MedDeID enables locally governed clinical-text de-identification from real or synthetic training data

# MedDeID enables locally governed clinical-text de-identification from real or synthetic training data
Source: [https://arxiv.org/html/2609.10049](https://arxiv.org/html/2609.10049)
Authors:Stig Hellemans1,3,\*, Tom Stroobants2,3, Elyne Scheurwegs3, Pieter Meysman1, Philippe G\. Jorens2,3, Kris Laukens1

Affiliations

1. 1\.Adrem Data Lab, Department of Computer Science, University of Antwerp, Antwerp, Belgium
2. 2\.Laboratory of Experimental Medicine and Pediatrics \(LEMP\), University of Antwerp, Antwerp, Belgium
3. 3\.Antwerp University Hospital \(UZA\), Edegem, Belgium

\*Correspondence: stig\.hellemans@uantwerpen\.be

### Abstract

Clinical notes contain personally identifiable information \(PII\), restricting reuse for research and medical AI, especially when data cannot leave an institution\. We developed MedDeID, an on\-premises framework combining in\-house annotation and synthetic\-note generation with model training, inference, pseudonymisation and evaluation\. On an independently annotated, adjudicated 300\-note Dutch hospital benchmark, a hospital\-trained compact transformer detected 98\.9% of identifying text while redacting 0\.24% of text outside annotated identifiers; a synthetic\-only counterpart detected 96\.1%\. On 100 primary\-care notes, the synthetic\-trained model achieved higher recall than the hospital\-trained model \(90\.3% versus 87\.0%\) and greater robustness to identifier\-format perturbations\. An English instantiation trained without real text detected 99\.7% and 98\.9% of annotated identifier characters on two external synthetic benchmarks\. These results demonstrate transfer of the workflow to another language, but not clinical English performance\. MedDeID provides a route to locally governed de\-identification using real or synthetic training data\.

### Introduction

The unstructured free text of the electronic health record — admission documentation, discharge letters, progress notes, consultation reports — is the location where clinicians record the reasoning, history and nuance that structured fields cannot capture\. It is therefore among the most valuable substrates for clinical research and for developing and evaluating medical artificial intelligence[1](https://arxiv.org/html/2609.10049#bib.bib1)\. Moreover, it is saturated with personally identifiable information \(PII\)\. Under the EU General Data Protection Regulation, processing health data for scientific research requires a lawful basis, an applicable Article 9 condition and appropriate technical and organisational safeguards\. Article 89 specifically requires safeguards for research, including data minimisation and, where the purposes can be fulfilled, pseudonymisation[2](https://arxiv.org/html/2609.10049#bib.bib2),[3](https://arxiv.org/html/2609.10049#bib.bib3)\. In the United States, the HIPAA Privacy Rule provides Safe Harbor and Expert Determination routes for de\-identification[5](https://arxiv.org/html/2609.10049#as1_bib.bib5)\. De\-identification is therefore a key safeguard for secondary uses of clinical free text\. The task extends beyond removing obvious identifiers: both direct identifiers, such as a patient’s name, and indirect \(or quasi\-\) identifiers, such as age, postal code or admission date, may reveal an individual’s identity and therefore fall within scope[3](https://arxiv.org/html/2609.10049#bib.bib3),[5](https://arxiv.org/html/2609.10049#bib.bib5)\.

English\-language systems have reached both benchmark maturity and production scale\. The i2b2/UTHealth shared tasks established a shared vocabulary for protected health information \(PHI\)[6](https://arxiv.org/html/2609.10049#bib.bib6),[7](https://arxiv.org/html/2609.10049#bib.bib7); neural sequence models pushed entity\-level F1 into the high nineties[8](https://arxiv.org/html/2609.10049#bib.bib8),[9](https://arxiv.org/html/2609.10049#bib.bib9),[10](https://arxiv.org/html/2609.10049#bib.bib10); and Philter, an openly released rule\-based system[11](https://arxiv.org/html/2609.10049#bib.bib11), was subsequently certified by external audit and scaled at the University of California, San Francisco, where it has placed more than 130 million de\-identified notes from 2\.75 million patients in the hands of over 600 researchers without further ethics review[12](https://arxiv.org/html/2609.10049#bib.bib12)\. That audit found no residual identifiers in any of the seventeen non\-date HIPAA categories and estimated that fewer than 0\.025% of patients remained at risk of re\-identification through shifted dates[12](https://arxiv.org/html/2609.10049#bib.bib12)\. Philter is the reference example of what a deployable, openly available de\-identification system makes possible[11](https://arxiv.org/html/2609.10049#bib.bib11)\.

The situation for Dutch and Flemish clinical text, and by extension for most non\-English settings, is very different, and the deficit is not merely one of effort\. De\-identification is inherently language\-specific: identifiers are expressed through language\-dependent patterns, including local lexicons, name morphology, date and address conventions, and the shorthand style of clinical documentation, all of which limit the transferability of methods developed for other languages\. The principal rule\-based Dutch tool, DEDUCE, was carefully hand\-built for a single institution and achieves high recall there[13](https://arxiv.org/html/2609.10049#bib.bib13), but rule systems of this kind generalise poorly: Trienes and colleagues showed that an existing Dutch rule\-based method failed on new data, whereas a state\-of\-the\-art neural architecture generalised across institutions and domains with far less configuration effort[14](https://arxiv.org/html/2609.10049#bib.bib14), and a 2025 replication study confirmed the variability of these tools across settings[15](https://arxiv.org/html/2609.10049#bib.bib15)\. Dutch clinical language models — MedRoBERTa\.nl, pre\-trained on real hospital notes, and the general\-purpose RobBERT family — provide practical encoder backbones for compact Dutch de\-identifiers[16](https://arxiv.org/html/2609.10049#bib.bib16),[17](https://arxiv.org/html/2609.10049#bib.bib17),[8](https://arxiv.org/html/2609.10049#as1_bib.bib8)\. In parallel, a wave of work applies generative large language models to de\-identification with impressive recall in favourable conditions[19](https://arxiv.org/html/2609.10049#bib.bib19),[20](https://arxiv.org/html/2609.10049#bib.bib20),[21](https://arxiv.org/html/2609.10049#bib.bib21),[22](https://arxiv.org/html/2609.10049#bib.bib22),[23](https://arxiv.org/html/2609.10049#bib.bib23),[24](https://arxiv.org/html/2609.10049#bib.bib24); however, the LLM evaluated here was substantially slower than the compact local model and remained brittle to the structured formatting of real notes\.

Two further gaps compound the first\. Public real\-data benchmarks for Dutch clinical de\-identification remain unavailable, so groups evaluate on inaccessible local corpora and independent reproduction is difficult[25](https://arxiv.org/html/2609.10049#bib.bib25)\. Synthetic pre\-training, diversity\-aware data construction and teacher–student distillation are emerging as routes around the same bottleneck in English and French[26](https://arxiv.org/html/2609.10049#bib.bib26),[27](https://arxiv.org/html/2609.10049#bib.bib27), but their benefit depends on training regime and evaluation domain\. Existing systems also often stop at detection, ignoring what healthcare institutions need from pseudonymisation: dates must be shifted so that clinical chronology survives, and ages must be reduced to the coarsest granularity that still carries clinical meaning\. Collapsing a two\-month\-old infant to “0 years old”, for example, destroys information a paediatrician needs and creates an avoidable trade\-off between re\-identification risk and clinical value\.

