# How to de-identify health chatbot logs

> A step-by-step guide to removing names, phone numbers and IDs from health chatbot transcripts before they reach logs, analytics or model training.

Guide · Regions: Global · By Harsh Vitra (BrandLabs) · Published 2026-11-14 · Reviewed 2026-11-14 · Source: https://www.brandlabs.app/learn/de-identifying-chat-logs

**TL;DR:** Redact identifiers at the point of capture, before chat text is written to logs, analytics or a training set. Combine format rules for phone numbers and IDs with a trained model for names and addresses, replace them with typed labels, measure recall per identifier type, and keep the raw text out of every downstream system.

## Key takeaways

- Redact before storage. Cleaning logs after the fact means the identifiers already reached disks, backups and vendors.
- Use rules for structured identifiers (phone numbers, record numbers, emails) and a model for names and addresses.
- Replace identifiers with typed labels such as [NAME] and [PHONE] so transcripts stay useful.
- Measure recall for each identifier type on real, labelled samples in every language you support.
- HIPAA's Safe Harbor method lists 18 identifiers to remove; use it as a checklist even outside the US.

## Where should redaction happen?

At the point of capture: in the service that first receives the user's message, before anything is written to logs, queues, analytics, error trackers or a model provider. Once raw text reaches backups and third-party tools, cleaning it later is slow and incomplete.

## Which identifiers should you remove?

Start from HIPAA's Safe Harbor list of 18 identifiers, which includes names, small geographic areas, dates more specific than a year, phone numbers, emails, record and account numbers, and device identifiers. Add local formats: Indian mobile numbers, Aadhaar-style IDs and local address patterns.

## How do you detect identifiers reliably?

| Identifier | Best method |
| --- | --- |
| Phone numbers, emails, record numbers | Pattern rules with format checks |
| Dates | Rules plus context ("DOB", "born") |
| Names, places, organisations | A trained entity recognition model |
| Mixed-language text | Models tested on that language and script |

Combine both: rules are precise on structured data, models catch names in free text. Score with context, for example raising confidence when "MRN" or "DOB" appears nearby.

## What should replace an identifier?

A typed label such as [NAME], [PHONE] or [DATE], so analysts and models still understand the sentence. For training data, realistic fake values keep text natural. For dates, a consistent shift preserves intervals between events.

## How do you know it works?

Label 200 to 500 real messages per language, run redaction, and measure recall per identifier type. A missed phone number matters more than an over-redacted word, so set a high recall target for direct identifiers and block releases that fall below it.

## Frequently asked questions

### Is redacted chat data anonymous?

Not automatically. Free text can re-identify people through rare details, places or events. Treat redacted transcripts as personal data unless an expert assessment says otherwise, and restrict who can see them.

### Should we redact before sending text to an LLM?

Wherever the task allows it. Many tasks, such as intent detection or summarising symptoms, work fine on redacted text. Where the model genuinely needs an identifier, keep it inside your own environment.

## Where BrandLabs fits

We build redaction into health products at the point of capture and measure it per identifier type before go-live. https://www.brandlabs.app/private-ai

## Sources

- Guidance regarding methods for de-identification of PHI under the HIPAA Privacy Rule, US Department of Health and Human Services: https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html
- Presidio: data protection and de-identification SDK, Microsoft: https://github.com/microsoft/presidio
- Digital Personal Data Protection Rules, 2025, Ministry of Electronics and IT, India, 2025-11-13: https://www.meity.gov.in