision-makers allow it.
Automated anonymisation is supplied by vendors, of which Privacy Analytics is one. A sponsor or CRO can operate a tool under licence, or the vendor can perform the anonymisation as a service. A sponsor or CRO interested in it should investigate it directly and complete its own cost analysis, because the cost varies tremendously with the services wanted.
Manual redaction tools
As of 2019, multiple software platforms enable manual redaction of PDF documents, among them Adobe Acrobat Pro DC, Nitro Pro 10, Objective Redact, PDFelement, PDFzorro, PDFescape, PDFfiller and PDF Studio Pro, and they often offer free trials. The desktop options described below are used by pharmaceutical companies for redaction or are capable of the breadth of redaction a dossier requires, and all of them require licences.
- Adobe Acrobat Pro DC redacts in two steps: text, images or pages are marked for redaction and appear within a red border, and the redactions are then applied, permanently removing the content and its metadata. A marked file can be downloaded and reviewed by another reviewer before anything is applied, and a search can mark every match at once.
- Objective Redact works on PDF, Word and Excel files and lets the user add comments saying why information was redacted, which can be included in the anonymisation report. It searches for phrases or structured data such as birthdates or names, and removes metadata and hidden code. It produces an audit copy whose translucent markings leave the underlying information visible for review, and a working copy that can be saved or emailed to reviewers and then opened in the program to accept the redactions or redact and review further.
- PleaseReview version 6.1 lets several users redact PDFs simultaneously and collaboratively using preconfigured redaction categories for personal data and commercially confidential information under Policy 0070. Appearance, overlay text and comment categories are configurable at system, workgroup or review level; redactions are applied as rectangles, highlighted text or whole pages; PDF annotations, including redactions, can be imported; the review owner may accept or reject redactions; and justifications for redaction can be added as comments. The information in its reconciliation report can serve as the basis for the justifications for de-identification reported to the EMA or Health Canada.
Automated anonymisation platforms
Automated anonymisation software is recommended for dossiers, given their scope and complexity and the need to maintain data utility. In general, such software is aligned with established anonymisation rules and standards, such as PhUSE's, and updated to keep pace with advances in data standards and artificial intelligence and with evolving regulations.
As of 2019, ARARA enables automated anonymisation together with quantitative risk and data utility assessment of clinical documents and data sets, as a desktop or cloud-hosted application, and sponsors can use it internally or outsource the service. It gives the user options for de-identifying direct and indirect identifiers and commercially confidential information, with control over the automated modelling and anonymisation process. It comes with rules and templates preconfigured to meet the EMA's and Health Canada's 9% re-identification risk thresholds, and the rules can be customised for the different thresholds different populations need. It also offers ten anonymisation models, templates that can be customised and re-run to test outputs and iterate quickly, processing of several data sets and documents at once with the same techniques, and risk and data utility dashboards, automated anonymisation reporting, traceability and audit tracking.
As of 2019, Blur supports automated anonymisation of data and clinical documents, used internally or as an outsourced service. It offers menu-driven options for de-identification, risk reduction and auditable workflows and controls, applies different anonymisation techniques by data variable, lets viewers compare the original source data with the anonymised data, and applies the rule sets created within the data consistently to documents through a template.
As of 2020, GenInvo's Shadow automates de-identification and anonymisation of data and documents in regulatory writing workflows, with re-identification risk analysis, data-utility assessment after de-identification, and generation of redaction proposals and anonymisation plans and reports. It stores and applies de-identification strategies in a metadata repository at several levels of the workflow, and provides interactive rule application and testing, before-and-after views, and performance metrics on the precision and efficiency of the strategy and the effectiveness of the de-identification team.
As of 2020, Synchrogenix offers the ClinGenuity Redaction Management Service, an AI-enabled solution for automatically identifying and redacting sensitive information. It uses natural language processing and recognition to accurately identify and call out sensitive information in long documents, with access to expert consulting on regulatory policy and guidance, anonymisation methods, reports and agency support.
