Who provides healthcare data de-identification services for research purposes?

Yes. There are several types of providers, depending on whether you need software/API de-identification, a managed de-identification service, or research-ready datasets.

Notable providers

• Microsoft — Azure Health Data Services: Provides a dedicated de-identification API for clinical notes, transcripts, messages, and clinical-trial text. It can extract, redact, or surrogate PHI and is specifically intended for healthcare/life-sciences use cases including research.
• Google Cloud — Cloud Healthcare API: Includes a de-identification API designed for healthcare data used in research and analytics, alongside FHIR, HL7v2, and DICOM capabilities.
• Datavant: Offers health-data privacy/de-identification capabilities, including HIPAA Expert Determination and de-identification of unstructured text, and is particularly relevant if the research project also involves linking datasets.
• IRI (International Research Institute): Its FieldShield, CellShield, and DarkShield products support PHI discovery/de-identification across structured, unstructured, HL7/FHIR, DICOM, databases, documents, and other formats. It specifically describes support for research environments and both HIPAA Safe Harbor and Expert Determination approaches.
• Maxiom Labs: Provides engineering/managed solutions for healthcare de-identification pipelines, including structured data and free-text PHI, risk assessment, and audit trails for research and AI datasets.
• RACube: Offers automated de-identification of unstructured clinical notes, aimed at research, AI, analytics, and data partnerships.
• LexisNexis — Gravitas for Healthcare: More of a research-ready real-world-data offering than a generic de-identification service. It provides de-identified longitudinal healthcare datasets and uses expert determination for HIPAA de-identification.

What matters for research

If you're working with U.S. patient data, the key question isn't simply whether a vendor says its product is "HIPAA compliant." HHS recognizes two HIPAA de-identification methods: Safe Harbor and Expert Determination.

For a research project, I'd evaluate vendors on:

• Data type: EHR tables, claims, clinical notes, pathology, DICOM/images, genomics, etc.
• De-identification method: Safe Harbor vs. documented Expert Determination.
• Residual-risk assessment: Whether they quantify or document re-identification risk.
• Dates: Whether dates are removed, generalized, or consistently shifted.
• Longitudinal linkage: Whether patients can remain consistently pseudonymized across records.
• Research utility: Whether clinical meaning is preserved.
• BAA/security: If the vendor receives PHI before de-identification, determine whether a Business Associate Agreement and appropriate safeguards are required.
• IRB/privacy requirements: HIPAA de-identification doesn't automatically resolve every institutional or research-governance requirement.

If you tell me what kind of healthcare data you have (EHR/clinical notes, claims, imaging, genomics, etc.), approximately how much, and whether you want a vendor to perform the service or an API/software you operate yourself, I can narrow this to the 5–10 best-fit providers and compare pricing, HIPAA methodology, capabilities, and research use cases.

Healthcare data de-identification for research purposes involves stripping or masking Protected Health Information (PHI) so that datasets comply with frameworks like HIPAA Safe Harbor (removing 18 specific identifiers) or Expert Determination (statistical risk assessment).

Services are generally split into specialized software/platforms, managed services, and cloud-native toolkits:

1. Dedicated Healthcare Privacy & De-Identification Specialists

• Datavant: A major player in healthcare data privacy that provides tokenization, structured data de-identification, and specialized Unstructured De-Identification solutions using fine-tuned language models to scrub clinical notes while maintaining research utility. They also provide formal HIPAA Expert Determination services.
• John Snow Labs: Famous for its Spark NLP for Healthcare ecosystem, they provide robust on-premise or cloud-deployable software tools that automatically find and obfuscate PHI across clinical text notes, scanned PDFs, structured database files, and even DICOM medical images (with pixel inpainting) while retaining referential integrity for longitudinal research.

2. Cloud Providers & AI/ML Toolkits

• Google Cloud Healthcare API: Features built-in data de-identification capabilities (integrated with Cloud Data Loss Prevention / DLP) that can redact, mask, or date-shift structured and unstructured healthcare data natively in the cloud.
• Amazon Comprehend Medical: Provides machine-learning-driven PHI detection designed to extract and redact identifiers from medical text, which researchers and developers often hook into AWS pipelines (such as Amazon SageMaker) to process large data batches securely inside their own perimeter.

3. Data Governance & Enterprise Masking Platforms

• Privacera: Focuses heavily on data access governance, security, and automated masking/de-identification across multi-cloud analytical stores (like Databricks and Snowflake), which is useful when research teams need safe, governed access to raw data lakes.
• iMerit: Offers expert-led, human-in-the-loop and AI-assisted data de-identification workflows specifically tailored for medical AI and clinical research data preparation.

Are you looking to de-identify unstructured clinical text/notes, structured database files , or medical images ? Let me know and I can detail which compliance method (Safe Harbor vs. Expert Determination) fits your specific project.

