Paper deep dive
TIDE 2.0: an open, model-agnostic engine for keyed de-identification of clinical notes
Jose D. Posada, Somalee Datta, Priya Desai
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 10/7/2026, 8:54:45 AM
Summary
The paper introduces TIDE 2.0, an open-source, model-agnostic engine for de-identifying clinical notes. It separates the process into an interchangeable recognizer (such as the distilled TIDE2-Sentry model) and a keyed anonymizer that replaces identifiers with consistent surrogates without storing linkage tables. The system preserves temporal intervals and ensures cross-note consistency. Benchmarks on SHIELD and i2b2 2014 corpora show high span-level recall and precision, outperforming several external open-source taggers.
Entities (10)
Relation Signals (8)
TIDE2-Sentry → basedonarchitecture → DeBERTa-v3-large
confidence 95% · TIDE2-Sentry is a DeBERTa-v3-large token classifier
Shield → collectedby → Stanford Medicine
confidence 95% · SHIELD 15 contains 1,381 clinical notes from Stanford Medicine
TIDE2-Sentry → distilledfrom → Gemini 2.5 Flash
confidence 95% · TIDE2-Sentry is a DeBERTa-v3-large token classifier distilled from Gemini 2.5 Flash
TIDE 2.0 → evaluatedon → SHIELD
confidence 95% · On two gold-annotated corpora... SHIELD... the default configuration reached span-level recall of 0.88
TIDE 2.0 → evaluatedon → i2b2 2014
confidence 95% · On two gold-annotated corpora... i2b2 2014... the default configuration reached span-level recall of 0.77
TIDE 2.0 → hascomponent → TIDE2-Sentry
confidence 95% · The default configuration pairs a token classifier, distilled from an LLM, with a regex layer... TIDE2-Sentry is a DeBERTa-v3-large token classifier
TIDE 2.0 → implementsstrategy → keyed anonymization
confidence 95% · The anonymizer is keyed and table-free... Surrogates are generated cryptographically with no stored linkage table.
TIDE 2.0 → runson → Ray
confidence 90% · Both stages run on Ray, a distributed runtime
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Clinical notes capture most of what is documented about a patient's care, but they cannot be used for research until protected health information (PHI) is removed. De-identification is often treated as a detection problem. Detection alone is not sufficient: redaction strips clinical content along with identifiers, date blanking destroys the temporal intervals needed for longitudinal analysis, and assigning a fresh random surrogate at each occurrence breaks links between a patient's notes. We present TIDE 2.0, an MIT-licensed engine with two separable stages: an interchangeable recognizer and a keyed anonymizer. Both run on hardware the institution owns. Surrogates are generated cryptographically with no stored linkage table. Dates shift by a per-patient, interval-preserving offset; each value receives the same surrogate across all occurrences under a given key; and a release produced under a new key cannot be linked to earlier releases. We also release TIDE2-Sentry, a recognizer distilled from a large language model. On two gold-annotated corpora from two institutions, the default configuration reached span-level recall of 0.88 in-domain and 0.77 on the second institution's corpus, at precision 0.88 and 0.87. We report recall and precision per category alongside these aggregates. The engine is open source, and the recognizer is available under a gated research-use agreement, so institutions can run, inspect and extend both within their own environments.
Tags
Links
- Source: https://arxiv.org/abs/2610.07224v1
- Canonical: https://arxiv.org/abs/2610.07224v1
Trouble viewing inline? Open PDF directly →
Full Text
115,036 characters extracted from source content.
Expand or collapse full text
TIDE 2.0: an open, model-agnostic engine for keyed de-identification of clinical notes Jose D. Posada †thanks: Corresponding author: jdposada@stanford.edu Somalee Datta Priya Desai Affiliation: Technology & Digital Solutions, Stanford Medicine, Stanford, CA, USA Abstract Clinical notes capture most of what is documented about a patient’s care, but they cannot be used for research until protected health information (PHI) is removed. De-identification is often treated as a detection problem. Detection alone is not sufficient: redaction strips clinical content along with identifiers, date blanking destroys the temporal intervals needed for longitudinal analysis, and assigning a fresh random surrogate at each occurrence breaks links between a patient’s notes. We present TIDE 2.0, an MIT-licensed engine with two separable stages: an interchangeable recognizer and a keyed anonymizer. Both run on hardware the institution owns. Surrogates are generated cryptographically with no stored linkage table. Dates shift by a per-patient, interval-preserving offset; each value receives the same surrogate across all occurrences under a given key; and a release produced under a new key cannot be linked to earlier releases. We also release TIDE2-Sentry, a recognizer distilled from a large language model. On two gold-annotated corpora from two institutions, the default configuration reached span-level recall of 0.88 in-domain and 0.77 on the second institution’s corpus, at precision 0.88 and 0.87. We report recall and precision per category alongside these aggregates. The engine is open source, and the recognizer is available under a gated research-use agreement, so institutions can run, inspect and extend both within their own environments. Introduction Much of what is documented about a patient’s care is written as free text. Some diagnoses never reach a billing code. The reasoning behind a treatment change and the symptoms that precede a diagnosis by years are also often recorded only in the clinical note. These details are absent from the structured tables held alongside the note in a research data warehouse 1, 2. Note text supports several secondary uses. A systematic review of case detection found that reading note text alongside diagnosis codes improves ascertainment 3. Postoperative complications appear in operative and progress notes that discharge coding does not record 4. Off-label prescribing appears in note text because no structured field encodes indication 5. Adapted language models have produced summaries of clinical text that clinicians rated above human-written summaries 6. Longitudinal questions also depend on the text. Examples are predicting disease from a patient’s trajectory 7 and reasoning over a clinical history that spans years 8. Both require knowing what happened, when, to whom and in what order. Notes cannot be used for research until identifiers are removed. HIPAA Safe Harbor lists 18 categories of protected health information (PHI). These must be handled before a note can be used for secondary research. A missed identifier can result in a reportable disclosure. The alternative route, expert determination, requires a statistical judgement by a qualified expert 9. In practice, notes are often kept behind an access committee or released only as small curated extracts. This limits the assembly of large corpora. De-identification has largely been treated as a detection problem, and detection has improved over time. The first shared task on the problem showed that automatic detection was feasible on discharge summaries 10. A review of the following decade described a field converging on hybrid rule-based and learning systems 11. Sequence-labeling taggers have progressed from conditional random fields through LSTMs to transformers that generalise across institutions 12. Recent clinical transformers match or exceed commercial cloud vendors on span-level accuracy 13. Large language models perform well without task-specific training, in both zero-shot 14 and few-shot 15 settings. A detected span is not a de-identified corpus. Redacting every detected span removes clinical content along with the identifier. In a physician review, most false-positive detections changed the clinical meaning of a note. Detection F1 did not reflect this loss 16. Blanking or coarsening dates removes the intervals that longitudinal analysis relies on. Drawing an independent random surrogate at each occurrence removes cross-note linkage. A patient, provider or encounter can then no longer be followed through a record. Replacing identifiers with realistic surrogates predates most of this detection work. Scrub replaced each identifier with a realistic value of the same type in 1996 17. Resynthesised identifiers were later shown not to degrade taggers trained on the resulting text 18. Replacement has also been described as a defence in its own right. A missed identifier is harder to find in a note containing plausible surrogates than in a note containing redaction marks 19. The i2b2 2014 corpus 20 and MC-MED 21 were released with surrogate replacement. MIMIC instead left bracketed placeholders where identifiers had been 22. To our knowledge, few open tools generate surrogates that are both realistic and consistent across a patient’s notes. The tooling gap also concerns how the parts fit together. The open clinical de-identifiers were built to process one note at a time. The PhysioNet software is rule-based and distributed as a script, with no execution layer around it 23. BoB reached high recall on Veterans Health Administration documents. It combined rule-based and statistical components tuned to one institution’s document set 24. Presidio is a widely used PII framework. It ships no clinical models and no distributed execution layer 25. TIDE 1.0, the prior Stanford tool, couples its recognizer to its anonymizer, so neither can be replaced independently. It either redacts most structured identifiers or replaces them with random values 26. Managed cloud services provide detection but require a business associate agreement (BAA) with the provider and send clinical text outside the institution. To our knowledge, no open engine combines three properties. First, the recognizer can be exchanged without changing anything else; it may be a large language model (LLM) or a fine-tuned small language model such as DeBERTa. Second, the engine runs on hardware the institution already owns. Third, it replaces the detected spans with realistic surrogates that are consistent across a patient’s notes, so that the corpus remains usable. Supplementary Tables S7, S10 and S11 compare TIDE 2.0 with TIDE 1.0, OpenMed and three managed cloud services on these properties. We built this engine. TIDE 2.0 11 1 https://github.com/susom/tide2-core is an MIT-licensed framework that separates a recognizer stage from an anonymizer stage (Fig. 1). A site can therefore adopt a recognizer today and replace it later. Notes that were already processed do not need to be re-anonymized. Both stages run on Ray, a distributed runtime, and can read from and write to warehouse note tables. In this paper we benchmark them on a single commodity GPU; we do not report a warehouse-scale deployment. The anonymizer is keyed and table-free. Dates move by a per-patient offset that preserves every interval. Alphanumeric identifiers are replaced by format-preserving encryption, and names are replaced by deterministic keyed selection. The same value therefore receives the same surrogate everywhere under one key, and no database of mappings is stored. A release produced under a new key cannot be linked to releases produced under the old one. The default configuration pairs a token classifier, distilled from an LLM, with a regex layer, and runs behind the institutional firewall. Any other model can fill the recognizer stage. We report what the default configuration detects on two gold-annotated corpora from two institutions and where, per category, it fails. We also report what the anonymizer guarantees and its throughput on one GPU. We release the engine and the recognizer so that other sites can run, inspect and extend them. Four stacked bands showing one clinical sentence transformed down the page. Band 1, the note as written, names a patient, a medical record number, a physician, two dates, a hospital and a phone number. Band 2 shows the same sentence with each identifier bracketed and typed as PATIENT, ID, DOCTOR, DATE, HOSPITAL or PHONE. Band 3 lists the replacement strategy per category: keyed selection from a surrogate list for names, F3 format-preserving encryption for identifiers and phone numbers, and a per-patient HMAC date offset that preserves the fourteen-day interval. Band 4 shows the released note, in which every identifier has been replaced by a plausible surrogate of the same type and both dates have moved by the same ten days. Figure 1: One sentence through the pipeline. The recognizer stage detects and types PHI spans and caches them before any text is altered. A reviewer can therefore inspect the detected spans before the anonymizer runs. The anonymizer stage applies a keyed strategy to each category. Both dates move by the same per-patient offset, so the fourteen-day interval between them is preserved. Fig. 4 shows the component-level architecture. Results Study design We evaluated every recognizer on two gold-annotated corpora. SHIELD 15 contains 1,381 clinical notes from Stanford Medicine with 10,229 annotated PHI spans in 9 categories, a mean of 7.4 identifiers per note. The i2b2 2014 de-identification corpus 20 contains 1,304 clinical notes from a different institution. After the label crosswalk described in Methods, it carries 27,298 spans, a mean of 20.9 identifiers per note. The two corpora differ in institution, note type and identifier density. SHIELD measures in-domain behaviour, and i2b2 measures what a site inherits when it adopts a model trained elsewhere. The primary outcome is span-level recall, reported per category and per corpus. We treat a missed identifier as a disclosure, which differs from a precision error that removes a clinical word. Secondary outcomes are span-level precision, sustained throughput and the structural guarantees of the anonymizer. Precision indicates how much clinical content survives replacement. Methods gives the span-matching rule, the 0.8 overlap threshold and the bootstrap procedure. Table 1 reports span-level precision and recall on both corpora. It covers the default configuration (TIDE2-Sentry+regex), TIDE2-Sentry alone, regex alone, TIDE 1.0, the two AIMI recognizers and the 6 external open-source PII taggers. Table 1: PHI detection performance by recognizer and corpus. Span-level precision (P) and recall (R) are micro-averaged over pooled category counts and macro-averaged over the 9 