Vendors that deliver the anonymised package
As of 2019, some vendors deliver the whole anonymised package as a service. Certara provides a complete redacted and anonymised Policy 0070 submission package using its redaction management software, ClinGenuity, and has developed anonymisation solutions using a quantitative risk assessment methodology; it provides the package and consulting services as a service model. Privacy Analytics provides a complete anonymised Policy 0070 or Health Canada submission package using its risk-based de-identification software, Eclipse, with a quantitative risk-based methodology, and likewise provides the package and consulting services as a service model. XOGENE provides a complete anonymised Policy 0070 or Health Canada submission package, including the anonymisation report, justification table and final anonymised data sets and documents, applying its automated anonymisation and redaction platform, Terminator, to personal data. It also reviews the documents for commercially confidential information against regulatory and company policies, and supports expedited redaction within 24 to 48 hours for requests under the policy. Kinapse's Redact360 is a technology-enabled service for redaction and anonymisation of clinical data and documents, comprising advisory and regulatory support on the anonymisation method, programme management including the proposal and final packages, completion of the anonymisation report and justification tables, and writing of clinical trial summaries, registry postings and lay summaries. Only Kinapse can use its platform to anonymise the documents and data sets, but the applicant may select among its advisory and support services, and key performance indicators are written into its service-level agreements.
In general, a vendor approached to anonymise a dossier first assigns a project manager. It analyses the dossier's direct and indirect identifiers and commercially confidential information, and recommends anonymisation rules for personal data and confidential information based on the acceptable re-identification threshold. Once the client agrees the threshold and methods, the vendor generates the anonymised proposal package with the rules replicated consistently across data sets and documents; the client reviews it, the vendor finalises it once it is agreed, and the vendor then supports the client in responding to the health authority's questions and prepares the final package. Because these vendors had supported a wider scope of redacted submissions and had redacted data sets for secondary use by researchers before the regulations took effect, applicants can also draw on their expertise for additional services. These may include help establishing standard operating procedures for anonymisation, software platforms with technical support and training, strategic recommendations on method selection and risk mitigation for the population and dossier in hand, review and quality control of the software-generated anonymised reports and data, completion of the anonymisation report and the justification table for confidential information, and help justifying the anonymisation method.
Vendor support may also extend beyond anonymisation, to protocol and results posting to registries, record maintenance, workflow planning and the writing of lay summaries. XOGENE offers postings to all registries, record maintenance on registry sites, and the writing and translation of lay summaries, site distribution, tracking and oversight. Blur's developer, d-Wise, partners with ClaritiDox for further anonymisation services, including advisory services, help with process management, review of anonymised documents and data sets, writing of anonymisation reports, registry postings and writing of lay summaries.
The Privacy Analytics platform
Privacy Analytics is a wholly owned subsidiary of IQVIA. The company describes its platform as ranked among the top technologies by market analysts, and the platform uses artificial intelligence and machine learning developed in-house to anonymise patient-level information in both structured and unstructured data. The underlying methodology is said to have been cited in over 175 publications and to have withstood commissioned privacy attacks, which are motivated-intruder attempts to re-identify a person from material already published. The company's experts sit on forums and consortia globally and are described as having informed regulatory guidance including ISO/IEC 27559, released in 2022. The track record it claimed in 2025 is over 160 successful regulatory submissions across EMA Policy 0070, Health Canada's public release of clinical information and Japan's PMDA, with millions of pages of documents and tens of thousands of data sets anonymised.
Two tools sit on the platform: Mirage handles documents, and Eclipse handles clinical trial data sets in their various formats. Both are available either as a service the vendor performs or under licence for use inside a sponsor's own environment.
The pipeline from upload to published file
Several projects can run on the platform at a time, and a study can be set up with an anonymisation workflow or a redaction workflow. The tool processes documents in PDF, the format most clinical trial documents are in; they can be uploaded one at a time or many together, and processing begins as soon as they are uploaded. The demonstration file was a sample clinical study report of about six pages with narratives created for the demonstration, so that nothing in it links to a real person.