This study addresses three challenges across languages and clinical settings: poor transfer of de\-identification systems, restrictions on sharing clinical text for model development and evaluation, and loss of useful information during pseudonymisation\. MedDeID responds with a locally deployable workflow that supports training on local annotations or synthetic notes, evaluation on shareable synthetic benchmarks, and clinically informed date and age pseudonymisation\. To compare real\-data and synthetic\-only training on authentic Dutch clinical text, we trained two independent models with the same compact architecture: one on annotated hospital notes and the other exclusively on synthetic Dutch notes, and evaluated both on held\-out hospital and primary\-care notes\. We then reuse MedDeID to train a separate English model exclusively on synthetic English data, testing whether researchers and healthcare institutions can adapt the framework to another language rather than rebuild the entire workflow\. This does not involve transfer from the Dutch models or establish performance on real English clinical text\. Across both language instantiations, MedDeID uses a common schema, character offsets, post\-processing, pseudonymisation rules, and evaluation contract\. Core PII recall measures the percentage of genuinely identifying characters detected, while non\-PII redaction measures the clinical text removed outside annotated spans\.

### Results

#### Evaluation datasets and clinical benchmarks

Table 1 summarises six data resources divided into nine non\-overlapping training and evaluation partitions\. Clinical performance was assessed on two real Dutch benchmarks: a held\-out, independently annotated and adjudicated hospital set \(n=300\) and a separately annotated primary\-care set \(n=100\)\. The Dutch synthetic benchmark provides a shareable test of the complete workflow, whereas the three entirely synthetic English benchmarks test whether the workflow can be reproduced in another language; they do not establish performance on real English clinical text[28](https://arxiv.org/html/2609.10049#bib.bib28),[29](https://arxiv.org/html/2609.10049#bib.bib29)\. No evaluation data were used for model training\. The hospital and primary\-care gold standards contained 4,269 and 4,010 PII annotations, respectively; annotation volume, density and mapped category composition across all six benchmarks are compared in Supplementary Fig\. S1\. Full data, annotation and evaluation procedures are reported in Methods and Supplementary Sections S1–S3\.

#### Performance on the Dutch hospital benchmark

We trainedmeddeid\-dutch\-uzaon a separate corpus of 4,470 annotated development notes from Antwerp University Hospital \(UZA\)\. On the 300\-note hospital benchmark, core PII recall was 98\.9% \(98\.5–99\.3%; Table 2\)\. Non\-PII redaction was 0\.24% \(0\.16–0\.32%\)\. The model uses a RobBERT\-2023 Dutch encoder[8](https://arxiv.org/html/2609.10049#as1_bib.bib8)with dual heads for token\-level span boundaries and span labels, followed by MedDeID’s post\-processing layer \(Fig\. 1\)\. Annotator 1 reached 98\.8% recall at 0\.17% non\-PII redaction and Annotator 2 98\.5% at 0\.36%\. The model’s recall was therefore 0\.1–0\.4 percentage points higher, while its non\-PII redaction rate lay between the two annotators\. These values place the model within the range observed for the annotators on this benchmark\. Because the annotators helped create the adjudicated reference standard, this comparison does not show that the model is better than, or equivalent to, physicians\.

Every external comparator was substantially further back\. Our upgraded Belgian DEDUCE reached 88\.0% recall, the previously published Dutch de\-identification modeldeidentify, 86\.4%[14](https://arxiv.org/html/2609.10049#bib.bib14), and a locally deployed large language model \(Qwen3\-8B\)[30](https://arxiv.org/html/2609.10049#bib.bib30)84\.2%\. A zero\-shot NER model for personally identifiable information \(PII\), GLiNER\-PII, reached 76\.6%[31](https://arxiv.org/html/2609.10049#bib.bib31), the original Dutch DEDUCE 75\.9%[13](https://arxiv.org/html/2609.10049#bib.bib13), and two general\-purpose neural PII detectors reached 72\.1% \(OpenAI\) and 49\.1% \(OpenMed\)\. These differences varied by identifier category and by the components within annotated identifier spans \(Supplementary Table S5 and Figs S2–S3\)\.

Higher recall did not require excessive non\-PII redaction\. Using the complete MedDeID pipeline,meddeid\-dutch\-uzaredacted 0\.236% of characters outside gold spans, below every other evaluated model and between the two annotators \(0\.174–0\.359%\);deidentify, for comparison, redacted 0\.558% \(Table 2\)\. Of the 1,236 non\-PII characters redacted bymeddeid\-dutch\-uza, 353 came from entirely incorrect detections\. The remaining 883 were extra characters at the edges of detected PII\. Thus, most over\-redaction reflected imprecise span boundaries rather than spurious detections \(Supplementary Table S4a\)\.

The MedDeID pipeline can also use patient and caregiver names stored in note metadata\. This increased the hospital\-trained model’s recall only marginally \(98\.8% to 98\.9%\) but raised Belgian DEDUCE’s recall from 78\.5% to 88\.0%\. Because metadata availability may differ across institutions, results with and without this step are reported in Supplementary Table S4a; all main\-text results use the complete MedDeID pipeline*with*metadata included\.

#### Synthetic training and cross\-setting performance

We trainedmeddeid\-dutch\-synthentirely on synthetic text, without using real patient data \(Table 1; Methods\)\. On the real hospital benchmark, it reached 96\.1% core PII recall — 2\.8 percentage points below the hospital\-trained model \(2\.2–3\.5\), but above every external comparator we tested \(Table 2\)\. For a site that cannot assemble a labelled corpus, this provides an open starting point for local deployment and fine\-tuning\.

We validated all systems on 100 general\-practice notes from a Belgian primary\-care practice, annotated and sub\-annotated by one physician\-researcher against the same guideline\. Every system achieved lower core PII recall on the primary\-care benchmark than on the hospital benchmark \(Table 2\)\. On these notes, the synthetic\-trained model had higher recall than the hospital\-trained model \(90\.3% versus 87\.0%\), a difference of 3\.3 percentage points \(1\.7–5\.2\)\. The largest hospital\-to\-primary\-care difference among the neural systems was observed for the local LLM \(84\.2% versus 60\.8%\); the original DEDUCE reached 75\.9% and 57\.2%, respectively\.

Among the identifier spans detected by the models, the hospital\-trained model assigned the correct identifier category in 98\.9% of cases on hospital notes and 89\.8% on primary\-care notes\. The corresponding values for the synthetic\-trained model were 92\.6% and 79\.3% \(Supplementary Table S6 and Fig\. S4\)\.

Thus, after detecting a span, the synthetic\-trained model was less reliable than the hospital\-trained model at assigning the correct identifier category in both care settings\.

Non\-PII redaction differed even more sharply on primary\-care notes\. The OpenAI neural PII detector redacted 11\.46% of all characters outside gold spans and the OpenMed detector 8\.25%, against 0\.29% for the hospital\-trained model and 1\.22% formeddeid\-dutch\-synth\(Table 2\)\. Supplementary Fig\. S10 shows how these redacted characters were distributed across the PII categories predicted by each system\. Such rates indicate substantial loss of research\-relevant text, a failure mode that recall\-only comparisons do not capture\.

On the openly released synthetic benchmark,meddeid\-dutch\-synthreached 99\.8% core PII recall \(99\.5–100\.0%\) with 0\.28% non\-PII redaction \(0\.21–0\.35%\)\. The hospital\-trained model reached 96\.6% recall on this set, 2\.3 points below its hospital result\. The publisheddeidentifybaseline reached 76\.7% core PII recall with 0\.37% non\-PII redaction, whereas Qwen3\-8B reached 90\.9% recall with 1\.28% non\-PII redaction\. The benchmark therefore provides a public, reproducible test of the complete workflow, but its in\-domain scores are neither evidence of model superiority nor estimates of performance on real clinical text\.

#### Performance on English synthetic benchmarks

To test whether MedDeID’s workflow was not only specific to Dutch, we instantiated it with separate British\- and American\-English profiles\. This produced a distinct English model, trained exclusively on synthetic English text; it was not obtained by transferring the Dutch model\. We evaluated it on two independently sourced external synthetic benchmarks \(Table 3\): the Technetium\-I test split, containing 74,700 multi\-section clinical notes and 1,161,437 annotations, and ASQ\-PHI \(Adversarial Synthetic Queries for Protected Health Information\), containing 1,051 queries and 2,973 annotations[28](https://arxiv.org/html/2609.10049#bib.bib28),[29](https://arxiv.org/html/2609.10049#bib.bib29)\.

