With Data Privacy Day this week, what single practice actually caught residual PHI during DICOM de-identification or clinical note redaction before model training? Which tool or test you now rely on made the difference, and can you cite one concrete catch?

One practice that genuinely caught residual PHI for us was running a second, human readable validation pass after automated redaction, using a simple rule based scan combined with spot checks by someone who understands clinical language. Early on, we relied too heavily on automated de identification and missed a patient name embedded in a free text clinical note that referenced a family member rather than the patient directly. It was subtle, but it would have slipped into model training. The tool that made the difference was a post redaction QA step that flags uncommon proper nouns, dates tied to events, and narrative sections rather than structured fields. My view is that automation gets you most of the way, but context is where PHI hides. The key lesson is to assume residual risk in unstructured text and build a deliberate pause into the workflow. One extra review layer, even if applied to a sample, can prevent serious downstream exposure and is far easier than fixing a breach after the fact.