PHI detection tools compared

What are the main PHI detection tools?

The main PHI detection tools fall into three groups. Cloud APIs from AWS, Microsoft, and Google detect or de-identify the text you send them. Presidio, Limina (formerly Private AI), and John Snow Labs run inside your own infrastructure. Nightfall and Arcjet act on data in motion, including AI agents: Nightfall as a data loss prevention platform, Arcjet as a decision on each agent action.

Protected health information (PHI) is health information that can be linked to a specific person, such as a diagnosis next to a patient's name or medical record number (MRN). The HIPAA Privacy Rule governs how covered entities (health plans, clearinghouses, and providers that conduct standard transactions, such as billing, electronically) and their business associates (vendors that handle PHI for them) use it. A business associate agreement (BAA) is the contract HIPAA requires between the two, under 45 CFR 164.502(e) and 164.504(e).

Several of these tools de-identify text, which Arcjet doesn't do, and each section says when that tool is the better choice. Arcjet publishes this comparison. Competitor details come from each vendor's public documentation, checked on November 6, 2026. This is technical guidance, not legal advice.

What's the difference between detecting, redacting, and de-identifying PHI?

Detecting PHI finds identifiers and reports their type and position. Redacting replaces or removes them. De-identifying is a legal standard: under 45 CFR 164.514(b), health information is de-identified when an expert determines that the risk of identifying anyone is very small, or when all 18 Safe Harbor identifier classes are removed and you have no actual knowledge that the rest could identify the person.

Safe Harbor requires removing dates related to a person other than the year, ages over 89, and "any other unique identifying number, characteristic, or code," not only names and MRNs. Text with masked names and phone numbers can still be PHI. HHS's de-identification guidance explains both methods.

A detector that feeds an allow or deny decision is a third approach. It leaves the text alone and stops the action that would have sent it somewhere, such as an agent posting a discharge summary to a third-party API. No detector, Arcjet's included, makes a system HIPAA compliant on its own.

How do PHI detection tools compare?

The tools differ most on where the text goes and what comes back. Five of the eight send text to a vendor's cloud for at least part of the work, and three keep it in your environment. The following table summarizes where each runs, its BAA status, what it does, and how it fits an agent's tool call.

What does Amazon Comprehend Medical DetectPHI do?

Amazon Comprehend Medical is an AWS API for clinical text. Its DetectPHI operation returns each PHI entity with a type, character offsets, and a confidence score, and your code does any redaction. AWS lists it as a HIPAA Eligible Service, usable for PHI once your account accepts the AWS BAA.

DetectPHI returns nine types: NAME, AGE, DATE, ADDRESS, PHONE_OR_FAX, EMAIL, URL, PROFESSION, and ID. The ID type groups Social Security numbers, MRNs, health plan numbers, license numbers, and vehicle and device numbers, so the type alone can't tell an MRN from a pacemaker serial number. AWS says its types don't map one to one onto Safe Harbor, and the list has no IP address type. It reads US English only.

AWS states that the service doesn't persistently store customer content, and it recommends human review for compliance use cases. Comprehend Medical fits teams on AWS that want a managed clinical model and will write their own redaction step.

What does Azure AI Language detect for PHI?

Azure AI Language PII detection finds and redacts personal data in text, conversations, and documents, and its API takes a phi domain value for health information. Microsoft also runs a de-identification service in Azure Health Data Services, built for clinical text, that tags PHI, redacts it, or replaces it with realistic surrogates.

The Language API's redaction policies mask characters by default, can substitute the entity type, such as [PERSON_1], and offer synthetic replacement in preview. A PII container runs on your hardware and still connects to Azure for billing, unless Microsoft approves it for disconnected use.

The Health Data Services service is the closer fit for clinical notes. Microsoft says it covers 27 entities, including the 18 HIPAA identifiers, tells doctors from patients, and replaces values consistently within a batch so patient timelines survive. Microsoft offers its HIPAA BAA through the Product Terms for in-scope services, so confirm the specific service is in scope before you send PHI.

How do Google Sensitive Data Protection and the Healthcare API handle PHI?

Google Cloud has two PHI tools. Sensitive Data Protection inspects and de-identifies content with detectors that Google calls infoTypes. The Cloud Healthcare API de-identifies whole FHIR stores (health records in the Fast Healthcare Interoperability Resources format) and DICOM stores (medical images). Google's HIPAA page lists both as covered by its BAA.

