# How to redact PII and PHI before it reaches an LLM

DevFeed: [How to redact PII and PHI before it reaches an LLM](<https://devfeed.tech/articles/how-to-redact-pii-and-phi-before-it-reaches-an-llm-103577.md>)

Original publisher: [Read original article](<https://www.lyzr.ai/blog/redact-pii-and-phi-before-it-reaches-an-llm/>)

Author: Lyzr Team

Published: 2026-10-28T07:44:04Z

Content type: tutorial

Language: en

Sources: [Lyzr.ai](<https://devfeed.tech/sources/lyzr-ai.md>)

Topics: [pii](<https://devfeed.tech/topics/pii.md>), [LLM security](<https://devfeed.tech/topics/llm-security.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>)

Tags: [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [llm](<https://devfeed.tech/tags/llm.md>), [pii](<https://devfeed.tech/tags/pii.md>)

## AI overview

Redacting prompts alone does not protect PII and PHI: identifiers can also leak through model responses, tool calls, streams, logs, or agents that bypass the checks. The excerpt recommends layered detection--validated regex for structured values, named entity recognition for names and places, and custom health-record rules for identifiers such as MRNs and care-related dates--followed by typed placeholders. If values must be restored, use random session-scoped tokens with mappings kept in an encrypted vault; hashes may remain personal data, and HIPAA bars re-identification codes derived from the person's information. Run detection within the trust boundary or under the same BAA and region, and apply checks to inputs and outputs through a single gateway. Test misses by identifier type with labeled examples, begin new rules in log-only mode, and rerun evaluations when detectors, prompts, or models change. The excerpt notes that NER can miss sensitive data or misclassify entities, so review and tuning remain necessary.

## Source excerpt

TL;DR Your discharge-summary agent is live. A nurse pastes in a note: "Pt in 412, MRN 0048291, daughter Priya called re: d/c on 3/14, cb...