De-identification and confidentiality are different legal frameworks. HIPAA's Safe Harbor removes 18 identifiers so information no longer relates to an identifiable person. An NDA protects the information itself, for example pricing, methods, unpublished results and industrial secrets, whether or not anyone is identifiable. Removing names from a trade secret does not make it non-confidential and shareable with anyone, so de-identification alone cannot satisfy an NDA.
Two frameworks that answer different questions
Nearly every "how to use AI safely" article ends the same way: de-identify the data first. The advice sounds complete because health privacy really does have a de-identification standard. In the US, HIPAA's Safe Harbor enumerates 18 categories of identifiers at 45 CFR 164.514(b)(2), and removing them renders information no longer subject to the Privacy Rule. But consultants do not primarily hold PHI, even where some of them hold a great deal of it. They hold NDA-bound information, industrial secrets, unpublished data, the PII of their clients and their employees, and in some cases PHI as well. Only the last two of those are addressed by privacy standards at all.
| Privacy (HIPAA / GDPR / PIPEDA) | Confidentiality (NDA / engagement terms) | |
|---|---|---|
| What it protects | Persons, or information that identifies or relates to an individual. | Information itself, whatever the parties agreed to protect, identifiable person or not. |
| Release standard | Defined: Safe Harbor's 18 identifiers (45 CFR 164.514(b)(2)), or Expert Determination. | None. No enumerated list of removals makes information non-confidential; the agreement's definition governs. |
| Example of protected content | A patient's name, MRN, dates, geographic detail. | A pricing model, an unpublished endpoint, the result of a statistical or economic analysis, a market-entry strategy, a client's identity as a client. |
| Effect of removing names | Often sufficient (with the other 17 categories) to de-identify. | Usually irrelevant. The confidential thing is the substance, not the attribution. |
This is why the popular equation, "we redacted the names, so it's fine", fails for consulting work. It imports a health-privacy release standard into a contract that relates to a much wider and deeper context.
A worked example
Consider a sentence from a (synthetic) engagement deliverable:
"Acme Corp's launch price of $48,000 per course undercuts the market leader by 22%, based on the unpublished Phase III response rate of 61%."
Now remove the identifier, per the de-identification instinct:
"[COMPANY]'s launch price of $48,000 per course undercuts the market leader by 22%, based on the unpublished Phase III response rate of 61%."
Every confidential fact is still there: the price, the discount strategy, the unpublished trial result. Anyone in the field could re-identify the company from the numbers alone, and even if they could not, the NDA protects the numbers, not the name. The disclosure happened anyway.
The tooling gap this creates
Almost every AI-safety tool on the market is a privacy tool: it detects and masks PII and PHI, which includes patient names, addresses, identifiers, the Safe Harbor list. That is genuinely useful for respecting the law and staying compliant, but it comes with two limits. First, stripping identifiers loses some information. Second, and more important for confidentiality, because only the names are de-identified, enough information is typically retained to reconstruct the secret or the important result. Both the AI and any human reading the document can rebuild what is missing, because too much was left behind. There is a further problem: many transmission methods involve complete files, so the metadata that travels with them can do the reconstruction on its own. The consultant's name and the client's name are most likely sitting in the Word document's author field, or in the slide master, which is enough for a frontier model to re-identify in milliseconds. Removing the name does not remove the substance, and the substance is what the NDA protects.
This is not only our reading. Reviewing generative AI for health technology assessment, an ISPOR Working Group advises avoiding protected health information in these models altogether, on the grounds that “absolute de-identification is not attainable, and re-identification risks remain non-zero” (Fleurence et al., Value in Health 2025;28(2):175–183). The same report notes that using patient-level or other confidential information in commercial models carries risk wherever data handling and privacy compliance are unclear, and that these models can memorise training data and later reproduce it.
Typically, institutional and academic guidance of this kind is written from a patient and societal perspective, and it reaches the conclusion that even thorough de-identification does not get you to safety. A leaked confidential value is rarely a societal harm, which is precisely why the literature spends less time on it, but it is a severe commercial one. An unpublished endpoint, a negotiated price, a sponsor's strategy, a potential optimal price. If de-identification is judged insufficient where the stake is patient privacy, it is plainly insufficient where the stake is a client's commercial position and a signed NDA. The framework that is under-served here is not privacy. It is confidentiality.
The other instinct, redact everything sensitive whatever it is, will certainly protect, but at the cost of destroying the work. A model reading "[REDACTED] undercuts [REDACTED] by [REDACTED]" has nothing to reason about.
Under blunt protection methods, AI output quality collapses: internal benchmarks measured roughly 37% of baseline writing quality after censoring-style redaction and 32% after random crypto-tokenization. Semantic cloaking, which the product calls Advanced Cloaking and which preserves each value's meaning, retained 94 to 98%.