The infoTypes reference includes MEDICAL_RECORD_NUMBER, US_MEDICARE_BENEFICIARY_ID_NUMBER, DATE_OF_BIRTH, IMEI_HARDWARE_ID, and US_VEHICLE_IDENTIFICATION_NUMBER. De-identification transformations include redaction, replacement, masking, pseudonymization by cryptographic hashing, and date shifting, which moves dates by a random number of days while keeping their order.

The Healthcare API removes DICOM tags, uses optical character recognition to redact text burned into images, and strips sensitive values from FHIR resources.

What does Presidio do for PHI?

Presidio is an open source library that detects personal data in text and images and anonymizes it, in your own process or containers. It started at Microsoft and moved to Data Privacy Stack, a community-governed project under the MIT license. No vendor receives the text, so the BAA question shifts to wherever you host it.

The anonymizer replaces, redacts, masks, hashes, or encrypts findings. The built-in entities include PERSON, LOCATION, DATE_TIME, US_SSN, US_MBI, and US_HEALTH_INSURANCE_MEMBER_ID, but no MRN, so you write a custom recognizer for your hospital's format. An image redactor handles images and DICOM files.

Presidio's documentation says there's no guarantee it finds all sensitive information. Because it's a library, you choose where to call it, such as before a model request or behind a proxy like LiteLLM, and you own its accuracy, hosting, and upgrades.

How does Nightfall detect PHI?

Nightfall is a data loss prevention (DLP) platform, a category of software that recognizes sensitive data and stops it from going where it shouldn't. It scans SaaS apps, email, endpoints, browsers, and AI tools, and its developer APIs scan text and files in Nightfall's cloud. Its healthcare page says "Nightfall signs BAAs."

Nightfall's PHI detector flags text only when an identifier appears with a health indicator. The identifier can be an SSN, a Medicare Beneficiary Identifier, a device identifier, or a name with a date of birth or street address. The indicator can be an ICD-10 code, a National Provider Identifier, or an FDA drug name. A name alone doesn't match.

Nightfall also covers coding agents. Its IDE hooks block a prompt, tool call, or shell command on Claude Code, Cursor, VS Code Copilot, and OpenAI Codex, on devices running the Nightfall agent. On macOS and Windows, except with VS Code Copilot, they can withhold a blocked MCP tool response before the model reads it. Arcjet can't do that. For details, see Nightfall vs Arcjet.

What does Limina (formerly Private AI) do with PHI?

Limina is the de-identification engine previously sold as Private AI. The private-ai.com domain redirects to getlimina.ai, and the Limina docs still name Private AI's detection engine. It runs as a container in your VPC or data center and detects, redacts, or replaces PHI with synthetic values in text and files.

Limina's entity list tags more than 50 types against regulations, including HIPAA Safe Harbor. HEALTHCARE_NUMBER covers MRNs, health plan numbers, and member IDs, and DOB, AGE, and VEHICLE_ID cover other Safe Harbor classes. A reidentify route restores original values in a model's response after you send a redacted prompt. Its public pages don't mention a BAA, and its site says your data never leaves your infrastructure.

What does John Snow Labs Healthcare NLP de-identify?

John Snow Labs sells Healthcare NLP, a licensed library of clinical language models, and a de-identification pipeline built on it. The pipeline runs inside Databricks, Snowflake, AWS, Azure, your own data center, or an air-gapped network, over clinical notes, scanned PDFs, DICOM images, FHIR resources, and tables.

It masks values, replaces them with realistic fakes, shifts dates while keeping intervals, and tokenizes identifiers. Replacements are deterministic, so one patient gets the same surrogate across every note. John Snow Labs says all 18 Safe Harbor categories are automated, and the page doesn't mention a BAA. This is the tool for de-identifying years of historical notes for a research dataset, not for sitting in an agent's request path.

How does Arcjet detect PHI on an agent's action?

Arcjet doesn't redact or de-identify. It detects PHI identifiers in an AI agent's prompt or tool call and returns a decision to allow or deny that action. The same policy model covers agents you build, through guard() in your code, and Claude Code, GitHub Copilot, Cursor, OpenAI Codex, and Muse Code, through the hooks those agents already fire.

A policy is a set of rules, written in Rego (the Open Policy Agent policy language) or a visual builder, that Arcjet evaluates on each call. A detector is a check that a policy runs on an input. A hook is a point where a coding agent pauses to report a prompt or tool call and waits for an answer.