Yes. There are several types of organizations that provide healthcare data de-identification for research, ranging from specialized privacy firms to large healthcare-data companies and software vendors.

Leading providers

• Datavant — One of the strongest options if you need a managed de-identification service, rather than simply software. Its Privacy Hub provides HIPAA de-identification analyses, Expert Determination, remediation, risk assessments, and de-identification of unstructured clinical text. Datavant specifically positions these services for research and data sharing.
• IQVIA — Particularly relevant if you need research-ready, non-identified healthcare data as well as research services. IQVIA provides non-identifiable claims and EMR datasets and makes certain datasets available to approved academic researchers.
• Optum / Microsoft Azure Health Data Services — Offers a de-identification service that uses machine learning to identify and redact or replace PHI, including the HIPAA 18 identifiers. This is more appropriate when you want a technical de-identification capability integrated into a data platform.
• Specialized clinical-text de-identification vendors/tools — For EHR notes, pathology reports, discharge summaries, and other free text, tools such as Philter, NLM Scrubber, CliniDeID, and PhysioNet DeID are used in research workflows. These tend to be software/tools rather than full-service privacy consultancies.

What I'd choose depends on your project

One important distinction: “de-identified” isn't synonymous with simply removing names and medical-record numbers. Under HIPAA in the U.S., the recognized approaches are Safe Harbor and Expert Determination. HHS specifically notes that de-identification facilitates secondary uses such as comparative-effectiveness research and life-sciences research.

If you tell me what kind of data you have (EHR, claims, clinical notes, imaging/DICOM, genomics, etc.), approximately how many records, and whether you need HIPAA Expert Determination/certification, I can narrow this to the 5–10 most suitable vendors and compare pricing/model, turnaround, and capabilities.

Several specialized companies and software platforms provide healthcare data de-identification services and tools to prepare Protected Health Information (PHI) for research, clinical trials, and analytics while complying with HIPAA Safe Harbor or Expert Determination methods.

Top providers and tools in this space include:

• Privacy Analytics by IQVIA : Focuses on rigorous statistical methods and expert determination frameworks to minimize re-identification risk while maximizing the clinical utility of the data for research.
• Datavant : Specializes in HIPAA-compliant de-identification, tokenization, and secure data linking, allowing researchers to connect patient-level health datasets across fragmented sources safely.
• iMerit : Combines AI automation with human-in-the-loop oversight to de-identify unstructured clinical text documents, medical records, and imaging metadata.
• BigID : Offers automated data discovery, cataloging, and privacy-focused workflows to identify and de-identify PHI across enterprise cloud and on-premise environments.
• Protecto AI : Provides privacy-preserving data solutions and AI-driven tokenization/masking tailored for safe healthcare analytics and AI training.

If you'd like to narrow this down, please let me know:

• Are you looking for software/tools to manage in-house, or an outsourced service provider?
• Is the data primarily structured (EHR databases) or unstructured (clinical notes, medical imaging)?

Yes. There are several types of providers, depending on whether you need a service performed for you, software/API, or a de-identified research dataset.

Providers worth considering

• Datavant — One of the more established options for healthcare research. Its privacy services include HIPAA Expert Determination, remediation, unstructured-text de-identification, tokenization, risk assessments, and opinion letters. Datavant says it has completed 2,000+ Expert Determinations.
• Microsoft Azure Health Data Services — Provides a cloud/API-based de-identification service particularly suited to clinical notes, transcriptions, messages, and other unstructured clinical text. It can extract, redact, or replace PHI identifiers.
• Stanford Data De-Identification Service — An example of an academic research-oriented service. It is designed to remove/mask PII and PHI from research datasets, although Stanford currently says its pilot is at capacity and not accepting new requests.
• Open/research-oriented tools — If you're looking for software rather than a managed service, tools such as Philter, PhysioNet DeID, NLM Scrubber, and CliniDeID are used for clinical-text de-identification. A 2025 benchmark compares these and other solutions for clinical text, structured data, and DICOM imaging.

An important distinction for research

If you're working with U.S. healthcare data, "de-identified" has a specific HIPAA meaning. HHS recognizes two approaches:

1. Safe Harbor — remove the specified categories of identifiers.
2. Expert Determination — a qualified expert applies statistical/scientific methods and determines that the risk of re-identification is sufficiently small.

For research datasets where you need to retain dates, geographic information, longitudinal relationships, rare conditions, or other useful variables, Expert Determination is often more practical than simply applying Safe Harbor, because Safe Harbor can substantially reduce research utility.