Source: Tremblay & Harricharan (2026), “Comparing De-identification Methods on AI Writing Quality in HEOR and Market Access,” Zenodo, doi:10.5281/zenodo.21343321. Composite writing-quality index, 30 tests per technique, rebalanced out of the study’s 96/100 baseline. The ~37% and ~32% de-identification figures are provisional pending publication of the per-condition data.
What an NDA-compatible, architecture-based method requires is different from standard redaction. Simply said, we need to remove the values and keep the meaning, and the replacement has to carry information rather than be a blank. On the user's own computer, before anything is transmitted, "Acme Corp" becomes a name cloak with a stable identifier; the "$48,000" price becomes a semantic flag that tells the model the strategic posture of the pricing (a premium launch price positioned to undercut the leader) without ever revealing the number; and the "61%" response rate becomes a sequential flag the model can reference and reason with in the text, consistently, without knowing the value. The real values are restored locally when the answer comes back. The model does the work on the flags; the confidential values are never disclosed to it.
What this means in practice
- Audit your tooling against the right framework. "PII redaction" on a vendor's feature list addresses privacy law, not your NDAs. Ask how it treats a pricing figure or an unpublished clinical-study-report datapoint, not a phone number. Ask how it protects your clients' real secrets. Leaking PHI is a disaster that might cost you millions in fines. Leaking an industrial secret that helps an adversary could cost you a great deal more than the fine.
- Treat "de-identified" claims as the start of the analysis, not the end. The question a client's counsel will ask is whether confidential substance was disclosed, not whether names were removed.
- Demand evidence, not policy. An architecture in which the model never receives confidential values, backed by a serious audit trail, can prove what was sent. A policy that people promise to follow cannot. And trust-based AI contracting is a policy that hedges on an entity you do not control. You do not sit on the AI company's board, nor can you control what the AI is actually able to do with the data. An architecture-based protection makes you safer, and it leaves a trail that can and should be followed.
Frequently asked questions
Does removing names make client data safe to put into AI?
No. Names are one kind of confidential value, not the definition of confidentiality. A cost model, an unpublished trial endpoint, or a pricing strategy is confidential in itself under an NDA. Removing the names attached to it does not release it from the agreement.
Does HIPAA Safe Harbor de-identification satisfy an NDA?
Not in general. Safe Harbor is a health-privacy standard (45 CFR 164.514(b)(2)): it removes 18 categories of identifiers so that information no longer relates to an identifiable person. An NDA protects information itself, trade secrets, business terms, unpublished results, industrial secrets and strategies, regardless of whether any person is identifiable. The two frameworks answer different questions, and satisfying one does not satisfy the other.
What is the difference between privacy and confidentiality?
Privacy is about persons: it restricts the use of information that identifies or relates to an individual, and it is governed by laws like HIPAA, GDPR and PIPEDA. Confidentiality is about obligations: it restricts disclosure of information you agreed to protect, whoever it concerns, and it is governed by contracts. Your NDAs, engagement letters, employment terms and MSA are the contracts that protect that data. Generic AI tools, enterprise licences included, and AI tools built for privacy (PII and PHI redaction) do not automatically address confidentiality.
What is semantic cloaking?
Semantic cloaking, which the product calls Advanced Cloaking, replaces each confidential value in a text with an informative marker, one that preserves the value's role and meaning for reasoning. The value is replaced before the text leaves the user's computer. The AI model receives only the cloaked text and never the underlying value. The real values are restored locally for the human operator. Unlike redaction, the model can still reason about the document. And unlike traditional fixed-identifier tokenization, it applies to any confidential value rather than a fixed list of 18, which is what lets it protect secrets and not only identifiers.
How much AI output quality is lost when data is de-identified?
It depends on the method. Blunt redaction and random tokenization destroy the context a model needs, and internal benchmarks put retained writing quality near a third of baseline. Semantic cloaking, which preserves each value's meaning, retains roughly 95% of output quality (Tremblay & Harricharan, 2026). The method, not the principle, determines the cost.
About the author
Gabriel Tremblay, DBA, Founder & CEO, Untraceable. Gabriel holds a doctorate in business administration (DBA) specialising in decision-making, and has published health economics and outcomes research on de-identification, cloaking methods and AI writing quality. Publications and DOIs are listed on the publications page.
This guide is general information about how AI tools interact with confidentiality obligations. It is not legal advice, and it does not create any professional relationship. Confidentiality agreements vary, so review your own agreements with qualified counsel before relying on any framework described here.
Work with AI on data you can't share with it.
Untraceable cloaks confidential values on your computer before any AI model sees the text. The model never receives the secret at all.