On Technetium\-I, MedDeID achieved 99\.730% annotation\-character recall \(99\.725–99\.735%\), the highest among the seven systems\. GLiNER, the next\-highest comparator, achieved 97\.773% \(97\.754–97\.791%\); the difference was 1\.957 percentage points \(1\.940–1\.975\)\. MedDeID’s non\-PII redaction rate was 1\.606% \(1\.605–1\.608%\)\.

On ASQ\-PHI, MedDeID achieved 98\.9% annotation\-character recall \(98\.6–99\.2%\), the highest among the seven evaluated systems\. GLiNER, the next\-highest recall comparator, achieved 96\.3% \(95\.8–96\.8%\); the difference was 2\.58 percentage points \(2\.06–3\.12\)\. Its raw non\-PII redaction was 6\.21% \(5\.99–6\.43%\)\. ASQ\-PHI leaves explicit ages below 90 unannotated, so detecting such ages increases the reported non\-PII redaction rate\. We therefore recalculated this rate for every system after excluding the same age characters, regardless of which label a system assigned\. After excluding these ages, MedDeID’s rate was 0\.89% \(0\.75–1\.03%\), second to OBI RoBERTa i2b2 at 0\.55% \(0\.45–0\.66%\); the other comparator estimates ranged from 1\.18% to 4\.29% \(Supplementary Table S12\)\.

The two benchmarks provide complementary tests: Technetium\-I covers structured clinical\-note formats at scale, whereas ASQ\-PHI focuses on adversarial queries and hard negatives\. Consistently high recall across both supports the feasibility of training a competitive English de\-identifier entirely from synthetic data\. Because both benchmarks are themselves synthetic, however, these results do not establish performance on authentic English clinical notes or clinical safety in an English\-language health system\. Nor do they test cross\-language transfer, because the English model was trained separately\. Confidence intervals for the external benchmarks in Table 3 and the separate held\-out MedDeID English benchmark are reported in Supplementary Tables S11–S13\.

#### Robustness to formatting and value perturbations

To assess how sensitive the models were to identifier values and formatting, we selected 100 notes from each of the three test sets \(300 notes in total\)\. We then changed one feature at a time — the names used, name capitalisation, name format, date format, date value or age format — and measured the resulting change in recall relative to the unmodified notes \(Fig\. 2\)\. Supplementary Figs S5–S9 and Tables S7b–d provide the detailed results\.

Changing which names appeared did not significantly reduce recall after correction, suggesting that neither model depended strongly on the particular names in the test notes\. Changes to formatting and date values had larger effects, especially for the hospital\-trained model\. Its largest recall loss was 19\.2 points when patient\-name formatting was altered on the synthetic benchmark, whereas the synthetic\-trained model’s largest loss in any setting was 4\.6 points under primary\-care caregiver\-name capitalisation \(Supplementary Fig\. S9 and Table S7d\)\.

Overall, the synthetic\-trained model was more stable across the three test sets: the mean positive recall loss, with improvements counted as zero, was 1\.25 points, compared with 2\.96 points for the hospital\-trained model, and fewer perturbations produced statistically significant losses \(5 versus 7; Fig\. 2 and Supplementary Table S7b\)\. This pattern appeared in each test set, although the synthetic\-trained model was not better under every individual perturbation\. Sensitivity to date values remains practically important because date distributions vary across settings and evolve over time; a deployable de\-identifier should remain reliable beyond the date range represented in its training data\.

#### Pseudonymisation validity and retained clinical detail

Detection is only half of what a healthcare institution needs\. After the detection and post\-processing stages shown in Fig\. 1, MedDeID applies a separate substitution step designed to retain clinical meaning\. Dates are first normalised: a model that detects the day and month of a date but misses the year leaves a residual identifier, so partially recognised dates are healed to their full extent using the regular formats in which dates appear\. Exact dates belonging to one patient are then shifted by a single patient\-specific offset, preserving every interval between events while breaking the absolute timeline\. Date\-like expressions with a resolution coarser than one day, such as “May 2023” or “summer”, are represented as the complete interval of calendar dates compatible with the text; both interval bounds are shifted, and the output is widened only when the shifted interval crosses a boundary at the source resolution\. For illustration, a\+10\+10\-day shift — chosen for clarity, not as a recommended production offset — changes “May 2023” \(1–31 May\) to “May/June 2023” because the shifted interval \(11 May–10 June\) spans two months\. This avoids imputing an arbitrary day, false precision and the resulting directional bias\. How the offset is used also affects privacy\. Operational safeguards and the residual re\-identification risk of shifted dates are discussed below and specified in Methods\.

Age and birth\-date reduction is likewise age\-dependent: whole years suffice for older patients, whereas progressively finer units are retained for younger children and neonates\. The retained level of detail for each age group is reported in Supplementary Table S10b\. This avoids discarding clinically relevant paediatric age information\.

We evaluated MedDeID’s pseudonymisation layer separately from PII detection by applying it to every gold date and age/birthdate span with a fixed 371\-day shift and checking whether each output satisfied the intended transformation\. Gold\-span transformation\-layer failure rates were 0\.0% \(0/1,693\) on synthetic text, 0\.8% \(14/1,798\) on hospital text and 3\.0% \(36/1,219\) in primary care\. When model\-predicted spans were used instead, end\-to\-end failure rates were 1\.5%, 3\.4% and 6\.0%, respectively; the rates of gold spans with unredacted characters were 0\.7%, 2\.2% and 2\.4% \(Supplementary Table S10a and Fig\. S11\)\. Most gold\-span transformation failures reflected unsupported or invalid source formats, identifying a remaining portability gap in the pseudonymisation layer rather than the detector\.

#### Inference time on GPU and CPU hardware

The practical case for a compact model is sharpest on compute\. In the measured timing runs, de\-identifying the 300\-note hospital set took the local large language model 11,411\.5 s \(3 h 10 min\), against 18\.4 s for the hospital\-trained model on the same NVIDIA T4 — a 621\-fold wall\-time difference \(Fig\. 3\)\. More consequential for local deployment in healthcare institutions, the hospital\-trained model completed the same set in 320\.3 s \(5\.3 min\) on CPU alone, roughly 36 times faster than the GPU\-based LLM run, and the CPU\-only Belgian DEDUCE finished in 17\.9 s\. The CPU result shows that smaller datasets or routine local batches can be processed without dedicated GPU infrastructure; for millions of archived notes, we recommend GPU acceleration \(Fig\. 3\)\. The larger general\-purpose neural PII detectors were slower than our compact transformer and achieved substantially lower recall across all three evaluation datasets\.

#### Deployment and local governance framework

The empirical comparisons establish two complementary starting points: the hospital\-trained model defines the attainable in\-domain level of performance, while the synthetic\-trained model can be deployed or adapted without access to our clinical training data\. MedDeID connects these routes in one reproducible framework \(Fig\. 4\)\. A shared core contract keeps the taxonomy, JSONL document schema, character offsets and post\-processing consistent across synthetic\-data generation, human annotation, model training, inference and evaluation\. Healthcare institutions can therefore begin with the open synthetic\-trained model, generate additional synthetic examples, or annotate local notes and fit a site\-specific model without exporting the source text or resulting weights\.

The same contract also links prediction data to a curated and sub\-annotated benchmark, allowing evaluation to guide further annotation, data generation and model refinement\. Users who only want to de\-identify text need the localmeddeidpackage and a compatible model\. The other MedDeID components allow healthcare institutions to build, evaluate and refine their own models reproducibly\. Belgian DEDUCE provides a directly usable CPU baseline and Belgian lookup foundations\. Together, MedDeID and Belgian DEDUCE give healthcare institutions practical tools to deploy and adapt a de\-identifier locally, without sending clinical notes or locally trained model weights outside the institution\.

