Cloud medical NLP APIs vs on-device de-identification
AWS Comprehend Medical, Azure Text Analytics for health and Google's Healthcare Natural Language API compared with open-source tools that run on your own hardware.
- Global
Key takeaways
- Cloud APIs need clinical text sent to a vendor region; open-source tools can run entirely inside your network, on a phone or in a browser.
- Cloud APIs bill by volume of text. Open-source tools have no licence fee; the cost is engineering time to deploy, tune and test them.
- Language coverage differs sharply. Cloud medical endpoints are mostly English; OpenMed publishes PII models for 35 languages, including major Indian languages.
- Neither option is accurate on your data until you test it on your data. Run the same evaluation set against every candidate.
What is the difference between cloud and on-device medical NLP?
A cloud medical NLP API is a hosted service: you send clinical text to the vendor, and it returns entities, codes or a redacted version. On-device de-identification runs a model inside your own process, on a server, laptop, phone or browser tab, so the text never leaves your network.
How do the options compare?
| Cloud medical APIs | Open-source, on your hardware | |
|---|---|---|
| Examples | AWS Comprehend Medical, Azure Text Analytics for health, Google Healthcare Natural Language API | OpenMed, Microsoft Presidio, Philter |
| Where text goes | Vendor cloud region | Stays in your process |
| Pricing | Pay per volume of text | No licence fee; you run it |
| Languages | Mostly English | OpenMed: PII models for 35 languages, including Hindi, Marathi, Tamil and Telugu |
| Runs offline or on a phone | No | OpenMed: yes, through ONNX and mobile runtimes |
| Setup time | Hours | Days to weeks, including evaluation |
| Who maintains it | The vendor | You, or a partner |
When does a cloud API make sense?
When you need results this week, your text is in English, volumes are modest and your legal team is comfortable sending clinical text to the vendor under a business associate agreement. It is also a sensible baseline to compare an open-source model against.
When does on-device de-identification make sense?
When patient data must not leave your network, when users write in Indian or other non-English languages, when volumes make per-character billing expensive, or when redaction has to happen on the phone or in the browser before anything is sent. It also suits regulated buyers who ask where every byte goes.
How should you choose?
Build a labelled test set of 200 to 500 real, de-identified notes in every language you support. Measure recall per identifier type: names, phone numbers, record numbers, dates and addresses. A missed phone number matters more than a wrongly redacted word. Pick the option that meets your recall target at a cost and data path your compliance team accepts, and re-run the test on every model update.
Frequently asked questions
Are cloud medical NLP APIs HIPAA compliant?
The major ones are HIPAA-eligible: the vendor will sign a business associate agreement. Eligibility is not compliance. You still need the right configuration, access controls and a legal basis for sending the data.
Is open-source de-identification accurate enough for production?
It can be, but only after you measure it on your own notes. Publish a target recall for each identifier type, test against a labelled sample in every language you support, and gate releases on that number.
Can we combine both approaches?
Yes. A common pattern is to de-identify on your own hardware first, then send only the redacted text to a cloud model for tasks that need it.
Sources
- Amazon Comprehend MedicalAmazon Web Services
- Text Analytics for healthMicrosoft Learn
- Healthcare Natural Language APIGoogle Cloud
- OpenMed: local-first clinical AIOpenMed · 2026-11
- OpenMed: domain-adapted biomedical NER (arXiv:2508.01630)arXiv · 2025-08
- Presidio: data protection and de-identification SDKMicrosoft
Found something out of date? Write to contact@brandlabs.app and we will fix it.