categories, at an overlap threshold of 0.8. The upper block shows the regular-expression and gazetteer layer alone, TIDE 1.0, the two AIMI recognizers, and the distilled TIDE2-Sentry with and without the regex layer; TIDE2-Sentry+regex is the default configuration. The lower block shows the 6 external open-source PII taggers. TIDE 1.0 was run on SHIELD only (“–”). The AIMI recognizers have no AGE, LOCATION or WEB label, and their macro averages include zeros for these three categories. The AIMI recognizers were also trained on i2b2 2014, so that corpus is not held out for them. No other model was trained on either corpus. Per-category values are in Supplementary Tables S1–S2. The same values with bootstrap confidence intervals are in Supplementary Tables S4–S5. SHIELD i2b2 2014 micro macro micro macro Recognizer P R P R P R P R TIDE2 regex 0.97 0.42 0.52 0.39 0.98 0.39 0.48 0.27 tide1 0.48 0.39 0.41 0.38 – – – – AIMI v1 0.67 0.72 0.45 0.55 0.73 0.67 0.44 0.49 AIMI v2 0.63 0.70 0.43 0.53 0.70 0.65 0.43 0.47 TIDE2-Sentry 0.89 0.88 0.85 0.81 0.87 0.77 0.72 0.67 TIDE2-Sentry + regex 0.88 0.88 0.83 0.80 0.87 0.77 0.72 0.67 External open-source PII taggers DeBERTa-PII (lakshyakh93) 0.24 0.30 0.19 0.35 0.14 0.18 0.10 0.21 OpenMed SuperClinical L 0.49 0.48 0.48 0.47 0.54 0.45 0.43 0.41 OpenMed SuperClinical S 0.50 0.51 0.49 0.54 0.53 0.46 0.40 0.43 PII-Identifier (antonio) 0.50 0.48 0.50 0.49 0.57 0.42 0.51 0.43 Ettin-68M Nemotron 0.52 0.48 0.53 0.50 0.57 0.45 0.44 0.44 ekacare MiniLM 0.43 0.46 0.45 0.58 0.50 0.48 0.33 0.46 On SHIELD, the default configuration reaches micro-averaged recall 0.88 at precision 0.88; macro-averaged recall and precision are 0.80 and 0.83. TIDE2-Sentry alone reaches micro-averaged recall 0.88 at precision 0.89, and macro-averaged recall and precision of 0.81 and 0.85. The stronger of the two AIMI recognizers 13, AIMI v1, reaches micro-averaged recall 0.72 at precision 0.67. The AIMI recognizers were trained on radiology reports and on i2b2 2014. Their label set covers DATE, DOCTOR, HOSPITAL, ID, PATIENT, PHONE and has no AGE, LOCATION or WEB label, so they score zero in those categories. Over the six categories they cover, macro-averaged recall is 0.83 for AIMI v1 and 0.88 for TIDE2-Sentry. Both AIMI recognizers match or exceed TIDE2-Sentry on DATE and ID. TIDE 1.0 reaches micro-averaged recall 0.39 at precision 0.48. On i2b2 2014, the default configuration reaches micro-averaged recall 0.77 at precision 0.87, and TIDE2-Sentry alone reaches 0.77 at 0.87. Macro-averaged recall and precision of TIDE2-Sentry are 0.67 and 0.72, or 0.68 for recall when WEB, with 7 gold spans, is left out. AIMI v1 reaches micro-averaged recall 0.67 at precision 0.73. This corpus is in-domain for the AIMI recognizers and out-of-domain for TIDE2-Sentry. Over the six categories in the AIMI label set, macro-averaged recall is 0.73 for AIMI v1 and 0.68 for TIDE2-Sentry. AIMI v1 has the higher recall in 4 of the 9 categories. The advantage of TIDE2-Sentry is concentrated in the categories the AIMI recognizers do not cover (AGE, LOCATION) or detect poorly (DOCTOR, PATIENT). On PATIENT, TIDE2-Sentry reaches 0.79 against 0.56. The 6 external open-source PII taggers were run on both corpora. They were trained on non-clinical or non-US identifier distributions, so they serve as an out-of-distribution probe and not as tuned baselines. Their micro-averaged recall ranges from 0.30 to 0.51 on SHIELD and from 0.18 to 0.48 on i2b2 2014. The highest values are OpenMed SuperClinical S on SHIELD (precision 0.50) and ekacare MiniLM on i2b2 (precision 0.50). The maximum DOCTOR recall among the external taggers is 0.00 on SHIELD and 0.00 on i2b2. Their taxonomies have a single generic person type and do not separate patients from providers, which clinical de-identification requires. When DOCTOR and PATIENT are pooled into one NAME category, their NAME recall ranges from 0.44 to 0.81 on SHIELD and from 0.40 to 0.82 on i2b2, against 0.91 and 0.84 for TIDE2-Sentry (Supplementary Table S14). Figure 2 shows per-category recall for all recognizers on both corpora. Two radar plots of span-level recall across nine PHI categories, one for SHIELD and one for i2b2 2014. Each plot shows the regex layer, the two AIMI recognizers, TIDE2-Sentry and six external open-source PII taggers. Figure 2: Per-category recall of all recognizers on each corpus. Each axis is one PHI category, and the radial scale is span-level recall from 0 to 1 at an overlap threshold of 0.8. Top: SHIELD. Bottom: i2b2 2014. Each panel shows the regex layer, the two AIMI recognizers, TIDE2-Sentry and the 6 external open-source taggers. The +regex ablations are omitted. Values are those in Supplementary Tables S1–S2. Regex alone reaches ID recall 0.56, TIDE2-Sentry alone reaches 0.90, and the two together reach 0.91. Adding the regex layer changes ID recall by +0.012 (95% CI +0.000 to +0.029) on SHIELD and +0.009 (+0.005 to +0.014) on i2b2, and micro-averaged recall by -0.001 (-0.003 to +0.001) and +0.003 (+0.001 to +0.004). It also lowers LOCATION recall and WEB precision on SHIELD (Supplementary Table S13). On these two corpora, the net effect of the regex layer on detection is therefore small. Moving from SHIELD to i2b2 2014 reduces the micro-averaged recall of TIDE2-Sentry by 0.11, from 0.88 to 0.77. Precision changes little, from 0.89 to 0.87. Supplementary Table S12 splits the drop into one term per category. Each term weights a category’s recall change by its share of gold spans (Methods). Recall changes account for 0.120 of the drop, and the different category mix of the two corpora for -0.008. HOSPITAL, ID and PHONE together contribute 56% of the drop (HOSPITAL 0.034, ID 0.018, PHONE 0.010). HOSPITAL recall falls by 0.39, from 0.79 to 0.39; PHONE by 0.29, from 0.85 to 0.56; and ID by 0.26, from 0.90 to 0.64. DATE contributes 33% (0.037). Its recall falls less, from 0.94 to 0.85, but DATE is the largest category on i2b2. DOCTOR goes from 0.90 to 0.85. LOCATION recall is higher on i2b2 than on SHIELD, 0.65 against 0.55. WEB has 7 gold spans on i2b2, and we do not interpret its change. We did not analyse the missed spans, so the causes of these drops are hypotheses. One hypothesis is that HOSPITAL, ID and PHONE depend on local vocabulary and formats, such as facility names and acronyms, identifier formats and phone conventions, that are rare in the Stanford training notes. The drop also mixes other differences between the corpora: note types, the surrogate identifiers that replace real ones in i2b2 (Methods), and the label crosswalk. We also varied the scoring choices. Re-mapping isolated years, weekdays, seasons and bare month names in i2b2 from PHI to safe, following the convention of Philter, changes the i2b2 recall and precision of TIDE2-Sentry by less than 0.03, in opposite directions. Trimming leading and trailing whitespace from predicted spans before matching raises i2b2 recall by 0.03 and SHIELD recall by 0.01. The crosswalk decisions were made with access to both corpora. Without the boundary alignment of the crosswalk, i2b2 micro-averaged recall of the default configuration is 0.69 rather than 0.77. At an overlap threshold of 0.5 instead of 0.8, it is 0.90 on SHIELD and 0.82 on i2b2. Counted by characters instead of spans and ignoring category, predicted spans cover 0.99 of gold PHI characters on SHIELD and 0.95 on i2b2. This is the share of identifier text that the anonymizer rewrites. The Philter re-mapping and whitespace trimming do not change the ordering of the recognizers or the cross-corpus pattern; the other three checks were run for the default configuration only. Supplementary Table S6 records every crosswalk decision. Distillation, anonymizer and throughput TIDE2-Sentry is a DeBERTa-v3-large token classifier distilled from Gemini 2.5 Flash over ∼ 13,000 unannotated notes (Methods). To measure distillation fidelity, the teacher was scored on all 1,381 SHIELD notes with the extraction prompt in Supplementary Note 1. That prompt was developed on a few dozen notes outside SHIELD and i2b2. Supplementary Fig. S1 compares teacher and student per category on SHIELD. The full table with confidence intervals is Supplementary Table S3. The student reaches macro-averaged recall 0.81, against 0.90 for the teacher. It has lower recall than the teacher in every category. Ordered by size, the recall differences are WEB (-0.15), AGE (-0.12), LOCATION (-0.11), PHONE (-0.10), HOSPITAL (-0.09), PATIENT (-0.07), DOCTOR (-0.06), ID (-0.05) and DATE (-0.04). After Bonferroni correction across the 9 categories, every difference except WEB (adjusted p=0.202p=0.202) remains significant at 0.05; the ID difference is close to that threshold (adjusted p=0.045p=0.045). Both models have their lowest recall on LOCATION: 0.66 for the teacher and 0.55 for the student. The low recall in this category is therefore shared with the teacher, and distillation adds a further gap (Δ -0.11). The guarantees of the anonymizer follow from a keyed, table-free construction. The measurement question is whether the implementation realizes the construction. Table 2 reports a seeded synthetic stress set of 2,000 distinct values per keyed category. The set contains no PHI. Table 2: Anonymizer verification. A seeded synthetic stress set containing no PHI (2,000 distinct values per keyed category). The first four rows are structural guarantees of the keyed construction, and they check that the implementation realizes them. The remapping row uses 1,000 two-token names and 1,000 eight-digit identifiers. The collision rows measure a property that is not guaranteed a priori: whether distinct real values receive distinct surrogates. The 3–5-digit row tests every value of each length. N is the number of distinct values tested. These are unit-level checks of the implementation on synthetic values, not a re-identification or linkage attack. Property Construction N Result Determinism (same key) keyed HMAC / F3 / selection 2,000 100.0% identical Remapping (rotated key) new key remaps surrogate 2,000 100.0% remapped Cross-note consistency same value → same surrogate 1,000 100.0% linked Interval preservation per-patient date shift 2,000 100.0% exact day-delta ID collisions, 8 digits F3, no padding 2,000 0.00% (2,000 distinct) ID collisions, 3–5 digits F3, padded, truncated 111,000 34.8%–36.6% Name collisions keyed per-token selection; pool 2,276 2,000 0.4% (1,993 distinct) Name collisions keyed per-token selection; pool 2,276 20,000 3.3% Determinism, cross-note consistency, remapping under a new key and interval preservation each hold on 100.0% of trials. This is expected for a keyed deterministic construction. Supplementary Table S8 shows worked examples per category, and Supplementary Table S9 follows one name, identifier and date across two notes under a fixed and a new key. The collision measurements are not guaranteed a priori. Eight-digit identifiers need no padding, and F3 over a fixed content length is a permutation; they collided at 0.00%. Numeric identifiers shorter than six digits are padded, encrypted and truncated back to their original length (Methods), so the map is not a permutation. Across all 3- to 5-digit values, 35% to 37% of values shared a surrogate with another value. Name surrogates are drawn by keyed selection from a pool of 2,276 entries per token, so distinct real names can collide. We measured 0.4% among 2,000 names and 3.3% among 20,000; the rate grows with the number of distinct names. A collision merges two identities under one surrogate. This reduces linkage precision and does not reveal either original value. Table 3 reports throughput per stage on 1 NVIDIA L4 GPU with 16 vCPUs, for the full SHIELD corpus and for a bounded subset of the longest notes. The stages ran as one automatically chained job; we did not measure whether they overlapped in time. GPU recognition was the slowest stage on both corpora. Peak GPU memory on the long-note subset was 5.8 GB. No batch failed for lack of memory in either configuration. The CPU-only path was not tuned (Supplementary Note 3). Table 3: Throughput per stage, in content-tokens per second. 1 NVIDIA L4 GPU on a GCP VM with 16 vCPUs and 64 GB of RAM, running TIDE2-Sentry with a 512-token window budget and 40-token overlap. Transformer: the token classifier. Recognizer: the CPU regex and Aho–Corasick stage. Left: the full SHIELD corpus (1,381 notes, 359,779 tokens). Right: a bounded subset of the longest notes (2,096,828 tokens). One run per configuration, so these are indicative rather than a mean. The CPU-only columns are an untuned single-actor configuration; the CPU stages are shared between the two paths. SHIELD Longest notes Stage L4 path CPU-only L4 path CPU-only Transformer 4,063 200 10,104 358 Recognizer 6,127 6,127 27,591 27,591 Anonymizer 4,421 4,421 21,547 21,547 End-to-end 1,573 186 5,506 348 Discussion The default configuration, a distilled token classifier with a regex layer running behind an institutional firewall, detected 0.88 of the PHI spans in a Stanford corpus and 0.77 of those in a corpus from a different institution. Precision was 0.88 and 0.87, respectively. At the second institution, HOSPITAL, ID and PHONE contributed 56% of the loss in recall and DATE 33%. The anonymizer that consumes the detected spans was deterministic, interval-preserving and remapped under a new key on 100.0% of trials in a synthetic stress set. The full SHIELD corpus ran end to end at 1,573 content-tokens per second on one commodity GPU. Together, these results show that detection with an exchangeable recognizer, keyed surrogate replacement, interval-preserving date shifts and cross-note consistency can be combined on hardware a site owns. Most de-identification studies report F1, which treats a leaked identifier and a removed clinical term as equivalent errors. The two errors have different consequences. A missed identifier is a reportable disclosure, and documented re-identification attacks on health data mostly start from identifiers that were missed 27. A false positive replaces a clinical word with a surrogate and reduces research signal. One study found that encoders pretrained on automatically de-identified clinical text lose little on downstream tasks 28. A privacy officer needs to know how many identifiers remain, and a researcher needs to know how much of each note is preserved. A single averaged score answers neither question. F1 also does not measure what happens after detection. A system that detects every identifier and then deletes it receives a perfect score, yet the resulting