### Discussion

This study contributes both an empirical result and a reusable framework for acting on it\. The central empirical finding is that synthetic\-only training provides a reproducible route to a compact Dutch de\-identifier evaluated on real hospital and primary\-care text\. The hospital\-trained model reached the range observed for the two physician annotators on the hospital benchmark, while its non\-PII redaction rate lay between theirs\. On the notes from the primary\-care practice, the synthetic\-trained model had higher recall than the hospital\-trained model \(90\.3% versus 87\.0%; 3\.3 percentage points\)\. Both model variants exceeded the other data\-driven and rule\-based approaches tested and ran locally on commodity hardware\. MedDeID translates these findings into a common workflow for annotation or synthetic\-data generation, training, local inference and benchmarking\. Because these stages share versioned interfaces, language profiles, datasets and models can be replaced without rebuilding the full workflow, supporting reuse and audit across locally governed deployments\. Together, these features make Dutch clinical\-text de\-identification more practical for routine use across healthcare institutions, as Philter has demonstrated in English\-language settings[11](https://arxiv.org/html/2609.10049#bib.bib11),[12](https://arxiv.org/html/2609.10049#bib.bib12)\.

Our findings also temper enthusiasm for LLM\-based de\-identification[19](https://arxiv.org/html/2609.10049#bib.bib19),[20](https://arxiv.org/html/2609.10049#bib.bib20),[21](https://arxiv.org/html/2609.10049#bib.bib21),[22](https://arxiv.org/html/2609.10049#bib.bib22),[23](https://arxiv.org/html/2609.10049#bib.bib23),[24](https://arxiv.org/html/2609.10049#bib.bib24)\. Large models can reach high recall in favourable conditions — theLLM\-Anonymizerreported 99\.24% with a 70\-billion\-parameter model on German letters[19](https://arxiv.org/html/2609.10049#bib.bib19)— but their size creates practical barriers\. Using a cloud service requires clinical text to leave local infrastructure, whereas running the model locally demands more hardware and was far slower than the compact transformer in our tests\. The locally deployed Qwen3\-8B model also reached 84\.2% recall on hospital notes and 60\.8% on primary\-care notes\. Runtime will vary with the deployment setup, and more efficient software could narrow the measured speed gap\. It would not, however, remove the additional hardware and governance requirements or the lower recall observed here\. These constraints may be particularly important for smaller healthcare institutions\.

The result that most changes how we think about this problem is that a model trained on nothing but synthetic text had higher recall on the primary\-care notes than a model trained on thousands of real hospital notes\. Real single\-institution data teaches a model the conventions of that institution alongside the task; synthetic data generated with deliberate formatting diversity teaches the task with fewer of those conventions attached\. The perturbation experiments locate important mechanisms: the hospital\-trained model was more sensitive to name formatting and shifted date values across evaluation scopes\. This supports synthetic generation as a complementary source of variation rather than simply a second\-best substitute for real data[25](https://arxiv.org/html/2609.10049#bib.bib25)\. Recent English and French studies similarly use synthetic pre\-training or diversity\-aware distillation to improve robustness and local deployment[26](https://arxiv.org/html/2609.10049#bib.bib26),[27](https://arxiv.org/html/2609.10049#bib.bib27); our contribution is to compare a synthetic\-only and a real\-data\-trained model on the same adjudicated Dutch hospital benchmark and then show that their ranking reversed on authentic primary\-care text\. This cross\-setting recall advantage did not extend to label assignment: among detected spans, the synthetic\-trained model was less accurate than the hospital\-trained model in both settings\. The effect of these label errors on real\-world utility remains uncertain and is likely to depend on the misclassified category and downstream task\. Some errors may not change which text is removed, whereas errors involving dates or birth dates can alter temporal transformations during pseudonymisation and may affect subsequent data modelling\. Aggregate label accuracy alone therefore cannot establish the practical safety or utility of pseudonymised outputs; this requires task\-specific evaluation\. We did not evaluate mixed training; future work should separately test richer synthetic data for label fidelity and mixed real–synthetic training for additional robustness\.

By extending MedDeID with English\-language profiles, we show that the workflow is not tied to Dutch and can be adapted to another language\. The resulting English model achieved the highest annotation\-character recall among seven systems on both Technetium\-I and ASQ\-PHI\. When the same unannotated explicit ages were excluded for every system, its ASQ\-PHI non\-PII redaction rate was 0\.89% \(0\.75–1\.03%\), second to OBI RoBERTa i2b2 at 0\.55% \(0\.45–0\.66%\)\. Much of MedDeID’s raw rate therefore reflected ASQ\-PHI’s treatment of explicit ages, although the same taxonomy mismatch also affected several age\-aware comparators\. This demonstrates language portability rather than clinical validity: the model was trained and tested only on synthetic English data\. Its performance on real English clinical notes, across institutions and patient populations, therefore remains unknown\.

A further distinctive element of this work is its attention to clinical utility\. De\-identification that destroys medical signal is self\-defeating, so MedDeID’s post\-processing layer preserves temporal relationships through a per\-patient date shift and preserves clinically meaningful age information through a transformation that is coarse for adults but graded for children, where age precision carries diagnostic weight\. The sub\-span annotation layer, to our knowledge not previously applied to Dutch clinical text, separates the identifying information itself from surrounding formatting and clinically relevant context, and should make future cross\-method comparisons fairer[32](https://arxiv.org/html/2609.10049#bib.bib32)\. Core PII recall should nevertheless be interpreted as a measure of how much identifying information is detected, not as a stand\-alone estimate of re\-identification probability[33](https://arxiv.org/html/2609.10049#bib.bib33)\.

Preserving chronology does not make shifted dates anonymous\. Weekday and holiday schedules can narrow candidate offsets or reveal shifted calendars[34](https://arxiv.org/html/2609.10049#bib.bib34)\. In the 4,770\-note hospital corpus used for model development and evaluation, 4,358 notes \(91\.4%\) were created from Monday to Friday, illustrating the strong weekday signature available to an attacker\. We therefore recommend patient\- or stay\-specific offsets exceeding one year in either direction where feasible\. When weekday consistency is desired, users may choose signed multiples of seven, but preserving weekdays is a utility choice rather than a privacy guarantee\. Date shifting remains pseudonymisation, and dense longitudinal records may require additional safeguards[12](https://arxiv.org/html/2609.10049#bib.bib12),[35](https://arxiv.org/html/2609.10049#bib.bib35)\.

Several constraints bound these claims\. The hospital benchmark comprises 300 notes from a single hospital\. The 100\-note primary\-care set and the 300\-note Dutch synthetic benchmark were each annotated and sub\-annotated by a single physician\. Some identifiers may therefore have been missed, and decisions about where an identifier begins and ends may reflect that physician’s judgement\. Differences in performance between datasets may consequently reflect differences in annotation, not only differences between settings\. The comparison with hospital annotators is descriptive and is measured against a gold standard that the annotators themselves constructed, not against independent ground truth\. The core sub\-annotation layer reduces the advantage conferred by our own span\-boundary conventions but cannot eliminate the more fundamental dependence on our guideline and adjudication decisions\.

The Dutch synthetic benchmark and all three English benchmarks contain no real patient text\. They are valuable for reproducibility, failure analysis and workflow portability, but performance on these benchmarks cannot show how accurately the models will perform on authentic clinical text\. The English model has not been evaluated on authentic English clinical notes\.

The Qwen3\-8B comparison used deliberately light prompt engineering\. The other external comparators —deidentify, GLiNER\-PII, the original Dutch DEDUCE, OpenAI Privacy Filter and OpenMed — were evaluated using their existing implementations without dataset\-specific tuning\. These choices reflect realistic deployment in healthcare institutions but may not show the best performance obtainable from these external systems\. A larger frontier generative model with extensive prompting might achieve higher recall, though it would not remove the speed, cost or governance barriers\. Qwen3\-8B reached 84\.2% recall on hospital notes and 60\.8% on primary\-care notes, a difference of 23\.4 points\.