Once the documents are uploaded, the platform's model detects personal information automatically, tagging each occurrence and classifying it by type of information. A human reviewer then works through every document page by page, in a step the vendor calls manual optimisation, checking that everything has been captured and categorised correctly and nothing missed. The vendor holds the tool's accuracy to be very high, but because the documents will be public, this further quality control ensures that a human, and not only a machine, has reviewed what is published. The captured information is assembled into a profile for each participant, risk is measured on those profiles, transformations are proposed, and the result is assembled into the proposal package submitted to the regulator. Additional quality control checks come at the end.
Turning the document into participant profiles
To measure risk, the unstructured text is converted into a structured format. Every value the model captured is extracted, categorised and grouped under the participant it belongs to, producing a profile on which risk can be measured.
Consolidation also keeps replacements consistent. One participant can appear in the summary section, again in a listing, again in a narrative and again in the clinical safety section, with the same age, race and adverse event in each place. Once every occurrence is pulled into a single profile, the same replacement appears everywhere the value occurs, even across fifty documents.
Detected values are colour-coded by identifier type and listed in a panel on the right, and a reviewer can delete a tag or add one by selecting the text and choosing its type. A by-subject view greys out everything associated with one participant, which shows when a value has not been linked to anyone: such a tag can be edited and associated with a subject ID the tool suggests from the closest ones nearby, and it then joins that participant's profile. The profile view presents the captured information in a structured form that can be reviewed by participant or by identifier type and downloaded as a CSV. An age with no subject ID against it can be clicked to jump back to where it appears in the document, and a subject ID added there.
Measuring re-identification risk
The tool treats identifiers as direct or indirect. Direct identifiers are the IDs, such as subject IDs and the other kinds of ID found in clinical trial documents, and the tool masks them. In statistical anonymisation, direct-identifier risk is typically not a concern, and the risk discussed is that from quasi-identifiers.
The reference population, the similar population the trial's participants are compared against, is one of two study settings that matter for risk-based anonymisation. There are many ways to arrive at it. A conservative sponsor can use the study population itself as the reference, and ClinicalTrials.gov can be queried for similar trials. Generally, the vendor counts the people who could have been in the study, those meeting the same inclusion criteria in the same geography, the same time period and with the same demographic information, using a tool set that returns a number to enter in the settings for the risk calculation. The settings also take the study start and end dates, so that shifted dates stay within the study's own timeline.
To estimate the risk correctly, the calculation considers all the participants in the trial, not only those who appear in the documents. In a study of 50 participants of whom only 10 had an adverse event, it is likely that only those 10 appear in the documents. So a structured file is uploaded alongside the documents, listing everyone who took part with their subject IDs, gender, whether they had an adverse event and the date, and that information is pulled in and combined with what the documents contain.
Sometimes clinical trial documents need to be anonymised consistently with data sets. Where the same trial's data sets have been pseudonymised, their pseudonymisation key can be imported so the tool uses those replacement values instead of generating new ones. One 2018 account holds that applying anonymisation to the underlying data sets is the best way to reach an accurate risk score, enabling a quantitative rather than merely qualitative risk measure, and saw signs then that some companies recognised the merit of linking documents to the original data sets more dynamically.
Transformations by identifier type
The tool transforms information rather than covering it with a box, and each identifier type has its own method.
- Direct identifiers are pseudonymised with format-preserving encryption. The replacement keeps the format of the original, so a subject ID written as three characters, a dash and three characters comes back in that form. The same replacement is used for that participant across every document, which preserves referential integrity and lets a reader track one participant's journey through the material, a utility an opaque box does not give.
- Ages can be retained, generalised or suppressed. Generalisation bands are configurable: the base value is set to the lowest age among the study's participants, 32 in the demonstration, with intervals of five or ten, other bands such as twenty years available to add, and a nominated replacement for any age that does not fit them.
- Medical history can be generalised to system organ class. The specific term is replaced by a higher-level medical term within which the original still falls, which makes the participant less identifiable.
- Dates are typically offset or shifted, within the study start and end dates entered in the settings.
- Commercially confidential information is redacted.