corpus contains no date intervals, patient threads or provider attributions. Redaction-based tooling behaves this way by default. A physician review found that most false-positive detections change the clinical meaning of a note, and detection metrics did not register this 16. We therefore used span-level recall as the primary outcome, because a missed identifier carries the greater cost. We report precision as an indicator of the clinical content that survives replacement. We suggest reporting recall and precision as a pair rather than as their harmonic mean. Clinical de-identification has a long history. Philter combined regular expressions, a part-of-speech tagger and safe and unsafe word lists, and it remains a reference point for recall-first design 29. The MIST toolkit treated surrogate replacement as a primary output 30. Recurrent taggers with a conditional random field layer, neural sequence labelling and transformers pretrained on clinical text later improved results on the same benchmark 31, 32, 33. Annotated corpora and shared tasks shaped this progression. The 2014 i2b2/UTHealth task provided the benchmark and evaluation script 34, and the 2016 CEGS N-GRID task moved evaluation to psychiatric intake records 35. An independently annotated paediatric corpus showed that systems score below their published results on corpora they were not tuned on 36. More recently, transformers have matched or exceeded commercial cloud vendors on span-level accuracy 12, 13, and large language models perform well without task-specific training 14. Our comparison covers the two AIMI recognizers and six external open-source taggers. On SHIELD, TIDE2-Sentry reached micro-averaged recall 0.88, against 0.72 for AIMI v1. On i2b2 2014 the values were 0.77 and 0.67. The AIMI recognizers were also trained on i2b2 2014, so this corpus is in-domain for them and out-of-domain for TIDE2-Sentry. The i2b2 comparison is therefore not a held-out comparison for AIMI, and we do not use it to rank the two. AIMI v1 had higher recall than TIDE2-Sentry in 4 categories on i2b2: DATE, HOSPITAL, ID and PHONE. One explanation is that these categories depend on local formats and vocabulary, which a model trained on the corpus can learn; the same categories account for most of the cross-corpus loss of TIDE2-Sentry, described below. The external taggers reached micro-averaged recall of 0.30 to 0.51 on SHIELD and 0.18 to 0.48 on i2b2. They were not built for clinical notes and serve as a robustness probe. We did not compare TIDE 2.0 against Philter, MIST, NeuroNER or the top i2b2 2014 systems. Each of them is a recognizer, and TIDE 2.0 provides the stage into which a recognizer is placed. Any of them could fill that stage. A comparison among them would indicate which recognizer a site should choose. It would say nothing about the engine, the anonymizer or the execution layer, which are the subject of this paper. Because the recognizer stage is open, such a comparison on one corpus and one metric is straightforward to set up, and we regard it as a useful next study. The tools a site might compare with TIDE 2.0 are different in kind. Presidio is the most widely used open PII framework, and TIDE 2.0 adopts its recognizer interface. It ships no clinical models and no distributed execution layer, so a site building on it must write the warehouse tier itself 25. OpenMed is a per-document detection toolkit, and its models can fill the recognizer stage. Managed cloud services detect and, in most cases, replace identifiers. They require clinical text to leave the institutional perimeter under a BAA. TIDE 1.0, the predecessor of this work, coupled recognition to a fixed rule-and-dictionary engine and redacted most structured identifiers instead of replacing them 26. Supplementary Tables S7, S10 and S11 compare these options with TIDE 2.0 feature by feature. To our knowledge, none of them combines an exchangeable recognizer with keyed, cross-note-consistent replacement in an open engine that runs inside the institution. TIDE 2.0 is designed to read from and write back to warehouse note tables, but this paper does not report a warehouse-scale deployment. Its contribution is the separation of an exchangeable recognizer from a keyed anonymizer, and the release of both the engine and a distilled recognizer. Several governance properties follow from the cryptographic construction. No linkage table is stored, so there is no table to protect, audit or lose. Consistency across notes depends on a key. Keys are isolated per study or tenant, so two releases produced under different keys cannot be linked to each other. A new key re-maps every surrogate deterministically. Rotation does not protect releases already issued: a party holding a disclosed key can recompute the surrogates in those releases for any candidate value, and those releases would need to be withdrawn or re-issued. Detected spans are cached before any text is altered, so a reviewer can inspect what a model found before the anonymizer runs. At inference, the released recognizer runs on institutional hardware, so no protected health information crosses the perimeter, and the de-identified corpus is the only artefact that leaves it (Fig. 3). Distillation was the exception: the teacher labelled identified notes through a cloud service under a BAA (Methods). The engine is MIT-licensed, and a security reviewer can read its code to check each of these properties. A dashed box labelled institutional security perimeter contains four components: clinical notes from warehouse source tables, a Ray cluster of GPU recognizer actors and CPU anonymizer actors, a cache of PHI spans inspected before any text is altered, and below them key custody holding per-study rotatable salts and keys, and an audit trail of the span cache and configuration. A single arrow leaves the perimeter to a de-identified corpus released to researchers under agreed terms, labelled as the only output that crosses. Figure 3: Deployment and the institutional perimeter at inference. All components that handle identified text run inside the institution. Keys are held per study or tenant. A new key re-maps every surrogate deterministically, so releases under different keys cannot be linked; releases already issued are not changed. The de-identified corpus is the only artefact that crosses the perimeter. The error pattern is more informative than the aggregate metrics. At the second institution, TIDE2-Sentry lost 0.39 of its HOSPITAL recall, 0.29 of PHONE and 0.26 of ID. Weighted by their share of gold spans, these three categories contributed 56% of the drop in micro-averaged recall, and DATE, the largest category on i2b2, contributed 33%. LOCATION improved. We hypothesise that the three categories with large drops depend on local vocabulary, such as facility acronyms, phone conventions and identifier formats, but we did not analyse the missed spans to confirm this. LOCATION is a different case, and we have not yet corrected it. It is the weakest category for the student (0.55 on SHIELD) and for the teacher (0.66). The low recall is shared with the teacher, which suggests that the label definition and the surface diversity of the category contribute; distillation adds a further gap (Δ -0.11). The two AIMI recognizers have no AGE, LOCATION or WEB label, so they cannot detect these categories on either corpus. This is a coverage limit of their label set, not a domain shift. The external PII taggers scored near zero on DOCTOR on both corpora. Their taxonomies have one generic person type and do not separate patients from providers; with DOCTOR and PATIENT pooled, their NAME recall reaches up to 0.81 on SHIELD. These three results have different causes, which supports reading per-category recall rather than an aggregate. This study has limitations. We did not run a downstream phenotyping or temporal-reasoning experiment on the de-identified corpus. Utility preservation is therefore argued by construction and verified structurally, and downstream equivalence is not demonstrated. Two designs could address this: a direct retention measurement in the style of the CIRE metric 16, and the pretrain-and-evaluate protocol used to show that automatic de-identification leaves downstream accuracy largely intact 28. Throughput comes from single runs on one machine and is indicative rather than a mean. The CPU-only path is an untuned single-actor configuration. We did not run on more than one node, measure overlap between stages, or test recovery from a failed worker. The student was trained on ∼ 13,000 teacher-generated silver labels. We did not characterise the noise in these labels against gold, so the effect of the teacher’s systematic errors on the student is unquantified. The distillation notes are disjoint from both corpora at the note level; we did not verify that their patients are disjoint from SHIELD’s. The AIMI recognizers were trained on i2b2 2014, so i2b2 is not a held-out corpus for them, and we did not verify that their Stanford training data are disjoint from SHIELD. The identifiers in i2b2 are surrogates, so recall there may differ from recall on real identifiers from that institution. The crosswalk decisions were made with access to both corpora. The 6 external taggers are off-distribution on clinical notes and serve as a robustness probe, not as tuned baselines. We do not report an LLM recognizer comparison. Prompt development was carried out for the teacher model only, and a comparison with unequal prompt-engineering effort would measure that effort rather than model capability. Keyed, on-premises surrogate replacement lowers re-identification risk without eliminating it 37. It offers no formal privacy guarantee of the kind defined by differential privacy 38. The anonymizer checks in Table 2 are unit-level tests on synthetic values; we did not run a linkage or re-identification attack on a release. We also did not test whether surrogates make missed identifiers harder to find, as reported for other systems 19. Membership inference is out of scope. We did not run the standard attack against a model trained on our output 39, and we did not probe a released encoder for memorised identifiers as has been done for clinical BERT models 40. The recognizer stage is the component most likely to be superseded, and it was designed to be replaceable. A site that adopts TIDE 2.0 with TIDE2-Sentry can switch to a better model later without re-anonymizing notes it has already processed. The crosswalk used here to score i2b2 against a Stanford taxonomy can also be used to score a new model against a site’s own taxonomy. Shared evidence would also help. Useful contributions include gazetteers of facility names and identifier formats, crosswalks between local taxonomies, and per-category results in a comparable form. We release tide2-core under an MIT license and the TIDE2-Sentry recognizer at https://huggingface.co/stanford-med-hdr/tide2-sentry-clinical-ner under a gated research-use agreement. We invite the OHDSI and open-source clinical NLP communities to evaluate them and report their findings. Methods Corpora SHIELD. SHIELD 15 comprises 1,381 Stanford Medicine clinical notes annotated for 9 PHI categories: AGE, DATE, DOCTOR, HOSPITAL, ID, LOCATION, PATIENT, PHONE and WEB. The corpus totals 10,229 gold spans. The annotation protocol, inter-annotator agreement, and category definitions are given in the corpus paper and are not re-derived here. i2b2 2014. The i2b2 2014 shared-task corpus 20 comprises longitudinal records from a second institution, released with surrogate-replaced PHI. Because we use it for evaluation only and train nothing on it, we pool all three track 1 releases, the two training sets and the test set, giving 1,304 notes and 28,867 annotated spans before crosswalking. Its identifiers are realistic surrogates rather than real values, so recall on i2b2 may differ from recall on real identifiers from the same institution. Label crosswalk. The two corpora use different taxonomies, so i2b2 gold is crosswalked to the SHIELD categories at scoring time. The mapping applies to the gold side only and does not affect SHIELD scoring. Four decisions define it. Each was measured on both corpora before adoption, so the decisions were made with access to the evaluation data; Results report i2b2 recall without the boundary alignment as well. First, i2b2 DATE maps to SHIELD DATE unchanged. Philter’s convention re-maps isolated years, weekdays, seasons and bare month names as non-PHI, but SHIELD annotates isolated years and weekdays too, and the affected forms are about a tenth of i2b2 DATE, so the conventions agree closely enough to map straight through. The Philter re-mapping is reported as a sensitivity analysis instead. Second, i2b2 AGE maps to SHIELD AGE unchanged. HIPAA Safe Harbor treats only ages of 90 and above as identifiers, but both corpora annotate ages at every value, and SHIELD’s AGE spans are dominated by values under 90, so the two conventions agree and no re-mapping is required. The corpora do disagree on how much text an AGE span covers, which is a boundary question handled below. Third, the i2b2 PROFESSION and ORGANIZATION tags are excluded from gold. Neither is a Safe Harbor identifier and neither has a SHIELD counterpart. Any PROFESSION or ORGANIZATION label that a recognizer emits maps to the unscored OTHER category, and neither TIDE2-Sentry nor the AIMI recognizers emit these labels, so removing the gold spans creates no unmatched false negative and no unpenalised false positive for them. It leaves one asymmetry for the external taggers: their company_name output maps to HOSPITAL, so a non-hospital organisation costs them a false positive with no gold span to match. Fourth, span boundaries are aligned. The two corpora annotate different extents for the same identifier, which the overlap rule below would otherwise score as a detection failure. i2b2 annotates the bare numeral of an age where SHIELD annotates the numeral with its unit, so an i2b2 AGE span is extended over a following age unit (1,390 spans extended). i2b2 annotates each address component separately where SHIELD annotates the whole address, so adjacent spans that all map to LOCATION and are separated by at most two characters of whitespace or punctuation are merged (950 merges). After the crosswalk, i2b2 gold is 27,298 spans. Supplementary Table S6 gives the full mapping. Leakage. The distilled recognizer was trained on teacher-generated labels over unannotated notes that are disjoint from both corpora at the note