Although 100 notes were selected from each test set, each perturbation analysis included only notes containing the relevant type of identifier \(19–98 notes; Supplementary Table S7a\)\. The results should therefore be interpreted as showing which changes tended to cause more failures, rather than as precise estimates of the size of these effects\. Replacing names addresses only whether model performance changes when different names are used; it does not establish whether either model memorised examples from its training data\.

Although the MedDeID components were used to construct and evaluate the systems in this study, the MedDeID framework has not yet been prospectively adopted and evaluated across multiple independent healthcare institutions; its portability as a complete workflow therefore remains to be established\.

Accurate and locally deployable de\-identification of Dutch clinical free text is achievable with compact models\. The synthetic\-only route offers a reproducible starting point where real training data cannot be shared, while the hospital\-trained model defines the attainable in\-domain level of performance\. To maximise performance, we recommend validating and tuning both the model and post\-processing layer for the target text domain\. By connecting both routes in MedDeID — an open workflow covering annotation, synthetic\-data construction, training, local inference, post\-processing and evaluation through a shared schema \(Fig\. 4\) — we provide healthcare institutions with a testable pathway for constructing, validating and refining locally governed systems\. The English instantiation shows that this pathway can be extended to another language; clinical validation must still be performed in every language and health system where it will be used\.

### Methods

Data sources, ethics and governance\.A total of 4,770 clinical notes were assembled from the free\-text electronic health record of Antwerp University Hospital \(UZA\), a tertiary university hospital: 4,470 were assigned to model development and 300 were reserved as a held\-out hospital benchmark before model training\. Its composition is reported in Supplementary Table S1\. A further 100 notes from a Belgian general practice were used forexternal validation\. The Ethics Committee of Antwerp University Hospital and the University of Antwerp approved the study on 2 June 2025 \(project 7654; CTMS/EDGE 004299\); its chair approved an amendment covering the primary\-care validation on 4 June 2026\. The Ethics Committee waived the requirement for individual informed consent for this retrospective use of routinely collected clinical records\. The documented legal bases were GDPR Arts\. 6\(1\)\(f\) and 9\(2\)\(j\), with Art\. 89 safeguards[2](https://arxiv.org/html/2609.10049#bib.bib2)\. UZA was the controller and the University of Antwerp the processor\. Identifiable data remained in UZA’s secured Azure research environment, with restricted MFA and SSH\-key access and local\-only model inference\. No identifiable data were exchanged with the participating general practice; only aggregated validation results were shared\.

No formal sample\-size calculation was performed\. The hospital development\-corpus size was pragmatic: annotation stopped after validation performance and the marginal benefit observed during iterative annotation had plateaued, rather than at a prespecified statistical target\. Evaluation\-cohort sizes were constrained by the availability and governance of manually reviewed clinical text and by the effort required for character\-level sub\-annotations\. The hospital sample was selected before training to provide broad department coverage and independent dual annotation; the primary\-care sample was intended as a first cross\-setting validation rather than a definitive estimate of primary\-care performance\.

Annotation and gold\-standard construction\.The development and training corpus was annotated by a single physician\-researcher \(SH\)\. To improve throughput and consistency, candidate spans were pre\-suggested by a model trained on previously annotated data and normalised by a rule\-based layer that standardised span boundaries; all suggestions were human\-reviewed\. The separately reserved hospital benchmark was annotated independently by two physician\-researchers \(SH and TS\), both trained in advance on the guideline, and adjudicated into a single gold standard by sequential review and consensus resolution of disagreements\. The Dutch and English synthetic benchmarks and the primary\-care set were each annotated by one physician\-researcher \(SH\) against the same guideline\.

Annotation guideline and label scheme\.The guideline was adapted from the NIH/NLM Scrubber annotation guidelines, the HIPAA 18\-identifier scheme and the GraSCCo/GeMTeX framework for German clinical text[3](https://arxiv.org/html/2609.10049#as1_bib.bib3),[4](https://arxiv.org/html/2609.10049#as1_bib.bib4),[5](https://arxiv.org/html/2609.10049#as1_bib.bib5),[6](https://arxiv.org/html/2609.10049#as1_bib.bib6),[7](https://arxiv.org/html/2609.10049#as1_bib.bib7), with further rules and examples developed from the clinical text encountered in this study\. Span labels cover person names; addresses and locations; healthcare and other organisations; dates; ages and birth dates; professions; contact details; numeric or alphanumeric identifiers; and exceptional identifying content\. Name and address labels distinguish patient, caregiver and other referents; identifier labels distinguish patients from caregivers; and organisation labels distinguish healthcare from other organisations\. The full guideline is provided in Supplementary Appendix A and in the versioned archival release described under Data availability\.

Sub\-annotation and core PII recall\.Gold annotations were subdivided to separate identifying information from incidental material captured inside the same span\. For example, in the fictitious phone number\+32 \(0\)493123457, spaces, punctuation and the country prefix are recorded separately from the person\-specific digits \(underlined\)\. Characters falling into the sub\-annotation categories*formatting*,*additional information*,*medical information*,*title*and*time*were excluded from the core PII set, because they either identify no one on their own or carry clinical meaning\. Definitions of all sub\-annotation categories and their inclusion in core PII are provided in Supplementary Table S3\. LetGcoreG\_\{\\mathrm\{core\}\}be the set of all remaining gold\-character positions andRsR\_\{s\}the union of character positions redacted by systemss\. We define

Recallcore​PII⁡\(s\)=\|Gcore∩Rs\|\|Gcore\|\.\\operatorname\{Recall\}\_\{\\mathrm\{core\\,PII\}\}\(s\)=\\frac\{\|G\_\{\\mathrm\{core\}\}\\cap R\_\{s\}\|\}\{\|G\_\{\\mathrm\{core\}\}\|\}\.\(1\)This label\-agnostic measure gives credit whenever the relevant content is removed, irrespective of a system’s chosen span boundary or output label\. LetGspanG\_\{\\mathrm\{span\}\}be the union of complete gold spans andDDall evaluated document\-character positions\. The complementary utility measure is

RedactionRatenon​\-​PII⁡\(s\)=\|Rs∖Gspan\|\|D∖Gspan\|,\\operatorname\{RedactionRate\}\_\{\\mathrm\{non\\text\{\-\}PII\}\}\(s\)=\\frac\{\|R\_\{s\}\\setminus G\_\{\\mathrm\{span\}\}\|\}\{\|D\\setminus G\_\{\\mathrm\{span\}\}\|\},\(2\)the non\-PII redaction rate\. It is decomposed in the Supplementary into characters belonging to false\-positive spans, which do not overlap any annotated PII span, and PII boundary extensions, the excess characters redacted beyond the boundary of an overlapping annotated PII span\. Characters excluded from the core PII set but lying inside a gold span contribute to neither measure; their coverage remains visible through overall recall\.

Synthetic data generation\.We developed the Dutch and English synthetic datasets between May and August 2026 using the same language\-profile\-driven workflow\. Each structured case combined a clinical scenario derived from Synthea[40](https://arxiv.org/html/2609.10049#bib.bib40)with synthetic PII sampled from regional resources: the Belgian Dutch \(nl\-BE\) profile ofmeddeid\-language\-nl, or the British and American English \(en\-GBanden\-US\) profiles ofmeddeid\-language\-en\(Fig\. 4\)\. The Dutch resources originated in the lookup lists used by Belgian DEDUCE\. The only difference between the two LLM\-generation workflows was the authoring model: GPT\-5\.4 mini for Dutch and GPT\-5\.6 Luna for English\. Both models converted compact case descriptions and designated PII fields into clinical notes and enclosed the PII in explicit markers, which we removed locally while recording exact character offsets\. Deterministic, targeted renderers supplemented the LLM\-generated notes in both languages\. No real patient text or PII was provided to either generator\.