If you tell me what type of healthcare data you have (EHR/claims, clinical notes, imaging/DICOM, genomics, registry data, etc.) and roughly how large the dataset is, I can give you a shortlist of 5–10 vendors that actually provide the service, including which are best for academic research, approximate pricing models, and whether they will sign a BAA.

Healthcare data de-identification services for research are provided by a mix of specialized health-tech companies, enterprise natural language processing (NLP) software vendors, and clinical data aggregators . These organizations typically operate under HIPAA compliance frameworks—utilizing either the Safe Harbor method (stripping 18 specific personal identifiers) or the Expert Determination method (formal statistical risk assessment).

Key providers and platforms offering these capabilities include:

• Datavant : Specializes in health data connectivity and provides robust HIPAA de-identification services, including formal expert determination and privacy-preserving record linkage (PPRL) so datasets can be securely shared for research without exposing Protected Health Information (PHI).
• John Snow Labs : Offers enterprise-grade healthcare NLP and de-identification software (Spark NLP for Healthcare). Their pipelines process unstructured clinical text, PDFs, DICOM medical images, and structured FHIR resources while supporting end-to-end HIPAA Expert Determination documentation and risk analysis.
• Protecto AI : Provides automated de-identification pipelines tailored for AI and large language models (LLMs), masking PHI in-place across data repositories to prepare training and research data safely.
• CitiusTech : Features enterprise microservices like the Smart Data De-Identifier, which helps large healthcare and life sciences organizations anonymize multi-source clinical data into standardized formats like FHIR for analytics and research.
• Academic/Institutional "Honest Brokers" : For internal or collaborative academic studies, many major academic medical centers (such as UCSF or Johns Hopkins) use internal informatics cores or specialized tools (like DICOM Cleaner or open-source software like Amnesia ) to act as an "honest broker," stripping identifiers before handing datasets over to researchers.

If you'd like to narrow this down, let me know:

• What type of data you need to de-identify (e.g., unstructured clinical notes, DICOM medical images, or structured database tables)?
• Whether you prefer a fully managed service / expert determination or an in-house software tool?

Several specialized companies, technology platforms, and consulting firms provide healthcare data de-identification services and formal certifications to make protected health information (PHI) safe and compliant for research.

Major Providers and Tools

• Privacy Analytics by IQVIA : Applies expert determination and statistical risk-based methods to anonymize complex datasets while retaining data utility for clinical research.
• ArcherHall LLC : Frequently recommended by academic medical centers for providing formal third-party audits and certifications of data de-identification.
• iMerit : Combines automated AI processing with human-in-the-loop quality control to scrub clinical documents and imaging metadata of PHI.
• Microsoft Azure Health Data Services : Offers a cloud-native de-identification service utilizing advanced PHI detection to process unstructured clinical text while preserving temporal and entity relationships.
• BigID : Automates the discovery, cataloging, and targeted redaction or masking of PHI across large enterprise data stores.
• Protecto AI : Focuses on tokenization and privacy-preserving data preparation for secondary AI analytics and research pipelines.

If you'd like, let me know:

• Is your dataset structured (spreadsheets, databases) or unstructured (clinical notes, medical imaging)?
• Do you need software tools to do it yourself or a third-party expert certification for compliance?

I can help narrow down the best provider for your project.

Yes. There are several types of providers, ranging from specialized de-identification vendors to health systems/university research data teams and health-data platforms.

Notable providers

• datavant.com — Provides healthcare data privacy/de-identification services, including HIPAA Expert Determination, de-identification of unstructured text, and privacy-preserving linkage.
• johnsnowlabs.com — Offers healthcare NLP-based de-identification for clinical text and professional Expert Determination services, useful for research datasets containing notes and other free text.
• bonamisoftware.com — Offers PHI de-identification for research and healthcare AI, including Safe Harbor, Expert Determination, structured data, clinical text, and risk validation.
• Microsoft Azure Health Data Services — Provides a de-identification service that identifies and redacts/surrogates PHI in healthcare data, including clinical text.
• University of Michigan / Michigan Medicine — Its Data Solutions team provides an honest-broker/de-identification service specifically for research, including clinical data pulled from MiChart and DataDirect.
• Many academic medical centers have similar research data cores/honest-broker services. For example, UC Davis describes its honest-broker process for de-identifying clinical data for research.

What to look for

If you're outsourcing this for a research project, I'd distinguish between three services:

1. Safe Harbor de-identification — removal of HIPAA's specified identifiers.
2. Expert Determination — a qualified expert assesses and documents that re-identification risk is "very small." This can preserve more useful research variables, such as granular dates, than Safe Harbor.
3. De-identification of unstructured clinical text — NLP-based removal or replacement of names, MRNs, dates, locations, etc., from progress notes, pathology reports, radiology reports, and similar documents.

For research datasets, Expert Determination is often particularly interesting because it can retain more analytical utility than simply applying Safe Harbor. HHS explicitly recognizes both approaches under HIPAA.