level. We did not verify that their patients are disjoint from SHIELD’s. No gold annotation from either corpus entered its training. The external taggers are public releases predating this evaluation. The AIMI recognizers 13 were also trained on i2b2 2014, so i2b2 is in-domain for them and is not a held-out test set for those two models. Their training data also include Stanford radiology reports, and we did not verify that these are disjoint from SHIELD’s notes or patients. Both corpora are therefore held out for the distilled recognizer (SHIELD at the note level) and for the external taggers; neither is verified as held out for the AIMI recognizers. System architecture TIDE 2.0 (tide2-core) is an MIT-licensed Python 3.12 library. It separates a recognizer stage, which detects PHI spans, from an anonymizer stage, which replaces them (Figure 1). The stages communicate through a cached span representation, so a site can run, audit and re-run recognition without re-anonymizing, and can change the strategy at either stage independently. Caching the spans is what makes recognition auditable: a reviewer inspects what a model detected before any text is altered. Figure 4 shows the components described in the rest of this section: the recognizer types and the span-resolution step, the per-category anonymizer strategies, the Ray streaming layer, and the cryptographic foundation they draw keys from. Figure 4: Component architecture. The recognizer slot accepts transformer token classifiers, an LLM recognizer, regular expressions and an Aho–Corasick gazetteer; span resolution passes a RecognizerResult list to the anonymizer, which applies keyed surrogates, format-preserving encryption, hashing and per-patient date jitter under a “same input ++ same keys == same output” rule. A Ray Data layer supplies GPU and CPU actors, out-of-memory batch splitting and checkpointing over a cryptographic foundation. Model-agnostic recognition. Recognition accepts four kinds of recognizer behind one interface: token classifiers, an LLM recognizer, regular expressions and an Aho–Corasick gazetteer. Any token classifier published through the Hugging Face transformers library 41 registers through a Presidio-compatible interface 25 with no pipeline change. In this paper the slot held nine token classifiers (TIDE2-Sentry, the two AIMI recognizers and the 6 external taggers) and the regex layer. An LLM-recognizer class prompts a generative model to return PHI spans as structured JSON, placing cloud and open-weight models in the same slot; here it was used only to run the distillation teacher. The same interface exposes regular-expression and Aho–Corasick matchers for structured identifiers such as medical record numbers, encounter identifiers and social security numbers. Aho–Corasick matches an entire gazetteer in a single pass over the note 42, so a site can add its own facility names and identifier formats with no GPU work. Distributed execution. Both stages run on Ray 43 as a two-stage GPU/CPU pipeline. We chose Ray over a general data-parallel engine because the job holds long-lived GPU model actors and short CPU tasks in one topology, which the stage-and-executor model of a system such as Spark 44 does not express directly. GPU actors run model inference while concurrent CPU actors handle document windowing, reassembly, regular-expression matching and anonymization. The GPU actor performs token-accurate windowing internally, using a 512-token budget with 40-token overlap, so span offsets realign after reassembly. Batching is adaptive: a batch that raises an out-of-memory error is split and retried rather than aborting the job. Tooling. The library ships two command-line entry points: tide2-runner, which executes a stage or a chained pipeline against an input corpus, and tide2-visualizer, a Streamlit application that shows original and de-identified text side by side for human verification. A warehouse ETL path writes the de-identified notes and their span metadata back into the source schema. We describe this path but do not evaluate a warehouse deployment in this paper. Anonymizer and cryptographic construction The anonymizer replaces each detected span with a type-matched surrogate rather than a redaction mark. Surrogates come from a keyed, table-free construction, so the same input value maps to the same surrogate under a fixed key and to a different surrogate under a rotated key, with no linkage database to store or protect. All primitives are standard. Keys and salts. A salt is a 256-bit value from a cryptographically secure random source. A working key is 32 bytes; where it derives from a study or tenant label it is SHA-256(label)SHA -256( label). Salt and key are combined as salt|key salt\,\|\, key before any derivation, so both are required to reproduce a surrogate. Keys are isolated per study or tenant. A new key deterministically re-maps every surrogate, so releases produced under different keys cannot be linked to each other. Rotation does not alter releases already issued under the old key. Per-patient date shift. The offset for a patient is HMAC-SHA256(salt∥key,‘date_jitter_v1:’∥patient_id).HMAC -SHA256 ( salt\,\|\, key,\; ``date\_jitter\_v1:′\,\|\, patient\_id ). HMAC is used rather than a bare hash of the concatenation because its security does not depend on the key and the message being separable in the input, which a plain SHA-256(key∥message)SHA -256( key\,\|\, message) construction does depend on 45. The first four digest bytes select the magnitude and a further byte the sign, giving an offset in [−180,−3]∪[3,180][-180,-3]∪[3,180] days; a minimum magnitude of three days is enforced, and the domain-separation tag prevents cross-purpose reuse of the key. The same offset applies to every date in that patient’s record, which is what makes the shift interval-preserving. Numeric and alphanumeric identifiers. Identifiers are encrypted with F3 format-preserving encryption over the digit (radix 10) or alphanumeric (radix 62) alphabet. Format-preserving encryption is the primitive that lets a medical record number be replaced by something a downstream system will still accept as a medical record number 46. F3 was one of the two modes NIST standardised for it in 2016 47. The implementation uses F3 with a 64-bit tweak. The 128-bit cipher key is SHA-256(salt∥key)SHA -256( salt\,\|\, key) truncated to 16 bytes, and the tweak derives per (format, content-length) as a keyed digest, so the same content encrypts identically regardless of surrounding punctuation, which is reinserted afterwards. Non-alphanumeric characters are preserved positionally, so length and character class survive. F3 has documented attacks on small domains. A distinguishing and message-recovery attack was published against the standardised mode 48 and then improved to full message recovery at practical cost 49. NIST responded with a revised mode, F3-1, with a 56-bit tweak. A later analysis found a weakness in the tweak schedule of both modes 50, and the current draft revision of the NIST standard no longer specifies F3 or F3-1 51. Both early attacks scale with the size of the domain, so a short identifier is the dangerous case. The implementation therefore enforces a domain of at least 10610^6: numeric content is padded to six digits and alphanumeric content to four characters (624≈1.5×10662^4≈ 1.5× 10^6) before encryption, then truncated back. Truncation makes the map on short identifiers many-to-one, so distinct short identifiers can share a surrogate (Results). Above F3’s maximum supported length (56 numeric, 32 alphanumeric characters) the construction falls back to a keyed SHA-256SHA -256. Names, locations and opaque identifiers. Name and location surrogates use deterministic keyed selection: the index is SHA-256(salt‖key‖value)mod|L|SHA -256( salt\,\|\, key\,\|\, value) |L| into a fixed surrogate list L, applied per token for multi-token names. Selection is deterministic and one-way. State and country are retained for locations so region-level covariates stay usable. Ages above 89 are set to 89, and ages at or below 89 are left as written. Accession and other opaque identifiers are replaced by SHA-256(salt∥study_id∥entity∥id)SHA -256( salt\,\|\, study\_id\,\|\, entity\,\|\, id) truncated to 16 hex characters. Threat model TIDE 2.0 produces real clinical text with synthetic PHI: the narrative is the original note and only identifier spans are replaced, so the output is not a synthetic note in the generative sense. It is also not a placeholder-substituted release of the kind MIMIC-IV distributes, where the reader can see where each identifier used to be 52. The design defends against a reader of a single release, in that name and opaque identifier surrogates are one-way and the per-patient shift makes calendar re-identification of a real date harder absent an external anchor event. It limits linkage across releases, in that releases produced under different keys cannot be linked. It does not protect releases already issued if their key is disclosed. It does not by itself defeat membership inference or re-identification from residual quasi-identifiers 37. Removing the named identifiers leaves combinations of age, date and location that can still be distinguishing, which is the observation k-anonymity was introduced to formalise 53. We make no k-anonymity claim about the released text, and no claim that it meets the HIPAA Safe Harbor standard. Distillation procedure The distilled recognizer, TIDE2-Sentry, is a DeBERTa-v3-large token classifier distilled from Gemini 2.5 Flash 54. The transfer is hard-label distillation rather than the soft-target form 55, because the teacher is reached through an API that returns extracted spans and no logits. That is the usual constraint when a language model is used to generate the training set for a much smaller task model 56. The teacher was applied to ∼ 13,000 unannotated clinical notes to produce silver-standard span annotations. These identified notes were sent to the teacher through a cloud API under an executed business associate agreement; no other step in this study sent identified text outside Stanford Medicine infrastructure. The student was trained on those labels with token-level cross-entropy over BIO tags across 512-token windows. The student covers 10 label types: the 9 scored categories plus an OTHER catch-all for genetic sequences, encoded image blobs and other miscellaneous identifiers, which the evaluation does not score. The base encoder is DeBERTa-v3 57; long-context clinical encoders are alternatives for the same slot 58, 59. The teacher prompt is reproduced verbatim in Supplementary Note 1. It was developed on a few dozen notes outside SHIELD and i2b2, and the teacher was then scored on all 1,381 SHIELD notes to measure distillation fidelity. Comparator recognizers Three fine-tuned clinical transformers were evaluated as drop-in recognizers: the two AIMI radiology de-identification models 13 and TIDE2-Sentry. The AIMI label set is DATE, HCW, HOSPITAL, ID, PATIENT, PHONE and VENDOR; HCW maps to DOCTOR and VENDOR to HOSPITAL, and there is no AGE, LOCATION or WEB label. TIDE 1.0 was run on SHIELD only. A regular expression and Aho–Corasick layer was evaluated alone and as a +regex configuration on each transformer; TIDE2-Sentry+regex is the default configuration. A further 6 external open-source PII and clinical-NER taggers were evaluated on both corpora as an out-of-distribution probe. They are trained on non-clinical or non-US identifier distributions and are not tuned baselines. Three of the external taggers were taken from the top five of a public PII-masking leaderboard; two are smaller models from the same families, and one targets Indian documents. A comparator had to load through the standard token-classification pipeline without a separate integration path or a caller-supplied label prompt. Supplementary Note 2 lists the models and the exclusions. No large language model other than the teacher is evaluated. Gemini 2.5 Flash was scored on SHIELD only to measure distillation fidelity. The extraction prompt was developed for this model alone, so a comparison across models would measure prompt fit rather than model capability. Throughput measurement Throughput was measured on 1 NVIDIA L4 GPU in a GCP VM with 16 vCPUs and 64 GB of RAM, using TIDE2-Sentry with a 512-token window budget and 40-token overlap. We report content-tokens per second, per stage and end-to-end, on two corpora: the full SHIELD corpus (359,779 content-tokens) and a bounded subset of the longest notes (2,096,828 content-tokens) that exercises the long-note path. Content-tokens are the recognizer tokenizer’s tokens for the note text, excluding the model’s special tokens and counted once per note. The stages ran as one automatically chained job, and each configuration was run once and timed end to end. This is a benchmark on one machine rather than a measurement of a production deployment. The CPU-only comparison path uses a single untuned actor, and GPU batch size was set separately for short and long notes. Supplementary Note 3 gives the CPU actor sizing. Outcomes and statistical analysis Declared outcomes. The primary outcome is span-level recall, per category and per corpus. Recall is primary on an ethical rather than a statistical rationale: a missed identifier is a disclosure with legal consequence for a patient, whereas a false positive costs a clinical word. The two errors are not interchangeable, so a single figure of merit that averages them, F1 included, cannot express the trade-off a site actually faces. Secondary outcomes are span-level precision, which bounds how much clinical content survives replacement; sustained throughput; and the anonymizer’s structural guarantees. Span matching. A predicted span s s matches a gold span s when they carry the same category and their character offsets overlap by at least τ=0.8τ=0.8 of the union. We use a graded overlap criterion rather than the exact-match and partial-match pair reported by the 2014 shared task 34, because the two corpora disagree on span extent often enough that exact match would score boundary conventions instead of detection: IoU(s,s^)=|s∩s^||s∪s^|≥τ.IoU(s, s)\;=\; |s∩ s||s∪ s|\;≥\;τ. (1) Matching runs per document, and each gold span matches at most one predicted span. Writing TPTP, FPFP and FNFN for the resulting counts, Recall=TPTP+FN,Precision=TPTP+FP.Recall\;=\; TPTP+FN, \;=\; TPTP+FP. (2) Micro-averages pool TPTP, FPFP and FNFN across categories; macro-averages are the unweighted mean over