We prioritised de\-identification challenges over narrative realism by including difficult non\-PII examples, such as laboratory results, medication names, eponyms and device identifiers, and by varying the clinical\-note format[25](https://arxiv.org/html/2609.10049#bib.bib25)\. During development, we used OpenAI Codex to inspect individual outputs and corpus\-level quality reports and to refine the prompts, generators, validation rules and post\-processing\. Automated checks and manual review identified and corrected remaining errors in annotation boundaries and coverage\. The held\-out benchmarks were manually reviewed and sub\-annotated against the same guideline used for the clinical benchmarks\.

Model architecture and training\.All three MedDeID models used the same dual\-head RoBERTa architecture\. One head performs three\-way BIO span detection over every token; the other assigns one of 14 entity categories from the first token of each detected span\. Byte\-level tokens were processed in overlapping 512\-token windows with 64\-token overlap, and logits were averaged across overlaps before typed spans were reconstructed at character offsets\.

The two Dutch models used RobBERT\-2023[8](https://arxiv.org/html/2609.10049#as1_bib.bib8)as their encoder\. We selected it after comparing RobBERT\-2023 with MedRoBERTa\.nl[16](https://arxiv.org/html/2609.10049#bib.bib16)on the hospital development corpus\. The English model used RoBERTa\-base[9](https://arxiv.org/html/2609.10049#as1_bib.bib9)\. The resulting models weremeddeid\-dutch\-uza, trained on annotated hospital text;meddeid\-dutch\-synth, trained only on synthetic Dutch text; andmeddeid\-english\-synth, trained only on synthetic English text from theen\-GBanden\-USprofiles\.

All three runs used the same MedDeID training implementation, seed, optimiser, encoder and classification\-head learning rates, weight decay, effective batch size and validation metric\. Microbatching, numerical precision, warm\-up and early\-stopping settings were adapted to the encoder and hardware\. Model selection maximised validation entity\-level F1\. After selecting the epoch count, we independently reinitialised each base encoder and refitted it for that fixed number of epochs on its complete development corpus: 17 epochs for each Dutch model and four for the English model\. All test benchmarks were withheld during model selection and evaluated only after the final refit\. Hyperparameter tuning was deliberately moderate because our effort focused on data quality; complete configurations and model\-selection records for all three models are reported in Supplementary Table S8\.

External English benchmark preparation\.We evaluated the English model on two public synthetic benchmarks\. Technetium\-I contributes a held\-out test split of 74,700 multi\-section clinical notes and 1,161,437 PII annotations[28](https://arxiv.org/html/2609.10049#bib.bib28)\. We used only the published test split and mapped its seven observed test\-set entity types to the MedDeID schema; its training and validation splits were not downloaded or used\. ASQ\-PHI contains short clinician\-style search queries[29](https://arxiv.org/html/2609.10049#bib.bib29)\. We included all 1,051 queries, of which 219 were hard negatives\. We converted all 2,973 annotations to character offsets in the MedDeID format\. Of these, 2,972 matched the source text directly, while one required apostrophe normalisation\. The external benchmarks and MedDeID group identifiers differently\. We therefore measured whether the correct text was identified, regardless of the label assigned to it \(label\-agnostic annotation\-character recall\)\. Because ASQ\-PHI does not annotate explicit ages below the HIPAA threshold, we identified these expressions in the source text using the same rules for every system, regardless of output labels\. We included numeric ages in year\-old or month\-old phrases,yooryshorthand,age N, compact age–sex expressions, or over/under age thresholds; overlapping matches were merged\. The resulting set comprised 8,745 non\-gold characters in 878 queries \(numeric values 5–88, including two infant ages expressed in months\) and did not overlap any gold annotation\. For every system, the sensitivity calculation removed redacted characters inside these expressions from the numerator, irrespective of the predicted label, while retaining the original denominator of 119,651 non\-PII characters\. Qualitative descriptors such aselderlyandadolescentswere not excluded\. Full mappings, label distributions and results after excluding these ages are reported in Supplementary Section S10\.

Computing environment\.Hospital data preparation and CPU inference used an Azure Standard DC4as v5 virtual machine with four vCPUs\. The hospital model was trained and GPU inference was run on an Azure Standard NC4as T4 v3 virtual machine with one NVIDIA T4\. Both synthetic models were trained on an Apple M4 Pro GPU\. Primary\-care validation ran on an isolated four\-vCPU Google Cloud virtual machine without a GPU\. Complete model and timing configuration values are reported in Supplementary Tables S8–S9\.

Post\-processing and pseudonymisation\.To compare the systems, we first used each one to identify PII spans\. We then applied MedDeID’s post\-processing to every system, optionally using known patient and caregiver names from the metadata \(Fig\. 1\)\. This step joins adjacent detections, extends incomplete detections when the surrounding text follows a known format, and handles repeated information consistently within a document\. For example, if a system detects the day and month of a date but misses the year, MedDeID’s post\-processing adds the year to the detected span\. Comparative recall and non\-PII redaction were calculated from these post\-processed outputs, and warm processing time included these steps\. Pseudonymisation was a separate downstream transformation and was evaluated independently\.

After detection, dates and ages can be replaced with less identifying values that retain clinical meaning\. All dates for one patient or hospital stay are shifted by the same number of days\. We refer to this number as the date shift or offset\. This changes the calendar dates but preserves the order of events and the time between them\. Less precise expressions, such as a month or season, are shifted as date ranges so that the output does not imply an exact day that was not present in the source text\. A separate shift should be used for each patient or hospital stay rather than applying one shift to the entire dataset\. MedDeID warns users when they choose a shift of one year or less\. If reversibility is required, the offset should be held separately under appropriate access controls so that authorised users can interpret shifted dates without exposing the mapping with the released record\. Ages are made less precise according to the patient’s age, while finer detail is retained for infants and young children \(Table S10b\)\.

Belgian DEDUCE\.The Dutch DEDUCE tool[13](https://arxiv.org/html/2609.10049#bib.bib13)was upgraded for the Belgian context by replacing its lookup lists with Belgian Dutch*and*French name, place and institution lists, and by incorporating the logic corrections identified during annotation, which were first implemented in MedDeID’s post\-processing layer and subsequently integrated into the rule base itself\.

Comparator systems\.We compared: the two human annotators; the hospital\-trained \(meddeid\-dutch\-uza\) and synthetic\-trained \(meddeid\-dutch\-synth\) versions of our RoBERTa transformer; Belgian DEDUCE and the original Dutch DEDUCE[13](https://arxiv.org/html/2609.10049#bib.bib13), which are rule\-based;deidentify, a published Dutch de\-identification model[14](https://arxiv.org/html/2609.10049#bib.bib14); a locally deployed generative large language model \(Qwen3\-8B\) with deliberately light prompt engineering, reflecting realistic local use in a healthcare institution; a zero\-shot neural NER model \(GLiNER\-PII\)[31](https://arxiv.org/html/2609.10049#bib.bib31); and two general\-purpose neural PII detectors \(OpenAI Privacy Filter and OpenMed multilingual\)\. The Qwen prompt used the annotation definitions in Supplementary Table S2 within a Dutch system prompt that described the model as a medical text\-annotation assistant and required a JSON object containing aspanslist\. Each item had to contain the exact source substring inannotated\_textand one allowedlabel; overlapping or nested entities and typo correction were prohibited, and notes without PII had to return an empty list\. Two fixed few\-shot examples illustrated patient and other\-person names, ages, dates and a healthcare organisation\. The original note text was appended unchanged as the user input\.

Qwen3\-8B was quantised and served locally through Ollama, allowing the same evaluation interface to run without transferring clinical text to an external service\. The evaluated configuration used the Ollama tagqwen3:8b, Q4\_K\_M GGUF quantisation with temperature 0\.6, top\-pp0\.95, an 8,000\-token output limit, two concurrent workers and Qwen thinking enabled\. Thinking blocks were removed before JSON parsing\. Returned substrings were aligned to character offsets by exact matching, with a case\- and whitespace\-tolerant fallback for near\-verbatim copies\. The complete prompt template, label definitions, two fixed examples, and the code used to construct, parse and align the Qwen output are available in the standalone[deid\-batteryreproducibility repository](https://github.com/stighellemans/deid-battery)\.

