# Cloud medical NLP APIs vs on-device de-identification

> AWS Comprehend Medical, Azure Text Analytics for health and Google's Healthcare Natural Language API compared with open-source tools that run on your own hardware.

Comparison · Regions: Global · By Harsh Vitra (BrandLabs) · Published 2026-11-14 · Reviewed 2026-11-14 · Source: https://www.brandlabs.app/learn/cloud-medical-nlp-vs-on-device-deidentification

**TL;DR:** Cloud medical NLP APIs are quick to start and HIPAA-eligible, but they bill per character and send clinical text to the vendor. Open-source tools such as OpenMed and Microsoft Presidio run on your own hardware, cost nothing to license, and keep patient data inside your network, at the price of owning deployment and evaluation.

## Key takeaways

- Cloud APIs need clinical text sent to a vendor region; open-source tools can run entirely inside your network, on a phone or in a browser.
- Cloud APIs bill by volume of text. Open-source tools have no licence fee; the cost is engineering time to deploy, tune and test them.
- Language coverage differs sharply. Cloud medical endpoints are mostly English; OpenMed publishes PII models for 35 languages, including major Indian languages.
- Neither option is accurate on your data until you test it on your data. Run the same evaluation set against every candidate.

## What is the difference between cloud and on-device medical NLP?

A **cloud medical NLP API** is a hosted service: you send clinical text to the vendor, and it returns entities, codes or a redacted version. **On-device de-identification** runs a model inside your own process, on a server, laptop, phone or browser tab, so the text never leaves your network.

## How do the options compare?

| | Cloud medical APIs | Open-source, on your hardware |
| --- | --- | --- |
| Examples | AWS Comprehend Medical, Azure Text Analytics for health, Google Healthcare Natural Language API | OpenMed, Microsoft Presidio, Philter |
| Where text goes | Vendor cloud region | Stays in your process |
| Pricing | Pay per volume of text | No licence fee; you run it |
| Languages | Mostly English | OpenMed: PII models for 35 languages, including Hindi, Marathi, Tamil and Telugu |
| Runs offline or on a phone | No | OpenMed: yes, through ONNX and mobile runtimes |
| Setup time | Hours | Days to weeks, including evaluation |
| Who maintains it | The vendor | You, or a partner |

## When does a cloud API make sense?

When you need results this week, your text is in English, volumes are modest and your legal team is comfortable sending clinical text to the vendor under a business associate agreement. It is also a sensible baseline to compare an open-source model against.

## When does on-device de-identification make sense?

When patient data must not leave your network, when users write in Indian or other non-English languages, when volumes make per-character billing expensive, or when redaction has to happen on the phone or in the browser before anything is sent. It also suits regulated buyers who ask where every byte goes.

## How should you choose?

Build a labelled test set of 200 to 500 real, de-identified notes in every language you support. Measure **recall per identifier type**: names, phone numbers, record numbers, dates and addresses. A missed phone number matters more than a wrongly redacted word. Pick the option that meets your recall target at a cost and data path your compliance team accepts, and re-run the test on every model update.

## Frequently asked questions

### Are cloud medical NLP APIs HIPAA compliant?

The major ones are HIPAA-eligible: the vendor will sign a business associate agreement. Eligibility is not compliance. You still need the right configuration, access controls and a legal basis for sending the data.

### Is open-source de-identification accurate enough for production?

It can be, but only after you measure it on your own notes. Publish a target recall for each identifier type, test against a labelled sample in every language you support, and gate releases on that number.

### Can we combine both approaches?

Yes. A common pattern is to de-identify on your own hardware first, then send only the redacted text to a cloud model for tasks that need it.

## Where BrandLabs fits

BrandLabs builds private de-identification on open-source foundations, runs it inside health companies' own stacks, and measures recall per identifier type before go-live. https://www.brandlabs.app/private-ai

## Sources

- Amazon Comprehend Medical, Amazon Web Services: https://aws.amazon.com/comprehend/medical/
- Text Analytics for health, Microsoft Learn: https://learn.microsoft.com/en-us/azure/ai-services/language-service/text-analytics-for-health/overview
- Healthcare Natural Language API, Google Cloud: https://cloud.google.com/healthcare-api/docs/how-tos/nlp
- OpenMed: local-first clinical AI, OpenMed, 2026-11: https://openmed.life
- OpenMed: domain-adapted biomedical NER (arXiv:2508.01630), arXiv, 2025-08: https://arxiv.org/abs/2508.01630
- Presidio: data protection and de-identification SDK, Microsoft: https://github.com/microsoft/presidio