the 9 categories. As sensitivity analyses we also report micro-averaged recall at τ=0.5τ=0.5, and character-level recall: the share of gold PHI characters covered by any predicted span, regardless of category. Recall-drop decomposition. Micro-averaged recall is R=∑cwcrcR= _cw_cr_c, where wcw_c is category c’s share of gold spans and rcr_c its recall. The drop from SHIELD (s) to i2b2 (i) splits exactly into Rs−Ri=∑cw¯c(rs,c−ri,c)+∑cr¯c(ws,c−wi,c),R_s-R_i\;=\; _c w_c\,(r_s,c-r_i,c)\;+\; _c r_c\,(w_s,c-w_i,c), (3) with w¯c w_c and r¯c r_c the means over the two corpora. The first sum is the recall change per category, weighted by its share of gold spans; the second is the effect of the different category mix. Uncertainty and comparisons. Confidence intervals are 95% bootstrap intervals over 2,000 document-level resamples, resampling documents with replacement and recomputing the metric on each resample 60. The document rather than the span is the resampling unit because spans within one note are not independent. A facility acronym a model cannot read tends to appear several times in the same note, and resampling spans would count those as separate pieces of evidence. Teacher-student recall differences are tested with a paired document-level bootstrap on the same resamples, and p-values are compared against a Bonferroni threshold for a family of 9 categories (0.05/9≈0.0060.05/9≈ 0.006), which is conservative here because the per-category tests are positively correlated 61. We report Bonferroni-adjusted p-values, min(1,9p) (1,9p). The effect of the regex layer (TIDE2-Sentry+regex minus TIDE2-Sentry) on recall and precision is estimated with the same paired document bootstrap, with 95% percentile intervals. The random seed is fixed at 42. Data availability The SHIELD corpus is governed by its own release and is available under the terms stated in the corpus paper 15. The i2b2 2014 de-identification corpus is available from the n2c2/DBMI data portal under the data use agreement described there 20. The clinical notes used for distillation contain protected health information and cannot be shared. Per-span predictions on both corpora are available from the corresponding author, subject to the terms of each corpus. Code availability tide2-core22 2 https://github.com/susom/tide2-core is released under the MIT license. The TIDE2-Sentry recognizer is released on Hugging Face33 3 https://huggingface.co/stanford-med-hdr/tide2-sentry-clinical-ner, gated under Stanford Medicine’s Data Research Use Agreement (non-commercial research; no redistribution). This is a separate approval from the SHIELD dataset. Acknowledgements This research was funded, in part, by the Advanced Research Projects Agency for Health (ARPA-H) under award number AY2AX000024. The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of the U.S. Government. The funders had no role in study design, data collection and analysis, the decision to publish, or preparation of the manuscript. We gratefully acknowledge Professor Sylvia Plevritis, Ph.D. (Stanford University), Principal Investigator of this project, for her support of this work. We also thank Todd Ferris (Deputy Chief Information Officer, Stanford University School of Medicine) and Anthea Buchin (Director of Research Technology Application Solutions, Stanford Healthcare) for their leadership and institutional support. We thank our colleagues David Love, Joe Pallas, Hannah Morgan-Cooper, Farnoosh Sheikhi, Shikha Kothari and Alvaro Alvarez, all of Stanford Healthcare, for their contributions to the research data infrastructure and engineering work that enabled this project. Author contributions J.D.P.: Conceptualization, Methodology, Software, Investigation, Formal analysis, Writing. S.D.: Conceptualization, Methodology, Writing – review & editing. P.D.: Conceptualization, Methodology, Writing – review & editing. All authors read and approved the final manuscript. Competing interests The authors declare no competing interests. Additional information Supplementary Information, with Supplementary Notes 1–3, Fig. S1 and Tables S1–S14, follows the references. Correspondence and requests for materials should be addressed to J.D.P. References 1 Somalee Datta, Jose Posada, Garrick Olson, Wencheng Li, Ciaran O’Reilly, Deepa Balraj, Joseph Mesterhazy, Joseph Pallas, Priyamvada Desai, and Nigam Shah. A new paradigm for accelerating clinical data science at stanford medicine, 2020. URL https://arxiv.org/abs/2003.10534. 2 Alison Callahan, Euan Ashley, Somalee Datta, Priyamvada Desai, Todd A Ferris, Jason A Fries, Michael Halaas, Curtis P Langlotz, Sean Mackey, José D Posada, Michael A Pfeffer, and Nigam H Shah. The stanford medicine data science ecosystem for clinical and translational research. JAMIA Open, 6(3):ooad054, 08 2023. ISSN 2574-2531. doi: 10.1093/jamiaopen/ooad054. URL https://doi.org/10.1093/jamiaopen/ooad054. 3 Elizabeth Ford, John A Carroll, Helen E Smith, Donia Scott, and Jackie A Cassell. Extracting information from the text of electronic medical records to improve case detection: a systematic review. Journal of the American Medical Informatics Association, 23(5):1007–1015, 2016. doi: 10.1093/jamia/ocv180. 4 Harvey J Murff, Fern FitzHenry, Michael E Matheny, Nancy Gentry, Kristen L Kotter, Kimberly Crimin, Robert S Dittus, Amy K Rosen, Peter L Elkin, Steven H Brown, and Theodore Speroff. Automated identification of postoperative complications within an electronic medical record using natural language processing. JAMA, 306(8):848–855, 2011. doi: 10.1001/jama.2011.1204. 5 Kenneth Jung, Paea LePendu, William S Chen, Srinivasan V Iyer, Ben Readhead, Joel T Dudley, and Nigam H Shah. Automated detection of off-label drug use. PLoS ONE, 9(2):e89324, 2014. doi: 10.1371/journal.pone.0089324. 6 Dave Van Veen, Cara Van Uden, Louis Blankemeier, Jean-Benoit Delbrouck, Asad Aali, Christian Bluethgen, Anuj Pareek, Malgorzata Polacin, Eduardo Pontes Reis, Anna Seehofnerová, et al. Adapted large language models can outperform medical experts in clinical text summarization. Nature Medicine, 30(4):1134–1142, 2024. doi: 10.1038/s41591-024-02855-5. 7 Li et al. Early prediction of alzheimer’s disease and related dementias from longitudinal electronic health record clinical notes. npj Digital Medicine, 2025. doi: 10.1038/s41746-025-01900-y. CARE-AD; PMC12375024. 8 Kruse et al. Temporal reasoning over long patient trajectories in clinical notes. In Findings of the Association for Computational Linguistics: EMNLP 2025, 2025. URL https://aclanthology.org/2025.findings-emnlp.1128/. ACL Anthology 2025.findings-emnlp.1128. 9 Office for Civil Rights, U.S. Department of Health and Human Services. Guidance regarding methods for de-identification of protected health information in accordance with the HIPAA privacy rule. https://w.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/, 2012. 10 Özlem Uzuner, Yuan Luo, and Peter Szolovits. Evaluating the state-of-the-art in automatic de-identification. Journal of the American Medical Informatics Association, 14(5):550–563, 2007. doi: 10.1197/jamia.M2444. 11 Stephane M Meystre, F Jeff Friedlin, Brett R South, Shuying Shen, and Matthew H Samore. Automatic de-identification of textual documents in the electronic health record: a review of recent research. BMC Medical Research Methodology, 10:70, 2010. doi: 10.1186/1471-2288-10-70. 12 Pierre J Chambon, Christopher Wu, Jackson M Steinkamp, Jason Adleberg, Tessa S Cook, and Curtis P Langlotz. Automated deidentification of radiology reports combining transformer and “hide in plain sight” rule-based methods. Journal of the American Medical Informatics Association, 30(2):318–328, January 2023. ISSN 1067-5027, 1527-974X. doi: 10.1093/jamia/ocac219. URL https://academic.oup.com/jamia/article/30/2/318/6843283. 13 Eva Prakash, Maayane Attias, Pierre Chambon, Justin Xu, Steven Truong, Jean-Benoit Delbrouck, Tessa Cook, and Curtis Langlotz. Improving the Performance of Radiology Report De-identification with Large-Scale Training and Benchmarking Against Cloud Vendor Methods, November 2025. URL http://arxiv.org/abs/2511.04079. arXiv:2511.04079 [cs]. 14 Zhengliang Liu, Yue Huang, Xiaowei Yu, Lu Zhang, Zihao Wu, Chao Cao, Haixing Dai, Lin Zhao, Yiwei Li, Peng Shu, Fang Zeng, Lichao Sun, Wei Liu, Dinggang Shen, Quanzheng Li, Tianming Liu, Dajiang Zhu, and Xiang Li. DeID-GPT: Zero-shot Medical Text De-Identification by GPT-4, December 2023. URL http://arxiv.org/abs/2303.11032. arXiv:2303.11032 [cs]. 15 Jose D. Posada, David Love, Somalee Datta, and Priya Desai. SHIELD: A diverse clinical note dataset and distilled small language models for enterprise-scale de-identification. https://github.com/susom/shield_dataset, 2025. Stanford Medicine. 16 Kimia Aghakasiri et al. Quantifying the clinical information loss of over-redaction in automated clinical text de-identification. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing (EMNLP), 2025. URL https://aclanthology.org/2025.emnlp-main.1637/. ACL Anthology 2025.emnlp-main.1637. 17 Latanya Sweeney. Replacing personally-identifying information in medical records, the Scrub system. In Proceedings of the AMIA Annual Fall Symposium, pages 333–337, 1996. 18 Reyyan Yeniterzi, John Aberdeen, Samuel Bayer, Ben Wellner, Lynette Hirschman, and Bradley Malin. Effects of personal identifier resynthesis on clinical text de-identification. Journal of the American Medical Informatics Association, 17(2):159–168, 2010. doi: 10.1136/jamia.2009.002212. 19 David Carrell, Bradley Malin, John Aberdeen, Samuel Bayer, Cheryl Clark, Ben Wellner, and Lynette Hirschman. Hiding in plain sight: use of realistic surrogates to reduce exposure of protected health information in clinical text. Journal of the American Medical Informatics Association, 20(2):342–348, 2013. doi: 10.1136/amiajnl-2012-001034. 20 Amber Stubbs and "Ozlem Uzuner. Annotating longitudinal clinical narratives for de-identification: The 2014 i2b2/uthealth corpus. Journal of Biomedical Informatics, 58:S20–S29, 2015. doi: 10.1016/j.jbi.2015.07.020. PMID: 26319540. 21 Aman Kansal, Emma Chen, Boyang Tom Jin, Pranav Rajpurkar, and David A. Kim. MC-MED, multimodal clinical monitoring in the emergency department. Scientific Data, 12(1):1094, 2025. doi: 10.1038/s41597-025-05419-5. URL https://doi.org/10.1038/s41597-025-05419-5. 22 Alistair E W Johnson, Tom J Pollard, Lu Shen, Li-wei H Lehman, Mengling Feng, Mohammad Ghassemi, Benjamin Moody, Peter Szolovits, Leo Anthony Celi, and Roger G Mark. MIMIC-I, a freely accessible critical care database. Scientific Data, 3:160035, 2016. doi: 10.1038/sdata.2016.35. 23 Ishna Neamatullah, Margaret M Douglass, Li-wei H Lehman, Andrew Reisner, Mauricio Villarroel, William J Long, Peter Szolovits, George B Moody, Roger G Mark, and Gari D Clifford. Automated de-identification of free-text medical records. BMC Medical Informatics and Decision Making, 8:32, 2008. doi: 10.1186/1472-6947-8-32. 24 Oscar Ferrández, Brett R South, Shuying Shen, F Jeff Friedlin, Matthew H Samore, and Stephane M Meystre. BoB, a best-of-breed automated text de-identification system for VHA clinical documents. Journal of the American Medical Informatics Association, 20(1):77–83, 2013. doi: 10.1136/amiajnl-2012-001020. 25 Microsoft. Microsoft presidio: Context-aware, pluggable and customizable pii de-identification service for text and images. https://github.com/microsoft/presidio, 2024. MIT License. 26 Stanford Medicine, Technology and Digital Solutions. Tide: The starr clinical text de-identification tool. https://github.com/susom/tide, 2025. Stanford Health Care. 27 Khaled El Emam, Elizabeth Jonker, Luk Arbuckle, and Bradley Malin. A systematic review of re-identification attacks on health data. PLoS ONE, 6(12):e28071, 2011. doi: 10.1371/journal.pone.0028071. 28 Thomas Vakili, Anastasios Lamproudis, Aron Henriksson, and Hercules Dalianis. Downstream task performance of BERT models pre-trained using automatically de-identified clinical data. In Proceedings of the 13th Conference on Language Resources and Evaluation (LREC), pages 4245–4252, 2022. 29 Beau Norgeot, Kathleen Muenzen, Thomas A. Peterson, Xuancheng Fan, Benjamin S. Glicksberg, Gundolf Schenk, Eugenia Rutenberg, Boris Oskotsky, Marina Sirota, Jinoos Yazdany, Gabriela Schmajuk, Dana Ludwig, Theodore Goldstein, and Atul J. Butte. Protected Health Information filter (Philter): accurately and securely de-identifying free-text clinical notes. npj Digital Medicine, 3(1):57, 2020. doi: 10.1038/s41746-020-0258-y. 30 John Aberdeen, Samuel Bayer, Reyyan Yeniterzi, Ben Wellner, Cheryl Clark, David Hanauer, Bradley Malin, and Lynette Hirschman. The MITRE Identification Scrubber Toolkit: design, training, and assessment. International Journal of Medical Informatics, 79(12):849–859, 2010. doi: 10.1016/j.ijmedinf.2010.09.007. 31 Zengjian Liu, Buzhou Tang, Xiaolong Wang, and Qingcai Chen. De-identification of clinical notes via recurrent neural network and conditional random field. Journal of Biomedical Informatics, 75:S34–S42, 2017. doi: 10.1016/j.jbi.2017.05.023. 32 Franck Dernoncourt, Ji Young Lee, and Peter Szolovits. NeuroNER: an easy-to-use program for named-entity recognition based on neural networks. In Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pages 97–102, 2017. doi: 10.18653/v1/D17-2017. 33 Alistair E W Johnson, Lucas Bulgarelli, and Tom J Pollard. Deidentification of free-text medical records using pre-trained bidirectional transformers. In Proceedings of the ACM Conference on Health, Inference, and Learning (CHIL), pages 214–221, 2020. doi: 10.1145/3368555.3384455. 34 Amber Stubbs, Christopher Kotfila, and Özlem Uzuner. Automated systems for the de-identification of longitudinal clinical narratives: Overview of 2014 i2b2/UTHealth shared task track 1. Journal of Biomedical Informatics, 58:S11–S19, 2015. doi: 10.1016/j.jbi.2015.06.007. 35 Amber Stubbs, Michele Filannino, and Özlem Uzuner. De-identification of psychiatric intake records: Overview of 2016 CEGS N-GRID shared tasks track 1. Journal of Biomedical Informatics, 75:S4–S18, 2017. doi: 10.1016/j.jbi.2017.06.011. 36 Louise Deleger, Todd Lingren, Yizhao Ni, Megan Kaiser, Laura Stoutenborough, Keith Marsolo, Michal Kouril, Katalin Molnar, and Imre Solti. Preparing an annotated gold standard corpus to share with extramural investigators for de-identification research. Journal of Biomedical Informatics, 46(6):1137–1143, 2013. doi: 10.1016/j.jbi.2013.08.002. 37 Atiquer Rahman Sarkar, Yao-Shun Chuang, Noman Mohammed, and Xiaoqian Jiang. De-identification is not enough: a comparison between de-identified and synthetic clinical notes. Scientific Reports, 14:28848, 2024. doi: 10.1038/s41598-024-81170-y. PMC11607336. 