Inference\-time evaluation\.Warm end\-to\-end inference time was measured only on the full 300\-note hospital benchmark\. “Warm” means that one\-time system setup and model loading had already been completed\. The timing included processing all notes, writing predictions, applying the shared post\-processing and writing the final outputs; it excluded setup and the preliminary warm\-up pass\. Supplementary Table S9 reports the complete timing results for this evaluated deployment\.

Stability analysis\.We used a deterministic coverage\-selection procedure to select 100 notes from each of the three test sets \(300 notes in total\)\. We perturbed these notes along six dimensions: name source \(original, reshuffled real names or synthetically generated names\), name capitalisation, name format \(full name, first name only, initials only, first name plus initials or title\), date format, date value shifted into the past or future, and age format\. Each analysis included only the selected notes containing the relevant type of identifier\. Individual analyses therefore included 19–98 hospital notes, 23–97 synthetic notes and 28–91 primary\-care notes\. The number of relevant identifiers also varied; Supplementary Table S7a reports both note and identifier counts\. Recall was computed as the fraction of perturbed target spans still detected with the correct category\. Confidence intervals for recall and degradation were obtained from 10,000 replicates of a note\-level cluster bootstrap: complete notes were resampled, with all target spans from a selected note kept together and each baseline–perturbation pair preserved\. Degradation was tested by a one\-sided permutation test atα=0\.05\\alpha=0\.05, with the note, rather than each individual identifier, treated as the independent unit\. False\-discovery rates were controlled separately for each model across the 27 cross\-scope cells using the Benjamini–Hochberg procedure\. Cells with fewer than five paired target spans or fewer than five contributing notes are excluded from all reported results\.

Pseudonymisation evaluation\.We evaluated pseudonymisation in two settings\. First, to isolate transformation\-layer performance from PII detection, the evaluator received every gold Date and Age\_Birthdate span directly\. Second, to evaluate the full pipeline, it used the metadata\-enabledmeddeid\-dutch\-synthpredictions for each test set\. A gold target failed end to end unless one predicted span covered it completely, had the correct label and produced a protocol\-valid transformation\. We separately counted gold spans with unredacted characters: targets for which at least one original character was not covered by any predicted redaction\. These cases are included among end\-to\-end failures; other end\-to\-end failures were fully redacted but failed because the identifier was split across predictions, assigned the wrong label or transformed incorrectly\. All rates used the total number of gold Date and Age\_Birthdate spans as the denominator\. Both evaluations used a fixed document creation date of 15 January 2025, a\+371\+371\-day shift and birthdate\-to\-age replacement\.

Statistics and reproducibility\.Core PII recall and non\-PII redaction rate are reported for every system on the three Dutch test sets\. Because the external English benchmarks lack the subannotations required to calculate core PII recall, we report annotation\-character recall and non\-PII redaction instead\. Unless stated otherwise, numbers in parentheses in the Results and Supplementary Information are 95% confidence intervals\. We calculated these intervals with the percentile method from 10,000 bootstrap samples of complete documents\. We used this method for every confidence interval reported\.

In each bootstrap sample, complete documents were drawn with replacement\. All gold annotations and system predictions from a selected document were kept together\. We then calculated each rate from the total character counts across the sampled documents, rather than averaging document\-level percentages\. The same sampled documents were used for all systems on a benchmark, allowing paired confidence intervals for between\-system differences\. Documents without PII remained in the denominator of the non\-PII redaction rate\. The comparison between the hospital model and the annotators was descriptive; we did not test whether their performance was equivalent\.

Confidence intervals for the stability experiments were obtained by the separate paired bootstrap described above, and degradation was tested by a one\-sided permutation test atα=0\.05\\alpha=0\.05, with Benjamini–Hochberg correction across the 27 cells separately for each model\. Reporting follows TRIPOD\+AI where applicable[42](https://arxiv.org/html/2609.10049#bib.bib42)\.

Use of generative artificial intelligence\.During preparation of this manuscript, the authors used OpenAI Codex for language editing, structural revision, consistency checking and audit support\. No confidential patient information, patient\-level clinical text or other identifiable clinical data were entered into an unapproved artificial\-intelligence service\. All outputs were reviewed and verified by the authors, who remain fully responsible for the manuscript’s content\.

### Data availability

Materials that contain no real patient data are openly available: the Dutch and English synthetic training corpora and benchmarks, annotation guideline and worked examples can be accessed through the MedDeID collection on Hugging Face \([https://huggingface\.co/collections/stighellemans/meddeid](https://huggingface.co/collections/stighellemans/meddeid)\) and are archived in versioned Zenodo records[1](https://arxiv.org/html/2609.10049#as1_bib.bib1),[2](https://arxiv.org/html/2609.10049#as1_bib.bib2)\. The public Dutch resources contain 6,793 notes \(6,493 training; 300 benchmark\), and the English resources contain 6,700 training notes and a 300\-note benchmark\. Technetium\-I and ASQ\-PHI remain available from their original repositories[28](https://arxiv.org/html/2609.10049#bib.bib28),[29](https://arxiv.org/html/2609.10049#bib.bib29)\. By contrast, the real\-EHR materials—300 hospital benchmark notes, 4,470 hospital training notes, 100 primary\-care validation notes, their annotations and the hospital\-trained model weights—cannot be shared publicly or on request because of patient privacy, GDPR, ethics and institutional\-governance restrictions[2](https://arxiv.org/html/2609.10049#bib.bib2)\.

