Risk-based data anonymization across every format.

Redaction removes information from view, masking replaces or obscures specific information, and anonymization transforms information to reduce the risk that an individual can be re-identified while preserving data utility. ANONYMIZE supports multiple techniques and uses risk-based anonymization to help teams determine the appropriate approach based on the information, regulatory requirements, and acceptable re-identification risk.

TrialAssure ANONYMIZE quantitatively assesses the probability that an individual could be re-identified from clinical information and compares that risk against an established threshold. The assessment considers combinations of quasi-identifiers such as dates, ages, sites, and rare events, helping teams understand risk beyond direct identifiers alone. When risk exceeds the defined threshold, ANONYMIZE helps identify appropriate transformations to reduce it while preserving data utility. The risk score, rules applied, and resulting decisions are captured for traceability and human review.

TrialAssure ANONYMIZE supports documents, datasets, and images, giving teams one risk-based approach across different types of clinical information. This includes unstructured documents, structured datasets such as SAS and XPT, scanned content through OCR, and DICOM medical imaging. Applying consistent rules and risk assessment across formats helps protect sensitive information wherever it appears while preserving data utility.

TrialAssure ANONYMIZE supports anonymization and de-identification requirements across EMA Policy 0070, Health Canada PRCI, HIPAA, GDPR, and FOIA. Built-in rules and risk thresholds give teams a starting point for applying the appropriate approach across different regulatory frameworks. For HIPAA de-identification, ANONYMIZE supports both Safe Harbor and Expert Determination approaches. For risk-based frameworks such as Policy 0070, the platform helps teams quantify re-identification risk and apply appropriate transformations while preserving data utility.

Yes. You can license TrialAssure ANONYMIZE and manage the process in-house, work alongside TrialAssure’s data anonymization experts, or have our team manage the work for you. The same technology, rule sets, risk model, and audit trail support each approach, giving you the flexibility to choose the level of support that fits your team.

Microsoft Office files, emails, CSV, SAS, XPT and PDF, plus scanned documents and images through OCR and DICOM medical imaging. Format coverage matters more than it sounds: a submission package mixes native documents, legacy scans, and analysis datasets, and anything the engine cannot open has to be redacted by hand — which is exactly where rules start drifting between reviewers. If a format you use is not listed, talk with our team about your specific requirements.

Rule-based transformations: scrambling patient IDs to pseudonymize them, masking company and patient information, shifting dates, generalizing ages into ranges, and applying full or pseudo-anonymization — all managed from one centralized view of every project and task. Each rule is chosen for what the risk score requires rather than applied uniformly, so a date can be offset instead of deleted and an age can become a band instead of a blank. Our date-offset method is patented with the USPTO. Because rules are defined once and applied across the corpus, the same identifier is handled the same way in every document.

Yes. DICOM is the third modality alongside documents and datasets. ANONYMIZE transforms the identifying metadata attached to each image — age, demographics, dates — using the same risk-based rules, the same thresholds and the same audit trail as your documents and datasets, so imaging travels with the rest of the trial record instead of sitting in a separate manual process beside it. The honest limit: pixel-level work, such as blurring or facial de-identification, is a custom engagement rather than part of the standard product.

Replacements are fitted to the page: pagination, layout, and tables stay intact even when a substitution runs longer than the original text, so the anonymized document reads like it was written that way — not a patchwork. That matters because a substitution that breaks pagination can also break the cross-references that make the document reviewable — the failure mode that separates purpose-built clinical document redaction software from a generic PDF editor.

Yes. Context-aware AI rules distinguish where a term appears, not merely that it appears: “type 2 diabetes” in a subject’s medical history can be generalized, because history combined with dates and site narrows the population, while the same words in an adverse-event table or lab listing are left alone — there they are the finding, not an identifier. That contextual layer is what lets you take out just enough instead of blanket-redacting every match, and it is the difference between a document that still answers a research question and a page of black boxes. Flagged context decisions go to a specialist for sign-off.

Voice and video are available as custom solutions rather than part of the standard product. Voice masking changes the speaker’s voice while preserving the speech pattern under study — a stutter or a slur stays audible, the identity does not — which matters when the recording itself is the measurement. Video is handled case by case, because what identifies a participant differs between a movement recording and a clinic consultation. Describe the recording types in your program and we can tell you what is feasible before you plan around it: contact us.