PHI minimization in RAG pipelines.
Chunking, redaction, retrieval filters, and eval hooks so regulated AI answers without stuffing patient data into every context window.
·9 min read
TL;DR
RAG for healthcare fails compliance when every chunk is treated as fair game for the prompt. Brandlabs designs retrieval with minimization: strip identifiers before embed where possible, filter by role and purpose, refuse when evidence is thin, and eval for leakage — not only answer quality.
Why does RAG increase PHI risk for healthcare AI?
Retrieval can pull sensitive notes, IDs, and free text into the context window even when the user’s question did not need them. Embeddings and chunk stores become a second copy of clinical content. Without minimization, every “helpful” answer is also a potential disclosure path.
Classic RAG tutorials optimize recall. Regulated products optimize necessary recall.
Failure modes we see:
- Chunks include MRNs, full names, and addresses next to clinically useful text
- Broad top-k retrieval dumps unrelated patients into context
- Debug UIs and traces show raw retrieved text to the whole eng team
- Eval datasets copy production chunks into shared drives
Minimize before you maximize fluency.
What minimization controls belong in the retrieval path?
Redact or tokenize identifiers at ingest, tag chunks with sensitivity and purpose, enforce tenant and role filters before similarity search, cap k, and prefer summaries over raw notes when the job allows. Log retrieval IDs — not full PHI payloads — in the default audit trail.
A practical pipeline:
- Ingest with redaction / tokenization rules
- Metadata: patient/tenant scope, document type, sensitivity
- Query-time ACL filters before vector search
- Re-rank with policy (no cross-patient bleed)
- Optional second-pass scrub before prompt assembly
- Empty-retrieval → refuse, do not invent
If your vector DB cannot filter by tenant, you do not have a multi-tenant clinical RAG system yet.
How do you prove minimization with evals?
Add leakage fixtures: prompts that should never surface another patient’s identifiers, and cases where retrieval must stay empty. Score groundedness and privacy together. A fluent answer that cites the wrong chart is both a clinical and a compliance failure.
Brandlabs puts these in the required suite for health RAG:
- Cross-tenant / cross-patient leakage attempts
- Over-retrieval of high-sensitivity doc types
- Refusal when corpus miss
- Citation fidelity to allowed chunks only
Wire failures into CI the same week you find them in staging.
Frequently asked questions
Can we just anonymize everything before embedding?
Often partially — but clinical utility may require controlled identifiers behind ACL. Minimization is a spectrum with policy, not a single scrub script.
Is this legal advice?
No. It is an engineering pattern. Counsel and compliance own what counts as PHI and permitted use in your deployment.