38 Cynthia Dwork. Differential privacy. In Automata, Languages and Programming (ICALP), pages 1–12, 2006. doi: 10.1007/11787006_1. 39 Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In IEEE Symposium on Security and Privacy (S&P), pages 3–18, 2017. doi: 10.1109/SP.2017.41. 40 Eric Lehman, Sarthak Jain, Karl Pichotta, Yoav Goldberg, and Byron C Wallace. Does BERT pretrained on clinical notes reveal sensitive data? In Proceedings of NAACL-HLT, pages 946–959, 2021. doi: 10.18653/v1/2021.naacl-main.73. 41 Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, et al. Transformers: State-of-the-art natural language processing. In Proceedings of EMNLP: System Demonstrations, pages 38–45, 2020. doi: 10.18653/v1/2020.emnlp-demos.6. 42 Alfred V Aho and Margaret J Corasick. Efficient string matching: an aid to bibliographic search. Communications of the ACM, 18(6):333–340, 1975. doi: 10.1145/360825.360855. 43 Philipp Moritz, Robert Nishihara, Stephanie Wang, Alexey Tumanov, Richard Liaw, Eric Liang, Melih Elibol, Zongheng Yang, William Paul, Michael I. Jordan, and Ion Stoica. Ray: A distributed framework for emerging AI applications. In 13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18), pages 561–577, 2018. URL https://w.usenix.org/conference/osdi18/presentation/moritz. 44 Matei Zaharia, Reynold S Xin, Patrick Wendell, Tathagata Das, Michael Armbrust, Ankur Dave, Xiangrui Meng, Josh Rosen, Shivaram Venkataraman, Michael J Franklin, et al. Apache Spark: a unified engine for big data processing. Communications of the ACM, 59(11):56–65, 2016. doi: 10.1145/2934664. 45 Mihir Bellare, Ran Canetti, and Hugo Krawczyk. Keying hash functions for message authentication. In Advances in Cryptology (CRYPTO), pages 1–15, 1996. doi: 10.1007/3-540-68697-5_1. 46 Mihir Bellare, Thomas Ristenpart, Phillip Rogaway, and Till Stegers. Format-preserving encryption. In Selected Areas in Cryptography (SAC), pages 295–312, 2009. doi: 10.1007/978-3-642-05445-7_19. 47 Morris Dworkin. Recommendation for block cipher modes of operation: Methods for format-preserving encryption. Technical Report NIST Special Publication 800-38G, National Institute of Standards and Technology, 2016. 48 F Betül Durak and Serge Vaudenay. Breaking the F3 format-preserving encryption standard over small domains. In Advances in Cryptology (CRYPTO), pages 679–707, 2017. doi: 10.1007/978-3-319-63715-0_23. 49 Viet Tung Hoang, David Miller, and Ni Trieu. Attacks only get better: attacking F3 with a message recovery attack. In Advances in Cryptology (EUROCRYPT), pages 512–534, 2019. doi: 10.1007/978-3-030-17653-2_17. 50 Tim Beyne. Linear cryptanalysis of F3-1 and FEA. In Advances in Cryptology (CRYPTO), pages 41–69, 2021. doi: 10.1007/978-3-030-84242-0_3. 51 Morris Dworkin and Nicky Mouha. Recommendation for block cipher modes of operation: Methods for format-preserving encryption (second public draft). Technical Report NIST Special Publication 800-38G Rev. 1 (2PD), National Institute of Standards and Technology, 2025. 52 Alistair E W Johnson, Lucas Bulgarelli, Lu Shen, Alvin Gayles, Ayad Shammout, Steven Horng, Tom J Pollard, Sicheng Hao, Benjamin Moody, Brian Gow, et al. MIMIC-IV, a freely accessible electronic health record dataset. Scientific Data, 10:1, 2023. doi: 10.1038/s41597-022-01899-x. 53 Latanya Sweeney. k-anonymity: a model for protecting privacy. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 10(5):557–570, 2002. doi: 10.1142/S0218488502001648. 54 Gemini Team, Google. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities. arXiv preprint arXiv:2507.06261, 2025. 55 Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531, 2015. 56 Cheng-Yu Hsieh, Chun-Liang Li, Chih-Kuan Yeh, Hootan Nakhost, Yasuhisa Fujii, Alexander Ratner, Ranjay Krishna, Chen-Yu Lee, and Tomas Pfister. Distilling step-by-step! outperforming larger language models with less training data and smaller model sizes. In Findings of the Association for Computational Linguistics: ACL, pages 8003–8017, 2023. doi: 10.18653/v1/2023.findings-acl.507. 57 Pengcheng He, Jianfeng Gao, and Weizhu Chen. Debertav3: Improving deberta using electra-style pre-training with gradient-disentangled embedding sharing. arXiv preprint arXiv:2111.09543, 2021. 58 Thomas Sounack, Joshua Davis, Brigitte Durieux, Antoine Chaffin, Tom J. Pollard, Eric Lehman, Alistair E. W. Johnson, Matthew McDermott, Tristan Naumann, and Charlotta Lindvall. BioClinical ModernBERT: A State-of-the-Art Long-Context Encoder for Biomedical and Clinical NLP, June 2025. URL http://arxiv.org/abs/2506.10896. arXiv:2506.10896 [cs]. 59 Wissam Antoun, Benoît Sagot, and Djamé Seddah. ModernBERT or DeBERTaV3? Examining architecture and data influence on transformer encoder models performance. In Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics (IJCNLP-AACL 2025), 2025. URL https://aclanthology.org/2025.ijcnlp-long.164/. 60 Bradley Efron and Robert J Tibshirani. An Introduction to the Bootstrap. Chapman and Hall/CRC, 1993. 61 Olive Jean Dunn. Multiple comparisons among means. Journal of the American Statistical Association, 56(293):52–64, 1961. doi: 10.1080/01621459.1961.10482090. Supplementary Information Supplementary Note 1: teacher extraction prompt The teacher, Gemini 2.5 Flash, was prompted to return PHI spans as JSON grouped by category, giving for each span the exact surface text and a confidence score. Character offsets are recovered by searching the note for each returned string, so a span that differs from the note by one character is lost. This is why the prompt insists on copying text exactly. The prompt was developed on a few dozen notes from the same source as the distillation set and disjoint from both evaluation corpora. The teacher was then scored once on all 1,381 SHIELD notes to measure distillation fidelity. The prompt is reproduced verbatim below. It is a Python format template: literal JSON braces appear doubled, and clinical_text is replaced by the note at call time. Identify and tag ALL patient-identifiable information and organizational information from clinical notes. Return results as JSON. ## TOP PRIORITIES (NEVER MISS THESE) 1. **DATES**: Scan exhaustively for ALL date formats (M/D/Y, M/D/Y, M/D, Month D Y, etc.). Include short dates like "4/12" without years. Tag every occurrence separately. - EXCLUDE times (10:00AM), temporal words (yesterday), day names (Monday). Example: "2023-03-05T03:43:00-08:00" -> "2023-03-05" (exclude T03:43:00-08:00). 2. **COMPLETE ADDRESSES WITH ZIP (CRITICAL PATTERN)**: ALWAYS tag addresses in format "Street Address City State ZIP" (note: 2+ spaces between street and city). Example: "1234 MAIN STREET BOSTON MA 02101" is ONE complete entity. This pattern appears frequently and MUST be captured. 3. **ALL DISTINCT MENTIONS**: Tag each occurrence separately: - Complete address: "5678 MAPLE STREET BOSTON MA 02134" → tag it - Same street appearing alone: "5678 MAPLE STREET" → ALSO tag it separately when occurring in a different part of the text - Do NOT skip any mention just because another version exists elsewhere 4. **EXACT TEXT MATCHING**: Copy text exactly - preserve all case, whitespace, punctuation. Different whitespace = different entity ("Smith, John" vs "Smith, John" are separate entities). 5. Check carefully for the entities separated by line breaks or several white spaces. Example: "Smith, John Albert" ## ENTITY DEFINITIONS **PATIENT**: Patient names, relatives, friends, guardians, and any person name mentioned that is NOT a healthcare provider. - EXCLUDE generic terms: "sister", "mother". EXCLUDE common professional titles that appear alongside the name. Example: John Smith PhD -> "John Smith" (exclude "PhD"). - EXCLUDE Ms./Mr./Mrs. Example: "Ms. Johnson" -> "Johnson" (exclude "Ms."). **LOCATION**: ALL address mentions (complete or incomplete). Preserve internal whitespace exactly. - Complete with ZIP: "456 OAK DR Austin TX 78745" (one entity despite multiple spaces) - Verbose format: "HealthMart #123 - Chicago, IL - 456 OAK DRIVE at Main St" - Standalone street: "456 OAK DRIVE" (even if complete version exists elsewhere) - Partial: "Chicago, IL - 456 OAK DRIVE" - City/state: "Chicago, IL" - Do NOT fragment single mentions. DO tag separate incomplete mentions. Do NOT double tag mentions that are already part of another mention. - EXCLUDE generic facility names (PACU, ICU) without room numbers. **DATE**: Any date format. Past, present, future. **ID**: MRNs (include hyphens: "1234567-8"), SSNs, account numbers. EXCLUDE generic codes (R07.89), labels without values ("MRN"). **AGE**: Complete expressions with units ("72 Y old", "14 year old"). When units in separate fields ("Age: 14 Units: Years"), tag only number "14". - EXCLUDE common female or male terms that accompany the age. Example 72 Y old female -> 72 Y old (exclude "female"). **PHONE**: All formats including pagers. For pagers, tag ONLY number ("12019"), NOT label ("Pgr"). **WEB**: Emails, URLs, social media handles, IPs. **DOCTOR**: ALL healthcare worker names (providers, nurses, staff, interpreters, coordinators, financial staff, etc..): - Formal: Examples: "Dr. Smith", "Wilson, Anne Marie, MD" -> "Smith", "Wilson, Anne Marie," (exclude "Dr.", "MD"), "Rn Johnson" -> "Johnson" (exclude "Rn") - Informal: "spoke with Jennifer", "called Michael", "coordinator Tom" - First names only when referring to healthcare workers - If the title appears at the end, EXCLUDE it. Example: Smith, John Michael, MD -> "Smith, John Michael" - If the title appears in the middle INCLUDE it. Example: Smith MD, John Michael Trey -> "Smith MD, John Michael Trey" **HOSPITAL**: Organizations, pharmacies, clinics. Room numbers as number only ("3142", NOT "room 3142"). EXCLUDE generic teams (T MICU GREEN), generic services (language line). **OTHER**: Unique identifying characteristics. ## KEY RULES **Organization + Location Combinations:** - Full address: "HealthMart #7842 - Dallas, TX - 4825 Maple Dr" → "HealthMart #7842" (HOSPITAL) + ALL location variants (verbose full, ZIP format if present, standalone street, partial combinations) - Shorthand (org + city/state only): "CVS Pharmacy Seattle, WA" → "CVS Pharmacy" (HOSPITAL) + "Seattle, WA" (LOCATION) as separate entities - Multiple repetitions like this should be split into their components and tagged separately: - RITE AID-1991 MOUNTAIN BLVD. - OAKLAND, CA - 1991 MOUNTAIN BOULEVARD - > 1991 MOUNTAIN BLVD. - OAKLAND, CA (LOCATION) + 1991 MOUNTAIN BOULEVARD (LOCATION) - RITE AID-1991 MOUNTAIN BLVD. - OAKLAND, CA - 1991 MOUNTAIN BOULEVARD 1991 MOUNTAIN BOULEVARD OAKLAND CA 94611-2812 -> 1991 MOUNTAIN BLVD. - OAKLAND, CA (LOCATION) + 1991 MOUNTAIN BOULEVARD (LOCATION) + 1991 MOUNTAIN BOULEVARD OAKLAND CA 94611-2812 (LOCATION) **Multiple Address Formats:** When same physical location appears in different formats, tag EACH format separately. Don’t skip standard ZIP format just because verbose format appeared first. **Exclusions:** Generic facilities (PACU), generic family terms (sister), generic teams (T CARDIAC ICU), generic services (language line), medical codes (P245). ## OUTPUT FORMAT Return valid JSON only. No markdown, explanations, or extra text. ```json "ENTITY_TYPE": [ "text": "exact text from input", "confidence": 0.95, "text": "another entity", "confidence": 0.87 ] ``` Entity types: `PATIENT`, `LOCATION`, `PHONE`, `WEB`, `DATE`, `ID`, `HOSPITAL`, `DOCTOR`, `AGE`, `OTHER` Confidence: 0.00-1.00 (use 0.90-0.99 for clear PHI) No PHI found: return `` Better to over-tag with lower confidence than miss entities. ## EXAMPLES **Example 1 - Comprehensive Detection:** Input: "Patient: Rodriguez, Maria Elena MRN: 7834521-3 Age: 14 Age Units: Years DOB: 03/22/2009 Pharmacy: MedPlus #5847 - Houston, TX - 2340 RIVERSIDE AVENUE at Memorial Drive 2340 RIVERSIDE AVENUE Houston TX 77004 2340 RIVERSIDE AVENUE (standalone) Phone: 713-555-8821 Fax: 713-555-8822 Pager Pgr 19304 Thomas K Williams is a 68 Y old male. Provider: Chen, Lisa Marie, MD Later, Dr. Chen, Lisa Marie (1 space) reviewed. Also consulted Smith, John Michael, MD. Referred to Smith MD, John Michael Trey for cardiology. Ms. Johnson visited with family. Room 4217 at PACU. Called Dr. Smith about results. Rn Johnson assisted with discharge. Labs: HbA1c 07/15/2023, LIPID PANEL 01/08/2024, GLUCOSE 05/12/2024 Patient’s brother visited. Team: T NEURO ICU RED. Used language line. Code M79.3. Spoke with Sandra in radiology. Interpreter Paulo #8472. Coordinator Michelle x6193. Additional pharmacy: QuickCare Rx #2109 - Phoenix, AZ - 8765 DESERT BOULEVARD 8765 DESERT BOULEVARD Phoenix AZ 85001 Verify: 8765 DESERT BOULEVARD Prior address: 1542 OCEAN DRIVE MIAMI FL 33139" Output: ```json "PATIENT": [ "text": "Rodriguez, Maria Elena", "confidence": 0.95, "text": "Thomas K Williams", "confidence": 0.95, "text": "Johnson", "confidence": 0.93 ], "ID": [ "text": "7834521-3", "confidence": 0.99, "text": "8472", "confidence": 0.94 ], "AGE": [ "text": "14", "confidence": 0.94, "text": "68 Y old", "confidence": 0.94 ], "DATE": [ "text": "03/22/2009", "confidence": 0.98, "text": "07/15/2023", "confidence": 0.98, "text": "01/08/2024", "confidence": 0.98, "text": "05/12/2024", "confidence": 0.98 ], "HOSPITAL": [ "text": "MedPlus #5847", "confidence": 0.95, "text": "QuickCare Rx #2109", "confidence": 0.95, "text": "4217", "confidence": 0.95 ], "LOCATION": [ "text": "Houston, TX - 2340 RIVERSIDE AVENUE at Memorial Drive", "confidence": 0.95, "text": "2340 RIVERSIDE AVENUE Houston TX 77004", "confidence": 0.97, "text": "2340 RIVERSIDE AVENUE", "confidence": 0.94, "text": "Phoenix, AZ - 8765 DESERT BOULEVARD", "confidence": 0.95, "text": "8765 DESERT BOULEVARD Phoenix AZ 85001", "confidence": 0.97, "text": "8765 DESERT BOULEVARD", "confidence": 0.94, "text": "1542 OCEAN DRIVE MIAMI FL 33139", "confidence": 0.97 ], "PHONE": [ "text": "713-555-8821", "confidence": 0.98, "text": "713-555-8822", "confidence": 0.98, "text": "19304", "confidence": 0.94, "text": "6193", "confidence": 0.94 ], "DOCTOR": [ "text": "Chen, Lisa Marie,", "confidence": 0.93, "text": "Chen, Lisa Marie", "confidence": 0.93, "text": "Smith, John Michael,", "confidence": 0.93, "text": "Smith MD, John Michael Trey", "confidence": 0.93, "text": "Smith", "confidence": 0.93, "text": "Johnson", "confidence": 0.92, "text": "Sandra", "confidence": 0.91, "text": "Paulo", "confidence": 0.91, "text": "Michelle", "confidence": 0.91 ] ``` **Example 2 - Additional Patterns:** Input: "At 0915 contacted Amy in billing x3482. Confirmed