Arcjet detects 25 entity types. Twenty core types, such as names, addresses, phone numbers, and SSNs, can run in your process through the SDK's local detector. The five PHI types, including MEDICAL_RECORD_NUMBER and HEALTH_PLAN_BENEFICIARY_NUMBER, run only in the server-side detector, so the value goes to Arcjet. An MRN has no fixed format, so Arcjet recognizes it from a label such as MRN next to the value.

Arcjet supports HIPAA compliance and offers a HIPAA-compliant environment. It enters into a BAA with Enterprise-level customers whose use involves PHI, and both parties must sign it before any PHI is processed. Using Arcjet for PHI without a signed BAA may leave your organization out of compliance. Arcjet removes a value that the server-side detector flags before storing the decision, and keeps only its entity type and position.

In your code, the check sits on the tool call. With a policy that denies PHI types in outbound notes, a support agent that copies a labeled member ID into a note for an external system is refused before the note leaves:

1
import { launchArcjet, policyInput } from "@arcjet/guard";
2

3
const arcjet = launchArcjet({ key: process.env.ARCJET_KEY! });
4

5
const decision = await arcjet.guard({
6
  label: "notes.send",
7
  actor: userId,
8
  inputs: {
9
    note: policyInput.server.string(note),
10
    external: policyInput.server.boolean(isExternal),
11
  },
12
});
13

14
if (decision.conclusion === "DENY" || decision.hasFailedOpen()) {
15
  // Refuse the tool call
16
}

Plan for the gaps. Arcjet doesn't cover dates, ages over 89, biometrics, photos, or other unique codes, and it matches account numbers only for bank accounts and license numbers only for driver's licenses. It doesn't decide whether the surrounding text is health information. On a coding agent, the hook that reports a tool result fires after the tool ran, so Arcjet can't withhold a fixture file of real patient rows the agent already read. Session analysis flags the session when the rows contain a type that the policy's detector denies. The starter's detector lists only card and Social Security numbers, so add the PHI types. The starter policy then refuses the agent's web and MCP calls (Model Context Protocol, how agents reach external tools). For more information, see PHI detection for AI agents.

Comprehend Medical vs Presidio: which should you use?

Choose Comprehend Medical when you run on AWS, want a managed model trained on clinical text, and accept sending PHI to AWS under its BAA. Choose Presidio when text can't leave your infrastructure, when you want redaction operators included, or when you need recognizers for your own identifier formats. Neither one decides what an agent may do.

How accurate are PHI detection tools?

No neutral, current benchmark compares these tools. Published comparisons come from vendors, at one point in time. John Snow Labs published a de-identification benchmark against AWS, Google Cloud, and Azure on June 9, 2022, and a 2026 benchmark on August 27, 2026 against OpenAI, Databricks, LLM APIs, and Presidio. The 2026 page takes its cloud API numbers from a 2023 peer-reviewed comparison, and the cloud models have changed since.

This page publishes no accuracy numbers for that reason. Build a test set from your own traffic, with real formats for your MRNs, member IDs, and note templates, and measure missed identifiers before you trust any tool, Arcjet included. Run Arcjet policies in dry run first, which logs what a rule would have denied without blocking.

Which is the best PHI redaction tool for your job?

The right tool depends on the job, because these products do different work. Use a de-identification pipeline for research datasets, a cloud API or Presidio for redaction in your own code, Nightfall for employee data movement across SaaS and endpoints, and Arcjet for allow or deny decisions on agent actions.

The following list matches common jobs to tools:

• Batch de-identification of clinical notes for research or model training: John Snow Labs, the Azure Health Data Services de-identification service, Limina, or the Google Healthcare API for FHIR and DICOM. This isn't Arcjet's job.
• Detection or redaction in an application hosted in a cloud where you already have a BAA: Comprehend Medical, Azure AI Language, or Sensitive Data Protection.
• Redaction that stays inside your network with no license fee: Presidio.
• PHI in Slack, Google Drive, email, and ChatGPT prompts across the company: Nightfall.
• A decision on whether an agent's tool call or prompt goes ahead, with one policy across your own agents and coding agents: Arcjet.

The approaches combine. A team can redact notes with Presidio before a model call and have Arcjet deny the outbound tool call that carries an MRN the redaction missed. For the regulatory side, see HIPAA compliance for AI agents and how to stop AI agents leaking PHI.

What are the alternatives to Nightfall for PHI?

Alternatives to Nightfall depend on which part you replace. For its scan-and-redact API, the cloud APIs, Presidio, and Limina cover the same ground. For agent controls, Arcjet decides on tool calls in your code and in the hooks of five coding agents without an endpoint agent. For guardrail frameworks in clinical chat, see healthcare AI guardrails compared.