De-identification and confidentiality are different legal frameworks. HIPAA's Safe Harbor removes 18 identifiers so information no longer relates to an identifiable person. An NDA protects the information itself — pricing, methods, unpublished results — whether or not anyone is identifiable. Removing names from a trade secret does not make it non-confidential, so de-identification alone cannot satisfy an NDA.
Two frameworks that answer different questions
Nearly every "how to use AI safely" article ends the same way: de-identify the data first. The advice sounds complete because health privacy really does have a de-identification standard — HIPAA's Safe Harbor enumerates 18 categories of identifiers, and removing them renders information no longer subject to the Privacy Rule. But consultants don't primarily hold PHI. They hold NDA-bound information — and NDAs work on an entirely different axis:
| Privacy (HIPAA / GDPR / PIPEDA) | Confidentiality (NDA / engagement terms) | |
|---|---|---|
| What it protects | Persons — information that identifies or relates to an individual. | Information itself — whatever the parties agreed to protect, identifiable person or not. |
| Release standard | Defined: Safe Harbor's 18 identifiers, or Expert Determination. | None. No enumerated list of removals makes information non-confidential; the agreement's definition governs. |
| Example of protected content | A patient's name, MRN, dates, geographic detail. | A pricing model, an unpublished endpoint, a market-entry strategy, a client's identity as a client. |
| Effect of removing names | Often sufficient (with the other 17 categories) to de-identify. | Usually irrelevant. The confidential thing is the substance, not the attribution. |
This is why the popular equation — "we redacted the names, so it's fine" — fails for consulting work. It imports a health-privacy release standard into a contract that never adopted it.
A worked example
Consider a sentence from a (synthetic) engagement deliverable:
"Acme Corp's launch price of $48,000 per course undercuts the market leader by 22%, based on the unpublished Phase III response rate of 61%."
Now remove the identifier, per the de-identification instinct:
"[COMPANY]'s launch price of $48,000 per course undercuts the market leader by 22%, based on the unpublished Phase III response rate of 61%."
Every confidential fact is still there: the price, the discount strategy, the unpublished trial result. Anyone in the field could re-identify the company from the numbers alone — and even if they couldn't, the NDA protects the numbers, not the name. The disclosure happened anyway.
The tooling gap this creates
Almost every AI-safety tool on the market is a privacy tool: it detects and masks PII/PHI — names, addresses, identifiers, the Safe Harbor list. That is genuinely useful for respecting the law and staying compliant, but it comes with two limits. First, stripping identifiers loses some information. Second — and more important for confidentiality — because only the names are de-identified, enough information is typically retained to reconstruct the secret or the important result, both for the AI and for any human reading the document. Removing the name does not remove the substance, and the substance is what the NDA protects.
The other instinct — redact everything sensitive, whatever it is — protects the NDA by destroying the work: a model reading "[REDACTED] undercuts [REDACTED] by [REDACTED]" has nothing to reason about.
Under blunt protection methods, AI output quality collapses: internal benchmarks measured roughly 37% of baseline writing quality after censoring-style redaction and 32% after random crypto-tokenization. Semantic cloaking — which preserves each value's meaning — retained 94–98%.
Source: Tremblay & Harricharan (2026), “Comparing De-identification Methods on AI Writing Quality in HEOR and Market Access,” Zenodo, doi:10.5281/zenodo.21343321. Composite writing-quality index, 30 tests per technique, rebalanced out of a 97% baseline.
What an NDA-compatible AI architecture requires is different from both: remove the values, keep the meaning — and do it with informative cloaks, not blanks. On the user's own computer, before anything is transmitted, "Acme Corp" becomes a name cloak with a stable identifier; the "$48,000" price becomes a semantic flag that tells the model the strategic posture of the pricing (a premium launch price positioned to undercut the leader) without ever revealing the number; and the "61%" response rate becomes a sequential flag the model can reference and reason with in the text, consistently, without knowing the value. The real values are restored locally when the answer comes back. The model does the work on the flags; the confidential values are never disclosed to it.
What this means in practice
- Audit your tooling against the right framework. "PII redaction" on a vendor's feature list addresses privacy law, not your NDAs. Ask how it treats a pricing figure or an unpublished clinical-study-report datapoint, not a phone number.
- Treat "de-identified" claims as the start of the analysis, not the end. The question a client's counsel will ask is whether confidential substance was disclosed — not whether names were removed.
- Demand evidence, not policy. An architecture in which the model never receives confidential values, backed by a serious audit trail, can prove what was sent. A policy that people promise to follow cannot.
Frequently asked questions
Does removing names make client data safe to put into AI?
No. Names are one kind of confidential value, not the definition of confidentiality. A cost model, an unpublished trial endpoint, or a pricing strategy is confidential in itself under an NDA — removing the names attached to it does not release it from the agreement.
Does HIPAA Safe Harbor de-identification satisfy an NDA?
Not in general. Safe Harbor is a health-privacy standard: it removes 18 categories of identifiers so that information no longer relates to an identifiable person. An NDA protects information itself — trade secrets, business terms, unpublished results — regardless of whether any person is identifiable. The two frameworks answer different questions, and satisfying one does not satisfy the other.
What is the difference between privacy and confidentiality?
Privacy is about persons: it restricts the use of information that identifies or relates to an individual, and it is governed by laws like HIPAA, GDPR and PIPEDA. Confidentiality is about obligations: it restricts disclosure of information you agreed to protect, whoever it concerns, and it is governed by contracts — NDAs, engagement letters, employment terms. AI tools built for privacy (PII/PHI redaction) do not automatically address confidentiality.
What is semantic cloaking?
Semantic cloaking replaces each confidential value in a text with an informative marker — one that preserves the value's role and meaning for reasoning — before the text leaves the user's computer. The AI model receives only the cloaked text and never the underlying value; the real values are restored locally for the human operator. Unlike redaction, the model can still reason about the document; unlike fixed-identifier tokenization, it applies to any confidential value, not a fixed list of 18.
How much AI output quality is lost when data is de-identified?
It depends on the method. Blunt redaction and random tokenization destroy the context a model needs — internal benchmarks put retained writing quality near a third of baseline. Semantic cloaking, which preserves each value's meaning, retains roughly 95% of output quality (Tremblay & Harricharan, 2026). The method, not the principle, determines the cost.
This guide is general information about how AI tools interact with confidentiality obligations. It is not legal advice, and it does not create any professional relationship. Confidentiality agreements vary — review your own agreements with qualified counsel before relying on any framework described here.
Work with AI on data you can't share with it.
Untraceable cloaks confidential values on your computer before any AI model sees the text — the model never receives the secret at all.