coverage. Coordinator Jason arranged transport. Connected with interpreter Diana #7621. Nurse Marcus reviewed discharge plan. Primary pharmacy: CareMed #4783 - Boston, MA - 5123 HARBOR STREET 5123 HARBOR STREET Boston MA 02108 5123 HARBOR STREET (confirm) Alternate: WellRx Pharmacy Denver, CO (shorthand - no street) Historical address: SupplyPlus - Atlanta, GA - 9876 PEACHTREE ROAD 9876 PEACHTREE ROAD Atlanta GA 30303 Financial advisor Teresa x5247. Follow-up 11/5/2024. Email: patient@health.org" Output: ```json "DOCTOR": [ "text": "Amy", "confidence": 0.91, "text": "Jason", "confidence": 0.91, "text": "Diana", "confidence": 0.91, "text": "Marcus", "confidence": 0.91, "text": "Teresa", "confidence": 0.91 ], "PHONE": [ "text": "3482", "confidence": 0.94, "text": "7621", "confidence": 0.94, "text": "5247", "confidence": 0.94 ], "ID": [ "text": "7621", "confidence": 0.94 ], "HOSPITAL": [ "text": "CareMed #4783", "confidence": 0.95, ], "LOCATION": [ "text": "Boston, MA - 5123 HARBOR STREET", "confidence": 0.96, "text": "5123 HARBOR STREET Boston MA 02108", "confidence": 0.97, "text": "5123 HARBOR STREET", "confidence": 0.94, "text": "Denver, CO", "confidence": 0.92, "text": "Atlanta, GA - 9876 PEACHTREE ROAD", "confidence": 0.96, "text": "9876 PEACHTREE ROAD Atlanta GA 30303", "confidence": 0.97 ], "DATE": [ "text": "11/5/2024", "confidence": 0.97 ], "WEB": [ "text": "patient@health.org", "confidence": 0.98 ] ``` **Key Patterns Demonstrated:** - MRNs with hyphens tagged - Age with units vs separate field units handled correctly - ALL dates captured (multiple years, different formats) - **CRITICAL: Standard ZIP format "Street City State ZIP" (2 spaces) ALWAYS captured** - appears 8 times across examples (including extended ZIP codes like 94301-2302 and concatenated ZIPs like 921284108) - **Addresses with suite numbers, floor numbers, mail codes (MC), room/building codes (H310), and directional indicators (South) preserved exactly** - Examples: "4523 Maple Grove Suite 900", "850 Pine Avenue, 2nd Floor", "1250 Oak Boulevard MC 5807", "425 Forest Dr Mc 5208 H310", "9847 Sunset Creek Dr South Ste300" - **State names can appear as abbreviations (CA) or full names (California)** - both formats captured - Standalone street addresses tagged even when complete versions exist - Verbose address formats captured - Partial address combinations captured - Doctor names with different whitespace variants captured separately - **Doctor title handling: "Dr. Smith" → "Smith" (exclude "Dr."), "Wilson, Anne Marie, MD" → "Wilson, Anne Marie," (exclude "MD"), "Rn Johnson" → "Johnson" (exclude "Rn")** - Informal healthcare worker first names tagged (billing, coordinators, interpreters, nurses, financial) - Pager numbers without "Pgr" label - Room numbers without "room" label - Extension numbers as phone - Shorthand pharmacy format split: "WellRx Pharmacy Denver, CO" → "Denver, CO" separately - EXCLUDED: Generic facilities (PACU), generic terms (brother), generic teams (T NEURO ICU RED), services (language line), medical codes (M79.3) Clinical Text: clinical_text Supplementary Note 2: recognizer selection and exclusion The 6 external PII taggers are: • from the top five of a public PII-masking leaderboard (ai4privacy English F1): lakshyakh93/deberta_finetuned_pii (0.14 B parameters), OpenMed/OpenMed-PII-SuperClinical-Large-434M-v1 (0.43 B) and antoniogr7/pii-identifier-v0.1 (0.15 B); • two small encoders from families already represented, included to separate model size from training data: OpenMed/OpenMed-PII-SuperClinical-Small-44M-v1 and kalyan-ks/ettin-68m-nemotron-pii; • the text model of ekacare/document-pii-redactor, which targets Indian names and documents and is an out-of-distribution check on US clinical notes. The other two top-five leaderboard entries were excluded under the rule stated in Methods, because they do not load through the standard token-classification pipeline. The same rule excludes the GLiNER family, whose output depends on a caller-supplied label prompt, and non-transformer models. AIMI v1 and v2 are radiology-trained de-identification transformers 13 that were also trained on i2b2 2014. Their label set is DATE, HCW, HOSPITAL, ID, PATIENT, PHONE and VENDOR (HCW scored as DOCTOR, VENDOR as HOSPITAL); it has no AGE, LOCATION or WEB label. Supplementary Note 3: Ray configuration and actor sizing Each CPU stage actor reserves one CPU and spawns a worker sub-actor that reserves another. On the 16 vCPU machine we used six actors, each with one CPU and a one-CPU worker, plus half a CPU each for the reader and the writer: about 13 CPUs in total. More actors over-subscribe the machine and deadlock the stage. The CPU-only transformer path uses a single untuned actor. GPU batch size was set separately for short and long notes. Supplementary Figures Dumbbell plot of span-level precision and recall across nine PHI categories comparing the Gemini 2.5 Flash teacher and the TIDE2-Sentry student on SHIELD; red connectors indicate the student trails the teacher. Figure S1: Teacher and student per category on SHIELD. Span-level precision (left) and recall (right) for the Gemini 2.5 Flash teacher and the distilled TIDE2-Sentry student. The student trails the teacher on recall in every category, most on WEB, AGE and LOCATION and least on DATE. Table S3 gives the same comparison with confidence intervals and paired p-values. Supplementary Tables Table S1: Per-category span-level recall and precision on SHIELD. Point estimates at an overlap threshold of 0.8 for regex, the two AIMI recognizers and TIDE2-Sentry with their +regex ablations, and the 6 external PII taggers. “–” marks a category absent from the AIMI label set (AGE, LOCATION, WEB). The +regex rows isolate the effect of the regex layer. TIDE 1.0 is not shown; its SHIELD aggregates are in main-text Table 1. Every external tagger scores at or near zero on DOCTOR, because their taxonomies carry one generic person type where clinical de-identification needs the patient/provider distinction (pooled NAME results in Table S14). Model AGE DATE DOCTOR HOSP ID LOC PATIENT PHONE WEB Recall TIDE2 regex 0.00 0.92 0.00 0.00 0.56 0.38 0.00 0.80 0.82 AIMI v1 – 0.95 0.46 0.90 0.95 – 0.78 0.92 – AIMI v1 + regex 0.00 0.95 0.46 0.90 0.95 0.36 0.78 0.94 0.60 AIMI v2 – 0.95 0.42 0.89 0.95 – 0.71 0.81 – AIMI v2 + regex 0.00 0.96 0.42 0.88 0.95 0.37 0.71 0.86 0.56 TIDE2-Sentry 0.78 0.94 0.90 0.79 0.90 0.55 0.88 0.85 0.67 TIDE2-Sentry + regex 0.78 0.95 0.90 0.78 0.91 0.51 0.88 0.85 0.67 DeBERTa-PII (lakshyakh93) 0.00 0.39 0.00 0.02 0.44 0.70 0.71 0.42 0.43 OpenMed SuperClinical L 0.03 0.75 0.00 0.47 0.29 0.58 0.92 0.67 0.52 OpenMed SuperClinical S 0.04 0.72 0.00 0.59 0.66 0.54 0.91 0.67 0.70 PII-Identifier (antonio) 0.09 0.74 0.00 0.45 0.36 0.71 0.85 0.59 0.60 Ettin-68M Nemotron 0.02 0.73 0.00 0.27 0.61 0.79 0.90 0.61 0.55 ekacare MiniLM 0.88 0.66 0.00 0.00 0.62 0.72 0.81 0.81 0.73 Precision TIDE2 regex 0.00 0.98 0.00 0.00 0.94 0.93 0.00 0.98 0.82 AIMI v1 – 0.94 0.41 0.47 0.63 – 0.88 0.69 – AIMI v1 + regex 0.00 0.93 0.42 0.53 0.72 0.93 0.89 0.87 0.77 AIMI v2 – 0.95 0.37 0.39 0.52 – 0.89 0.76 – AIMI v2 + regex 0.00 0.94 0.38 0.44 0.61 0.93 0.90 0.92 0.75 TIDE2-Sentry 0.71 0.97 0.93 0.61 0.92 0.78 0.96 0.89 0.90 TIDE2-Sentry + regex 0.71 0.95 0.93 0.61 0.92 0.74 0.96 0.89 0.72 DeBERTa-PII (lakshyakh93) 0.00 0.42 0.00 0.07 0.18 0.15 0.25 0.60 0.02 OpenMed SuperClinical L 0.03 0.66 0.00 0.81 0.35 0.41 0.28 0.97 0.80 OpenMed SuperClinical S 0.06 0.62 0.00 0.78 0.53 0.29 0.29 0.95 0.89 PII-Identifier (antonio) 0.14 0.65 0.00 0.74 0.53 0.40 0.27 0.96 0.80 Ettin-68M Nemotron 0.12 0.65 0.00 0.78 0.70 0.42 0.28 0.95 0.88 ekacare MiniLM 0.72 0.57 0.00 0.00 0.32 0.42 0.22 0.91 0.90 Table S2: Per-category span-level recall and precision on i2b2 2014. Same models and same conventions as Table S1, after the label crosswalk of Table S6. The 6 external PII taggers are included as an off-distribution probe, as on SHIELD. Model AGE DATE DOCTOR HOSP ID LOC PATIENT PHONE WEB Recall TIDE2 regex 0.00 0.75 0.00 0.00 0.44 0.13 0.00 0.38 0.71 AIMI v1 – 0.94 0.25 0.87 0.81 – 0.56 0.94 – AIMI v1 + regex 0.00 0.95 0.25 0.87 0.81 0.08 0.56 0.93 0.57 AIMI v2 – 0.94 0.23 0.84 0.80 – 0.54 0.88 – AIMI v2 + regex 0.00 0.95 0.23 0.84 0.80 0.09 0.54 0.88 0.29 TIDE2-Sentry 0.68 0.85 0.85 0.39 0.64 0.65 0.79 0.56 0.57 TIDE2-Sentry + regex 0.68 0.86 0.85 0.39 0.65 0.63 0.79 0.56 0.57 DeBERTa-PII (lakshyakh93) 0.00 0.25 0.00 0.01 0.14 0.55 0.43 0.07 0.43 OpenMed SuperClinical L 0.00 0.68 0.00 0.04 0.38 0.79 0.85 0.22 0.71 OpenMed SuperClinical S 0.01 0.66 0.00 0.12 0.62 0.77 0.84 0.25 0.57 PII-Identifier (antonio) 0.15 0.59 0.00 0.07 0.39 0.81 0.84 0.26 0.71 Ettin-68M Nemotron 0.02 0.64 0.00 0.13 0.52 0.82 0.85 0.31 0.71 ekacare MiniLM 0.75 0.70 0.00 0.00 0.44 0.81 0.49 0.22 0.71 Precision TIDE2 regex 0.00 0.99 0.00 0.00 0.91 0.85 0.00 0.97 0.62 AIMI v1 – 0.98 0.25 0.59 0.83 – 0.55 0.76 – AIMI v1 + regex 0.00 0.98 0.25 0.61 0.85 0.84 0.55 0.82 0.57 AIMI v2 – 0.98 0.23 0.52 0.73 – 0.53 0.77 – AIMI v2 + regex 0.15 0.97 0.23 0.54 0.76 0.85 0.53 0.83 0.40 TIDE2-Sentry 0.74 0.96 0.92 0.48 0.85 0.69 0.90 0.73 0.22 TIDE2-Sentry + regex 0.74 0.95 0.92 0.48 0.84 0.69 0.90 0.73 0.19 DeBERTa-PII (lakshyakh93) 0.00 0.49 0.00 0.04 0.03 0.10 0.13 0.09 0.00 OpenMed SuperClinical L 0.01 0.80 0.00 0.54 0.49 0.54 0.27 0.91 0.31 OpenMed SuperClinical S 0.01 0.80 0.00 0.68 0.50 0.44 0.26 0.86 0.10 PII-Identifier (antonio) 0.28 0.79 0.00 0.64 0.62 0.56 0.28 0.94 0.45 Ettin-68M Nemotron 0.10 0.79 0.00 0.63 0.65 0.41 0.28 0.87 0.25 ekacare MiniLM 0.70 0.70 0.00 0.00 0.34 0.48 0.16 0.44 0.20 Table S3: Distillation fidelity on SHIELD, per category. Gemini 2.5 Flash (teacher) against TIDE2-Sentry (student), with bootstrap 95% confidence intervals over 2,000 document-level resamples. Δ is student minus teacher recall, so a negative value means the student trails; p comes from a paired document-bootstrap test, and padj=min(1,9p)p_adj= (1,9\,p) is the Bonferroni-adjusted value for a family of 9 categories. Gemini 2.5 Flash TIDE2-Sentry Category P [95% CI] R [95% CI] P [95% CI] R [95% CI] Δ p padjp_adj AGE 0.85 [0.79-0.90] 0.90 [0.87-0.93] 0.71 [0.65-0.77] 0.78 [0.74-0.83] -0.12 <0.0005 <0.005 DATE 0.99 [0.98-0.99] 0.98 [0.98-0.99] 0.97 [0.96-0.97] 0.94 [0.93-0.95] -0.04 <0.0005 <0.005 DOCTOR 0.95 [0.94-0.97] 0.96 [0.96-0.97] 0.93 [0.92-0.94] 0.90 [0.88-0.92] -0.06 <0.0005 <0.005 HOSPITAL 0.67 [0.64-0.71] 0.88 [0.85-0.90] 0.61 [0.57-0.65] 0.79 [0.75-0.82] -0.09 <0.0005 <0.005 ID 0.91 [0.87-0.94] 0.95 [0.92-0.97] 0.92 [0.89-0.94] 0.90 [0.86-0.94] -0.05 =0.0050 0.045 LOCATION 0.86 [0.82-0.90] 0.66 [0.60-0.71] 0.78 [0.72-0.84] 0.55 [0.49-0.61] -0.11 <0.0005 <0.005 PATIENT 0.95 [0.93-0.97] 0.95 [0.93-0.97] 0.96 [0.94-0.97] 0.88 [0.85-0.90] -0.07 <0.0005 <0.005 PHONE 0.98 [0.97-0.99] 0.95 [0.93-0.97] 0.89 [0.85-0.92] 0.85 [0.81-0.89] -0.10 <0.0005 <0.005 WEB 1.00 [1.00-1.00] 0.82 [0.67-0.95] 0.90 [0.81-0.98] 0.67 [0.52-0.83] -0.15 =0.0225 0.202 Table S4: Per-category confidence intervals for the core recognizers. Span-level precision and recall with bootstrap 95% intervals over 2,000 document-level resamples, for regex, the fine-tuned clinical transformers and the TIDE2-Sentry+regex ablation, on both corpora. The AIMI recognizers have no AGE, LOCATION or WEB label; their degenerate 0.00 [0.00–0.00] cells in these categories reflect that, and Tables S1–S2 write them as “–”. Category Metric TIDE2 regex AIMI v1 AIMI v2 TIDE2-Sentry TIDE2-Sentry+regex SHIELD AGE Precision 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.71 [0.65-0.77] 0.71 [0.65-0.77] AGE Recall 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.78 [0.74-0.83] 0.78 [0.74-0.83] DATE Precision 0.98 [0.98-0.99] 0.94 [0.93-0.95] 0.95 [0.94-0.96] 0.97 [0.96-0.97] 0.95 [0.94-0.96] DATE Recall 0.92 [0.91-0.94] 0.95 [0.94-0.96] 0.95 [0.94-0.96] 0.94 [0.93-0.95] 0.95 [0.93-0.96] DOCTOR Precision 0.00 [0.00-0.00] 0.41 [0.38-0.43] 0.37 [0.34-0.39] 0.93 [0.92-0.94] 0.93 [0.92-0.94] DOCTOR Recall 0.00 [0.00-0.00] 0.46 [0.43-0.49] 0.42 [0.40-0.45] 0.90 [0.88-0.92] 0.90 [0.88-0.92] HOSPITAL Precision 0.00 [0.00-0.00] 0.47 [0.44-0.50] 0.39 [0.36-0.42] 0.61 [0.57-0.65] 0.61 [0.57-0.64] HOSPITAL Recall 0.00 [0.00-0.00] 0.90 [0.88-0.93] 0.89 [0.87-0.91] 0.79 [0.75-0.82] 0.78 [0.74-0.81] ID Precision 0.94 [0.91-0.97] 0.63 [0.59-0.66] 0.52 [0.49-0.56] 0.92 [0.89-0.94] 0.92 [0.89-0.94] ID Recall 0.56 [0.52-0.60] 0.95 [0.92-0.98] 0.95 [0.92-0.97] 0.90 [0.86-0.94] 0.91 [0.88-0.94] LOCATION Precision 0.93 [0.89-0.96] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.78 [0.72-0.84] 0.74 [0.68-0.80] LOCATION Recall 0.38 [0.32-0.43] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.55 [0.49-0.61] 0.51 [0.45-0.56] PATIENT Precision 0.00 [0.00-0.00] 0.88 [0.86-0.91] 0.89 [0.86-0.91] 0.96 [0.94-0.97] 0.96 [0.94-0.97] PATIENT Recall 0.00 [0.00-0.00] 0.78 [0.75-0.81] 0.71 [0.67-0.75] 0.88 [0.85-0.90] 0.88 [0.85-0.90] PHONE Precision 0.98 [0.96-1.00] 0.69 [0.64-0.73] 0.76 [0.72-0.80] 0.89 [0.85-0.92] 0.89 [0.85-0.92] PHONE Recall 0.80 [0.75-0.84] 0.92 [0.89-0.94] 0.81 [0.77-0.86] 0.85 [0.81-0.89] 0.85 [0.81-0.89] WEB Precision 0.82 [0.70-0.91] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.90 [0.81-0.98] 0.72 [0.60-0.84] WEB Recall 0.82 [0.67-0.95] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.67 [0.52-0.83] 0.67 [0.52-0.83] i2b2 2014 AGE Precision 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.14 [0.03-0.28] 0.74 [0.72-0.77] 0.74 [0.72-0.77] AGE Recall 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.68 [0.66-0.71] 0.68 [0.66-0.71] DATE Precision 0.99 [0.99-0.99] 0.98 [0.98-0.99] 0.98 [0.97-0.98] 0.96 [0.95-0.96] 0.95 [0.95-0.96] DATE Recall 0.75 [0.73-0.77] 0.94 [0.93-0.95] 0.94 [0.93-0.94] 0.85 [0.84-0.86] 0.86 [0.85-0.87] DOCTOR Precision 0.00 [0.00-0.00] 0.25 [0.23-0.27] 0.23 [0.21-0.25] 0.92 [0.91-0.93] 0.92 [0.91-0.93] DOCTOR Recall 0.00 [0.00-0.00] 0.25 [0.23-0.27] 0.23 [0.21-0.25] 0.85 [0.84-0.87] 0.85 [0.84-0.87] HOSPITAL Precision 0.00 [0.00-0.00] 0.59 [0.57-0.61] 0.52 [0.49-0.54] 0.48 [0.45-0.51] 0.48 [0.45-0.51] HOSPITAL Recall 0.00 [0.00-0.00] 0.87 [0.85-0.88] 0.84 [0.82-0.86] 0.39 [0.37-0.42] 0.39 [0.37-0.42] ID Precision 0.91 [0.87-0.94] 0.83 [0.81-0.85] 0.73 [0.71-0.75] 0.85 [0.82-0.87] 0.84 [0.82-0.86] ID Recall 0.44 [0.40-0.48] 0.81 [0.75-0.87] 0.80 [0.74-0.86] 0.64 [0.58-0.69] 0.65 [0.59-0.70] LOCATION Precision 0.85 [0.79-0.91] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.69 [0.65-0.73] 0.69 [0.65-0.72] LOCATION Recall 0.13 [0.11-0.16] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.65 [0.61-0.69] 0.63 [0.59-0.67] PATIENT Precision 0.00 [0.00-0.00] 0.55 [0.52-0.57] 0.53 [0.50-0.56] 0.90 [0.88-0.93] 0.90 [0.88-0.93] PATIENT Recall 0.00 [0.00-0.00] 0.56 [0.53-0.59] 0.54 [0.51-0.57] 0.79 [0.77-0.82] 0.79 [0.77-0.82] PHONE Precision 0.97 [0.94-1.00] 0.76 [0.72-0.80] 0.77 [0.73-0.81] 0.73 [0.68-0.77] 0.73 [0.68-0.78] PHONE Recall 0.38 [0.33-0.42] 0.94 [0.92-0.96] 0.88 [0.85-0.91] 0.56 [0.52-0.60] 0.56 [0.51-0.60] WEB Precision 0.62 [0.25-1.