If you tell me what kind of healthcare data you have (EHR tables, clinical notes, imaging/DICOM, claims, genomics, etc.) and approximately how large the dataset is, I can give you a shortlist of 5–10 vendors that actually provide this as a service, including approximate pricing/model, research experience, and whether they will sign a BAA.

Healthcare data de-identification services for research purposes are provided by specialized health tech firms, cloud infrastructure providers, and specialized artificial intelligence/natural language processing (NLP) companies . These services generally transform Protected Health Information (PHI) to comply with regulations like HIPAA (via Safe Harbor or Expert Determination methods) while maximizing the analytical utility of the data for longitudinal studies, machine learning, and clinical research.

Prominent providers and platforms in this space include:

• Datavant : Widely recognized for tokenization and privacy-preserving data connectivity, providing tools like Privacy Hub to de-identify and securely link real-world evidence and clinical datasets across silos.
• Privacy Analytics (by IQVIA): Focuses heavily on the Expert Determination method, utilizing advanced statistical models to minimize re-identification risk while retaining rich clinical data utility.
• John Snow Labs : Specializes in healthcare-focused NLP software that automatically detects and obfuscates PHI across clinical text notes, scanned or text-based PDFs, DICOM medical images, and structured databases.
• iMerit : Combines secure, expert-led human oversight with AI-assisted workflows specifically engineered to clean and de-identify unstructured clinical documentation and image metadata for research and AI model training.
• Google Cloud Healthcare API : Offers native data de-identification features (integrated with Data Loss Prevention tools) to scrub, redact, or hash DICOM and FHIR-formatted healthcare data directly inside cloud environments.
• Amazon Comprehend Medical : Provides automated, API-driven PHI entity extraction and detection to assist researchers in flagging and removing identifiers from raw medical text.
• BigID : Provides automated data intelligence and discovery software that catalogs, maps, and initiates privacy-compliant de-identification workflows for unstructured and structured health records.

If you are looking for a solution, let me know:

• Is your data structured (databases), unstructured (clinical notes/PDFs) , or multimodal (images + text)?
• Are you leaning toward a Safe Harbor rules-based approach or an Expert Determination statistical risk approach?

I can help you narrow down which vendor fits your technical and compliance needs best.

Yes. There are several categories of providers, ranging from commercial de-identification platforms to specialized research organizations and open-source tools.

Commercial healthcare-data de-identification providers

• azure.microsoft.com — Offers a cloud API that detects, redacts, or substitutes PHI in clinical notes, transcripts, messages, and clinical-trial material. It specifically supports research and analytics use cases.
• datavant.com — Provides healthcare data connectivity and privacy services, including HIPAA de-identification through Expert Determination, as well as handling unstructured text and state-specific requirements.
• synthologysolutions.com — Its XyDromatics platform is designed specifically for research-safe healthcare data, including structured information, free text, dates, and PHI embedded in medical images.
• racube.com — Provides automated PHI detection/de-identification for unstructured clinical notes, targeting research, analytics, AI, and data-sharing applications.
• maxiomlabs.com — Offers custom healthcare de-identification pipelines covering structured data and free text, with Safe Harbor/Expert Determination approaches and audit trails.

Research-oriented/open-source options

• NLM-Scrubber, from the National Library of Medicine, is freely available for de-identifying clinical text according to HIPAA Safe Harbor principles. It is particularly relevant if you want to run the software yourself rather than send PHI to a vendor.
• Philter, developed at University of California San Francisco, is an open-source clinical-text de-identification system. UCSF reported an externally certified Philter pipeline used to make more than 130 million clinical notes available to researchers.
• PhysioNet DeID and other academic systems are also used for research datasets; a recent benchmark identifies PhysioNet DeID, Philter, NLM Scrubber, and CliniDeID among tools focused on clinical text.

What to look for

For research use, I'd distinguish between a vendor that merely redacts names and one that can provide a defensible HIPAA de-identification workflow. In the U.S., HIPAA recognizes two principal approaches: Safe Harbor and Expert Determination. Expert Determination involves a qualified expert assessing and documenting that the risk of re-identification is sufficiently small.

If your dataset contains EHR tables + clinical notes + DICOM images, I'd prioritize a provider that can handle all three rather than combining several point solutions. A 2026 systematic review notes that free-text de-identification is much more mature than de-identification of structured data and medical images, so the latter deserve particular scrutiny.

If you tell me what type of healthcare data you have (EHR, clinical notes, claims, imaging, genomics, etc.), approximate volume, and whether you need HIPAA Safe Harbor or Expert Determination, I can narrow this to the 5–10 best vendors for your research project and compare pricing, deployment model, certifications, and capabilities.