Which identifiers are kept
The transformation settings set a priority for how each identifier type is treated. A type can be set to be always retained, ranked high, medium or low, always suppressed, or excluded from the risk calculation altogether, and ages can be generalised from the same settings.
Adverse events and gender were both set to always retain in the demonstration. Retaining them does not mean they are not considered a risk: risk is still measured on them, and the setting tells the tool to prioritise retaining them above the other identifiers. Adverse events are kept intact because they matter for data utility, so that a reader of the released information can see which adverse events occurred with the medication. The technique aims at privacy protection and data utility together.
The tool may lack the context of the study: it sees a medical history and tags it for all participants. Where a condition is the inclusion criterion common to all participants, such as gallstones in a study of gallbladder disease, it is no longer identifying within the group and needs to be retained. A bulk delete removes that value for everybody, on the current page, a set of pages or all pages.
The risk results
A risk run on the six-page demonstration document took eight seconds. A result of low risk means that the risk of the highest-risk participant, after the proposed transformations, falls below the 0.09 threshold. The residual risk reported, 0.08 in the demonstration, is the risk of the participant with the highest risk.
The overview also states how many participants the calculation covered: twelve, of whom six appeared in the six-page document and the rest were brought in from the uploaded structured file. Results can be filtered by participant from highest to lowest risk, and each shows how many identifiers were present for that person, which shows how much information varies within clinical trial documents. One participant in the demonstration had only two, probably the gender and adverse-event information pulled in from the structured file. A second view summarises what happened by identifier type: 60 dates in the document, all of them shifted; every age generalised into a five-year band, because no suppression had been allowed for age; and the corresponding lines for country, medical history, adverse event and gender. Each replacement can be reviewed against its original and changed individually before the result is assembled.
The proposal package and the final package
Assembly produces the output, and several PDF formats are available. In the proposal version every value that was considered in the risk calculation and transformed is highlighted, with a comment giving its replacement value.
The proposal package is submitted to the regulator, which reviews it, provides comments and recommendations, and then asks for the final package. In the final version the highlighting is removed and the transformed values, such as a participant's age, race and country, appear as plain text, and that is the version published on the public portal.
Who operates the software
The vendor holds that the tool itself is easy to use, but that it requires some basic knowledge, which can be trained. Knowing what qualifies as an identifier and what the regulatory transparency guidance expects to be retained should be sufficient to use the tool, and the user does not need to know anything about the risk calculation, which the tool performs. The vendor's own team has diverse backgrounds and consists mostly of medical writers, alongside people with experience in transparency teams and people with medical backgrounds.
Detection accuracy and its limits
The model is a fine-tuned, domain-specific large language model that identifies and captures information in clinical trial documents at very high speed, and the vendor claims high accuracy in detecting personal information. It supports active learning within a document: where it meets an unusual format, a reviewer who retags a value and marks the page complete lets it learn from that information as it continues through the same document.
By the vendor's account, much of the model is built not on a specific sponsor's data but on synthetic data assembled from experience of working with multiple sponsors, so generally it is not tied to any sponsor and works well across several, which answers a concern a CRO working for multiple sponsors may have. The model is built to capture text rather than images. It can sometimes capture a subject ID in the header or footer of a graph or within a graph or table, but it cannot read images themselves, and image anonymisation, such as of DICOM images, was not done within this platform as of 2025.
With artificial intelligence and machine learning, a system can be taught to recognise potentially sensitive references, links and context more accurately, and to take a specific action, such as offsetting all associated dates, or flag them for checking. Such software can pick up inconsistently spelled references that a text search might miss. In 2018, initial benchmarks suggested that by the seventh time a system has been shown something, such as what constitutes a sensitive identifier, it is already at human-level accuracy, after which it becomes progressively better and faster, with the leak rate, the share of mentions missed, dropping below 1%. Such systems can also be set to apply different levels of risk mitigation where particular sensitivities exist, such as alcohol use or pregnancy.
Natural language processing tools can help a writer detect errors when anonymising patients enrolled in clinical studies, particularly in international multicentre trials involving thousands of patients. Using natural language processing to create robust anonymised documents is one way to overcome a possible breach of anonymisation by AI-based tools.