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.22 [0.04-0.47] 0.19 [0.04-0.40] WEB Recall 0.71 [0.25-1.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.57 [0.10-1.00] 0.57 [0.10-1.00] Table S5: Per-category confidence intervals for the external PII taggers. Bootstrap 95% intervals over 2,000 document-level resamples, on SHIELD and i2b2 2014. These models are trained on non-clinical or non-US PII distributions, so their numbers read as an off-distribution check and not as tuned baselines (Supplementary Note 2). Category Metric DeBERTa-PII OpenMed L OpenMed S PII-Ident. Ettin-68M ekacare SHIELD AGE Precision 0.00 [0.00-0.00] 0.03 [0.01-0.06] 0.06 [0.04-0.09] 0.14 [0.09-0.18] 0.12 [0.05-0.20] 0.72 [0.68-0.77] AGE Recall 0.00 [0.00-0.00] 0.03 [0.01-0.05] 0.04 [0.03-0.07] 0.09 [0.06-0.11] 0.02 [0.01-0.04] 0.88 [0.85-0.92] DATE Precision 0.42 [0.40-0.44] 0.66 [0.64-0.68] 0.62 [0.59-0.64] 0.65 [0.63-0.67] 0.65 [0.63-0.67] 0.57 [0.54-0.59] DATE Recall 0.39 [0.36-0.42] 0.75 [0.73-0.77] 0.72 [0.70-0.75] 0.74 [0.71-0.76] 0.73 [0.71-0.75] 0.66 [0.63-0.68] DOCTOR Precision 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] DOCTOR Recall 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] HOSPITAL Precision 0.07 [0.04-0.11] 0.81 [0.77-0.85] 0.78 [0.74-0.82] 0.74 [0.69-0.78] 0.78 [0.72-0.83] 0.00 [0.00-0.00] HOSPITAL Recall 0.02 [0.01-0.03] 0.47 [0.43-0.50] 0.59 [0.55-0.62] 0.45 [0.41-0.49] 0.27 [0.24-0.30] 0.00 [0.00-0.00] ID Precision 0.18 [0.16-0.20] 0.35 [0.31-0.38] 0.53 [0.50-0.56] 0.53 [0.49-0.58] 0.70 [0.66-0.74] 0.32 [0.29-0.35] ID Recall 0.44 [0.39-0.48] 0.29 [0.25-0.33] 0.66 [0.62-0.70] 0.36 [0.32-0.41] 0.61 [0.56-0.66] 0.62 [0.58-0.66] LOCATION Precision 0.15 [0.13-0.17] 0.41 [0.36-0.46] 0.29 [0.25-0.34] 0.40 [0.35-0.45] 0.42 [0.37-0.46] 0.42 [0.38-0.47] LOCATION Recall 0.70 [0.65-0.75] 0.58 [0.52-0.63] 0.54 [0.48-0.60] 0.71 [0.66-0.76] 0.79 [0.74-0.83] 0.72 [0.67-0.77] PATIENT Precision 0.25 [0.23-0.28] 0.28 [0.26-0.30] 0.29 [0.27-0.32] 0.27 [0.25-0.29] 0.28 [0.26-0.30] 0.22 [0.20-0.24] PATIENT Recall 0.71 [0.68-0.75] 0.92 [0.90-0.93] 0.91 [0.89-0.93] 0.85 [0.82-0.87] 0.90 [0.88-0.92] 0.81 [0.78-0.84] PHONE Precision 0.60 [0.54-0.66] 0.97 [0.95-0.99] 0.95 [0.92-0.97] 0.96 [0.94-0.98] 0.95 [0.92-0.97] 0.91 [0.86-0.94] PHONE Recall 0.42 [0.37-0.47] 0.67 [0.62-0.72] 0.67 [0.62-0.72] 0.59 [0.54-0.64] 0.61 [0.55-0.67] 0.81 [0.76-0.85] WEB Precision 0.02 [0.01-0.03] 0.80 [0.65-0.92] 0.89 [0.81-0.96] 0.80 [0.70-0.89] 0.88 [0.77-0.96] 0.90 [0.81-0.97] WEB Recall 0.43 [0.29-0.57] 0.52 [0.38-0.69] 0.70 [0.54-0.84] 0.60 [0.45-0.75] 0.55 [0.41-0.69] 0.73 [0.57-0.89] i2b2 2014 AGE Precision 0.00 [0.00-0.00] 0.01 [0.00-0.01] 0.01 [0.00-0.01] 0.28 [0.26-0.31] 0.10 [0.07-0.14] 0.70 [0.68-0.72] AGE Recall 0.00 [0.00-0.00] 0.00 [0.00-0.01] 0.01 [0.00-0.01] 0.15 [0.14-0.17] 0.02 [0.01-0.02] 0.75 [0.72-0.77] DATE Precision 0.49 [0.47-0.51] 0.80 [0.77-0.83] 0.80 [0.76-0.82] 0.79 [0.75-0.83] 0.79 [0.75-0.82] 0.70 [0.67-0.72] DATE Recall 0.25 [0.24-0.27] 0.68 [0.66-0.71] 0.66 [0.64-0.68] 0.59 [0.56-0.61] 0.64 [0.61-0.67] 0.70 [0.67-0.72] DOCTOR Precision 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] DOCTOR Recall 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] HOSPITAL Precision 0.04 [0.02-0.05] 0.54 [0.46-0.62] 0.68 [0.63-0.73] 0.64 [0.57-0.70] 0.63 [0.58-0.67] 0.00 [0.00-0.00] HOSPITAL Recall 0.01 [0.01-0.02] 0.04 [0.03-0.05] 0.12 [0.10-0.14] 0.07 [0.06-0.08] 0.13 [0.11-0.14] 0.00 [0.00-0.00] ID Precision 0.03 [0.02-0.03] 0.49 [0.44-0.54] 0.50 [0.47-0.52] 0.62 [0.57-0.66] 0.65 [0.61-0.69] 0.34 [0.31-0.36] ID Recall 0.14 [0.12-0.16] 0.38 [0.34-0.41] 0.62 [0.58-0.66] 0.39 [0.36-0.42] 0.52 [0.48-0.56] 0.44 [0.40-0.48] LOCATION Precision 0.10 [0.09-0.11] 0.54 [0.52-0.57] 0.44 [0.42-0.47] 0.56 [0.53-0.58] 0.41 [0.39-0.43] 0.48 [0.45-0.50] LOCATION Recall 0.55 [0.51-0.59] 0.79 [0.76-0.82] 0.77 [0.74-0.80] 0.81 [0.78-0.84] 0.82 [0.79-0.84] 0.81 [0.78-0.84] PATIENT Precision 0.13 [0.12-0.14] 0.27 [0.25-0.28] 0.26 [0.25-0.28] 0.28 [0.26-0.29] 0.28 [0.27-0.30] 0.16 [0.15-0.17] PATIENT Recall 0.43 [0.40-0.45] 0.85 [0.83-0.86] 0.84 [0.82-0.86] 0.84 [0.82-0.86] 0.85 [0.83-0.87] 0.49 [0.46-0.52] PHONE Precision 0.09 [0.06-0.13] 0.91 [0.85-0.95] 0.86 [0.80-0.91] 0.94 [0.90-0.97] 0.87 [0.80-0.92] 0.44 [0.37-0.51] PHONE Recall 0.07 [0.04-0.10] 0.22 [0.18-0.25] 0.25 [0.21-0.29] 0.26 [0.22-0.30] 0.31 [0.27-0.35] 0.22 [0.18-0.26] WEB Precision 0.00 [0.00-0.00] 0.31 [0.09-0.54] 0.10 [0.02-0.21] 0.45 [0.14-0.75] 0.25 [0.06-0.46] 0.20 [0.05-0.38] WEB Recall 0.43 [0.00-1.00] 0.71 [0.25-1.00] 0.57 [0.10-1.00] 0.71 [0.25-1.00] 0.71 [0.25-1.00] 0.71 [0.25-1.00] Table S6: The i2b2 2014 to SHIELD label crosswalk. The mapping is applied to the gold spans at scoring time. After exclusions and boundary alignment the corpus has 27,298 gold spans over 1,304 notes. The boundary rules follow from the annotation conventions: i2b2 annotates most ages as a bare number and each address component separately, whereas SHIELD includes the age unit and annotates the whole address as one span. SHIELD category i2b2 2014 tags Treatment AGE AGE straight through; right edge extended over the age unit DATE DATE straight through (Philter safe-date re-mapping: sensitivity only) DOCTOR DOCTOR straight through HOSPITAL HOSPITAL straight through ID MEDICALRECORD / IDNUM / USERNAME / DEVICE / HEALTHPLAN / BIOID relabelled LOCATION CITY / STATE / STREET / ZIP / COUNTRY / LOCATION-OTHER relabelled; adjacent components merged into one span PATIENT PATIENT straight through PHONE PHONE / FAX relabelled WEB EMAIL / URL relabelled (not scored) ORGANIZATION excluded from gold; model output already unscored (not scored) PROFESSION excluded from gold; model output already unscored Table S7: Functional and architectural change from TIDE 1.0 to TIDE 2.0. Capability TIDE 1.0 TIDE 2.0 Recognizer coupled, fixed NER model-agnostic (regex / transformer / LLM) Name / location surrogate yes (RNG, non-deterministic) yes (cryptographic keyed) Same value → same surrogate no yes, automatic (keyed) New key gives an unlinkable release n/a yes ID / MRN / SSN / phone redaction only format-preserving encryption / hash Email / URL / organization redaction only surrogate Age handling generalize 90+ only cap at 89 State / country retained yes yes Distributed execution no Ray GPU/CPU, adaptive batching Out-of-memory recovery no automatic batch-splitting License open source MIT Table S8: Worked anonymization examples on identical inputs. TIDE 1.0 redacts structured identifiers and draws non-deterministic name and location surrogates; TIDE 2.0 applies a surrogate, format-preserving encryption or a keyed hash to every category. Category PHI span TIDE 1.0 TIDE 1.0 strat. TIDE 2.0 TIDE 2.0 strat. Name John Smith Ziyad Bromberg surrogate (RNG) Flynn Singleton keyed surrogate Location 123 Main St, New York, NY 10001 Nashua NH 03060 surrogate (RNG) 13737 Chestnut Hill Rd, Balance Of Jerome County, NY 49885 keyed surrogate Org Stanford Health Care Stanford Health Care unchanged (no org surrogate) Unity Ridge Community Hospital keyed surrogate Date April 18, 2012 04/28/2012 date-shift (jitter) April 28th, 2012 date-shift (jitter) Age 95 years old [90 year old] old generalization (90+) 89 years old cap at 89 Age 88 years old 88 years old unchanged (fires 90+ only) 88 years old cap at 89 MRN 15851368 [MRN] redaction 15068153 FPE (F3) SSN 123-45-6789 [general-ssn] redaction 069-88-6168 FPE (F3) Phone 650-876-9087 [general-phone] redaction 504-015-2308 FPE (F3) Account 22222222 [general-account] redaction 743A4DE6F3E9B49A hash (SHA256) Email wcl@com.com [general-email] redaction johnsonjoshua@example.org faker surrogate URL https://w.yahoo.com/testpage [general-url] redaction https://w.hill.net/ faker surrogate Table S9: Consistency and remapping. Each value appears three times across two notes for one patient. TIDE 2.0 maps a value to the same surrogate under a fixed key, which is what makes cross-note linkage survive, and to a different surrogate under a new key, so releases under different keys cannot be linked. TIDE 1.0 draws a new random surrogate at each occurrence for names. Value Occ. TIDE 1.0 TIDE 2.0 (same key) TIDE 2.0 (new key) Jose (Name) A/1 Rourke Tidwell Rowland A/2 Suskin Tidwell (same) B/1 Abid Tidwell (same) 15851368 (MRN) A/1 [MRN] 15068153 24176984 A/2 [MRN] 15068153 (same) B/1 [MRN] 15068153 (same) 03/15/2023 (Date) A/1 03/25/2023 03/25/2023 03/25/2023 A/2 03/25/2023 03/25/2023 (same) B/1 03/25/2023 03/25/2023 (same) Table S10: Feature comparison with OpenMed, a per-document detection toolkit. The two systems address different problems and are complementary: TIDE 2.0 is a batch engine and can host an OpenMed model as a recognizer plugin. Axis TIDE 2.0 (batch engine) OpenMed (detection toolkit) Primary artifact de-id engine/pipeline (recognizer-agnostic) model collection + toolkit Target unit of work batch corpora per-document / on-device inference Recognizer flexibility any HF token classifier, LLM, regex/Aho-Corasick own MoE Privacy-Filter + NER families LLM recognizer support yes (structured-JSON extraction) not provided Anonymization strategies mask / keyed surrogate / FPE / hash / per-patient date shift mask / synthetic replace / hash / temporal shift Longitudinal consistency across notes yes, cryptographic keyed not guaranteed across documents Per-study/tenant key isolation yes not provided Distributed execution Ray GPU/CPU, adaptive batching, OOM batch splitting batch processing; no distributed infra License MIT Apache-2.0 Table S11: Feature comparison with managed cloud de-identification services. These services require sending clinical text off-site under a business associate agreement. AWS Comprehend Medical detects PHI but performs no in-service replacement. Axis TIDE 2.0 GCP Sensitive Data Protection Azure Health De-id AWS Comprehend Medical Deployment on-prem, open-source (PHI local) managed cloud managed cloud managed cloud De-identify (replace) or only detect? detect + replace detect + redact/replace/mask/crypto/tokenize detect + surrogation detect only Longitudinal consistency across notes yes, cryptographic keyed not documented as built in not documented as built in n/a Interval-preserving per-patient date shift yes generic date-shift, not per-patient limited n/a Model-agnostic recognizer yes fixed service models fixed service models fixed service models Batch execution Ray distributed (single-node benchmark in this paper) via cloud APIs (egress + quota) via cloud APIs via cloud APIs License / openness MIT, inspectable proprietary proprietary proprietary Table S12: Decomposition of the SHIELD to i2b2 drop in micro-averaged recall, TIDE2-Sentry. Share: the category’s percentage of gold spans on each corpus. Recall term: w¯c(rs,c−ri,c) w_c(r_s,c-r_i,c), the category’s recall change weighted by its mean share. Mix term: r¯c(ws,c−wi,c) r_c(w_s,c-w_i,c), the effect of the different category mix. The two columns sum to the total drop (Methods). A positive value lowers recall on i2b2. Share (%) Recall Category SHIELD i2b2 SHIELD i2b2 Recall term Mix term AGE 3.5 7.3 0.78 0.68 +0.006 -0.028 DATE 34.7 45.7 0.94 0.85 +0.037 -0.099 DOCTOR 25.4 17.6 0.90 0.85 +0.010 +0.069 HOSPITAL 9.0 8.5 0.79 0.39 +0.034 +0.003 ID 7.1 6.8 0.90 0.64 +0.018 +0.002 LOCATION 4.4 4.1 0.55 0.65 -0.004 +0.002 PATIENT 10.1 8.0 0.88 0.79 +0.008 +0.017 PHONE 5.0 2.0 0.85 0.56 +0.010 +0.022 WEB 0.8 0.0 0.67 0.57 +0.000 +0.005 Total 100.0 100.0 0.88 0.77 +0.120 -0.008 Table S13: Effect of the regex layer. Difference in span-level recall (Δ ) and precision (Δ ), TIDE2-Sentry+regex minus TIDE2-Sentry, with 95% intervals from a paired document bootstrap (2,000 resamples). Micro pools counts over the 9 categories. SHIELD i2b2 2014 Category Δ [95% CI] Δ [95% CI] Δ [95% CI] Δ [95% CI] AGE +0.000 [+0.000 to +0.000] +0.000 [+0.000 to +0.000] +0.000 [+0.000 to +0.000] +0.000 [+0.000 to +0.000] DATE +0.001 [+0.000 to +0.004] -0.011 [-0.016 to -0.007] +0.007 [+0.004 to +0.010] -0.007 [-0.009 to -0.005] DOCTOR +0.000 [+0.000 to +0.000] +0.000 [+0.000 to +0.000] +0.000 [+0.000 to +0.000] +0.000 [+0.000 to +0.000] HOSPITAL -0.008 [-0.014 to -0.002] -0.001 [-0.004 to +0.001] -0.000 [-0.001 to +0.000] +0.000 [-0.001 to +0.002] ID +0.012 [+0.000 to +0.029] -0.000 [-0.004 to +0.002] +0.009 [+0.005 to +0.014] -0.003 [-0.007 to +0.000] LOCATION -0.045 [-0.074 to -0.019] -0.040 [-0.066 to -0.017] -0.022 [-0.035 to -0.010] -0.007 [-0.017 to +0.002] PATIENT +0.000 [+0.000 to +0.000] +0.000 [+0.000 to +0.000] +0.000 [+0.000 to +0.000] +0.000 [+0.000 to +0.000] PHONE +0.000 [+0.000 to +0.000] +0.000 [+0.000 to +0.000] -0.002 [-0.006 to +0.000] +0.003 [-0.001 to +0.009] WEB +0.000 [+0.000 to +0.000] -0.178 [-0.282 to -0.088] +0.000 [+0.000 to +0.000] -0.032 [-0.107 to +0.000] Micro -0.001 [-0.003 to +0.001] -0.006 [-0.008 to -0.004] +0.003 [+0.001 to +0.004] -0.003 [-0.004 to -0.002] Table S14: DOCTOR and PATIENT pooled as NAME. Span-level precision and recall with bootstrap 95% intervals when the two person categories are scored as one. This removes the patient/provider distinction that the external taggers’ taxonomies do not make. SHIELD i2b2 2014 Model P [95% CI] R [95% CI] P [95% CI] R [95% CI] TIDE2 regex 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] 0.00 [0.00-0.00] AIMI v1 0.55 [0.53-0.58] 0.59 [0.56-0.61] 0.35 [0.34-0.37] 0.35 [0.33-0.37] AIMI v2 0.53 [0.51-0.55] 0.56 [0.54-0.58] 0.33 [0.32-0.35] 0.33 [0.32-0.35] TIDE2-Sentry 0.95 [0.94-0.96] 0.91 [0.89-0.92] 0.93 [0.92-0.94] 0.84 [0.83-0.86] TIDE2-Sentry + regex 0.95 [0.94-0.96] 0.91 [0.89-0.92] 0.93 [0.92-0.94] 0.84 [0.83-0.86] DeBERTa-PII (lakshyakh93) 0.56 [0.53-0.59] 0.44 [0.42-0.47] 0.40 [0.39-0.42] 0.40 [0.39-0.42] OpenMed SuperClinical L 0.81 [0.80-0.83] 0.73 [0.70-0.75] 0.81 [0.80-0.82] 0.76 [0.75-0.78] OpenMed SuperClinical S 0.74 [0.72-0.76] 0.65 [0.62-0.67] 0.82 [0.80-0.83] 0.78 [0.77-0.79] PII-Identifier (antonio) 0.93 [0.92-0.94] 0.76 [0.74-0.78] 0.93 [0.92-0.94] 0.80 [0.79-0.82] Ettin-68M Nemotron 0.94 [0.93-0.95] 0.81 [0.79-0.84] 0.93 [0.92-0.94] 0.82 [0.81-0.83] ekacare MiniLM 0.72 [0.69-0.74] 0.73 [0.71-0.75] 0.51 [0.50-0.53] 0.49 [0.47-0.50]