### Code availability

## References

- 1Kory Kreimeyer, Matthew Foster, Abhishek Pandey, Nina Arya, Gwendolyn Halford, Sandra F\. Jones, Richard Forshee, Mark Walderhaug, and Taxiarchis Botsis\.Natural language processing systems for capturing and standardizing unstructured clinical information: A systematic review\.*Journal of Biomedical Informatics*, 73:14–29, 2017\.doi:10\.1016/j\.jbi\.2017\.07\.012\.
- 2European Parliament and Council of the European Union\.Regulation \(EU\) 2016/679 \(general data protection regulation\)\.Official Journal of the European Union L119, 1–88, 2016\.URL[https://eur\-lex\.europa\.eu/eli/reg/2016/679/oj](https://eur-lex.europa.eu/eli/reg/2016/679/oj)\.
- 3Article 29 Data Protection Working Party\.Opinion 05/2014 on anonymisation techniques\.Technical Report 0829/14/EN, WP216, European Commission, 2014\.
- 4Office for Civil Rights, U\.S\. Department of Health and Human Services\.Guidance regarding methods for de\-identification of protected health information in accordance with the HIPAA privacy rule\.Technical report, U\.S\. Department of Health and Human Services, 2012\.URL[https://www\.hhs\.gov/hipaa/for\-professionals/privacy/special\-topics/de\-identification/index\.html](https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html)\.Safe Harbor and Expert Determination methods\.
- 5Mehmet Kayaalp\.Modes of de\-identification\.*AMIA Annual Symposium Proceedings*, 2017:1044–1053, 2018\.
- 6Amber Stubbs, Christopher Kotfila, and Özlem Uzuner\.Automated systems for the de\-identification of longitudinal clinical narratives: Overview of 2014 i2b2/UTHealth shared task track 1\.*Journal of Biomedical Informatics*, 58\(Suppl\):S11–S19, 2015\.doi:10\.1016/j\.jbi\.2015\.06\.007\.
- 7Amber Stubbs and Özlem Uzuner\.Annotating longitudinal clinical narratives for de\-identification: The 2014 i2b2/UTHealth corpus\.*Journal of Biomedical Informatics*, 58\(Suppl\):S20–S29, 2015\.doi:10\.1016/j\.jbi\.2015\.07\.020\.
- 8Franck Dernoncourt, Ji Young Lee, Özlem Uzuner, and Peter Szolovits\.De\-identification of patient notes with recurrent neural networks\.*Journal of the American Medical Informatics Association*, 24\(3\):596–606, 2017\.doi:10\.1093/jamia/ocw156\.
- 9Alistair E\. W\. Johnson, Lucas Bulgarelli, and Tom J\. Pollard\.Deidentification of free\-text medical records using pre\-trained bidirectional transformers\.In*Proceedings of the ACM Conference on Health, Inference, and Learning \(CHIL\)*, pages 214–221, 2020\.doi:10\.1145/3368555\.3384455\.
- 10Karthik Murugadoss, Ajit Rajasekharan, Bradley Malin, Vineet Agarwal, Sairam Bade, Jeff R\. Anderson, Jason L\. Ross, William A\. Faubion, John D\. Halamka, Venky Soundararajan, and Sankar Ardhanari\.Building a best\-in\-class automated de\-identification tool for electronic health records through ensemble learning\.*Patterns*, 2\(9\):100255, 2021\.doi:10\.1016/j\.patter\.2021\.100255\.
- 11Beau Norgeot, Kathleen Muenzen, Thomas A\. Peterson, Xuancheng Fan, Benjamin S\. Glicksberg, Gundolf Schenk, Eugenia Rutenberg, Boris Oskotsky, Marina Sirota, Jinoos Yazdany, Gabriela Schmajuk, Dana Ludwig, Theodore Goldstein, and Atul J\. Butte\.Protected health information filter \(Philter\): accurately and securely de\-identifying free\-text clinical notes\.*npj Digital Medicine*, 3:57, 2020\.doi:10\.1038/s41746\-020\-0258\-y\.
- 12Lakshmi Radhakrishnan, Gundolf Schenk, Kathleen Muenzen, Boris Oskotsky, Habibeh Ashouri Choshali, Thomas Plunkett, Sharat Israni, and Atul J\. Butte\.A certified de\-identification system for all clinical text documents for information extraction at scale\.*JAMIA Open*, 6\(3\):ooad045, 2023\.doi:10\.1093/jamiaopen/ooad045\.
- 13Vincent Menger, Floor Scheepers, Linda M\. van Wijk, and Marco Spruit\.DEDUCE: A pattern matching method for automatic de\-identification of Dutch medical text\.*Telematics and Informatics*, 35\(4\):727–736, 2018\.doi:10\.1016/j\.tele\.2017\.08\.002\.
- 14Jan Trienes, Dolf Trieschnigg, Christin Seifert, and Djoerd Hiemstra\.Comparing rule\-based, feature\-based and deep neural methods for de\-identification of Dutch medical records\.In*Proceedings of the ACM WSDM Health Search and Data Mining Workshop \(HSDM\)*, 2020\.URL[https://arxiv\.org/abs/2001\.05714](https://arxiv.org/abs/2001.05714)\.arXiv:2001\.05714\.
- 15Tom M\. Seinen, Jan A\. Kors, Erik M\. van Mulligen, and Peter R\. Rijnbeek\.Investigating de\-identification methodologies in Dutch medical texts: A replication study of Deduce and Deidentify\.*Electronics*, 14\(8\):1636, 2025\.doi:10\.3390/electronics14081636\.
- 16Stella Verkijk and Piek Vossen\.MedRoBERTa\.nl: A language model for Dutch electronic health records\.*Computational Linguistics in the Netherlands Journal*, 11:141–159, 2021\.
- 17Pieter Delobelle, Thomas Winters, and Bettina Berendt\.RobBERT: a Dutch RoBERTa\-based language model\.In*Findings of the Association for Computational Linguistics: EMNLP 2020*, pages 3255–3265, 2020\.doi:10\.18653/v1/2020\.findings\-emnlp\.292\.
- 18Pieter Delobelle, Thomas Winters, Bettina Berendt, and François Remy\.RobBERT\-2023: Keeping Dutch language models up\-to\-date at a lower cost thanks to model conversion\.*Computational Linguistics in the Netherlands Journal*, 13:193–203, 2024\.
- 19Isabella Catharina Wiest et al\.Deidentifying medical documents with local, privacy\-preserving large language models: The LLM\-Anonymizer\.*NEJM AI*, 2\(4\):AIdbp2400537, 2025\.doi:10\.1056/AIdbp2400537\.
- 20Bayan Altalla’ et al\.Evaluating GPT models for clinical note de\-identification\.*Scientific Reports*, 15:3852, 2025\.doi:10\.1038/s41598\-025\-86890\-3\.
- 21Océane Dorémus et al\.Harnessing moderate\-sized language models for reliable patient data deidentification in emergency department records: Algorithm development, validation, and implementation study\.*JMIR AI*, 4:e57828, 2025\.doi:10\.2196/57828\.
- 22Chih\-Wei Chang et al\.An LLM\-based framework for zero\-shot de\-identifying flexible text data in protected health information enabling potential risk\-informed patient safety\.*International Journal of Radiation Oncology, Biology, Physics*, 120\(2, Suppl\):e518, 2024\.doi:10\.1016/j\.ijrobp\.2024\.07\.1149\.
- 23Sanjeet Singh et al\.Generation and de\-identification of Indian clinical discharge summaries using LLMs\.In*Proceedings of the 23rd Workshop on Biomedical Natural Language Processing \(BioNLP\)*, pages 342–362, 2024\.doi:10\.18653/v1/2024\.bionlp\-1\.26\.
- 24Kiana Aghakasiri, Noopur Zambare, JoAnn Thai, Carrie Ye, Mayur Mehta, J\. Ross Mitchell, and Mohamed Abdalla\.Not what the doctor ordered: Surveying LLM\-based de\-identification and quantifying clinical information loss\.In*Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing \(EMNLP\)*, 2025\.URL[https://arxiv\.org/abs/2509\.14464](https://arxiv.org/abs/2509.14464)\.arXiv:2509\.14464\.
- 25Claudia Alessandra Libbi, Jan Trienes, Dolf Trieschnigg, and Christin Seifert\.Generating synthetic training data for supervised de\-identification of electronic health records\.*Future Internet*, 13\(5\):136, 2021\.doi:10\.3390/fi13050136\.
- 26Anthony Yazdani, Alban Bornet, Hossein Rouhizadeh, Abiram Sandralegar, Philippe Bijlenga, and Douglas Teodoro\.CONORM\-DEID: Robustness evaluation of a multilingual de\-identification system for clinical texts\.*Studies in Health Technology and Informatics*, 336:929–933, 2026\.doi:10\.3233/SHTI260315\.
- 27Jose D\. Posada, David Love, Somalee Datta, and Priya Desai\.SHIELD: A diverse clinical note dataset and distilled small language models for enterprise\-scale de\-identification\.arXiv preprint arXiv:2605\.03301, 2026\.
- 28TeMLM Foundation\.Technetium\-I: A large\-scale synthetic clinical nlp dataset\.Hugging Face dataset, 2026\.URL[https://huggingface\.co/datasets/temlm\-foundation/Technetium\-I](https://huggingface.co/datasets/temlm-foundation/Technetium-I)\.
- 29James Weatherhead, George Golovko, and Peter McCaffrey\.ASQ\-PHI: An adversarial synthetic data benchmark for clinical de\-identification and search utility\.*Data in Brief*, 65:112586, 2026\.doi:10\.1016/j\.dib\.2026\.112586\.
- 30An Yang et al\.Qwen3 Technical Report\.*arXiv preprint arXiv:2505\.09388*, 2025\.doi:10\.48550/arXiv\.2505\.09388\.
- 31Urchade Zaratiana, Nadi Tomeh, Pierre Holat, and Thierry Charnois\.GLiNER: Generalist model for named entity recognition using bidirectional transformer\.In*Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\)*, pages 5364–5376, Mexico City, Mexico, 2024\. Association for Computational Linguistics\.URL[https://aclanthology\.org/2024\.naacl\-long\.300/](https://aclanthology.org/2024.naacl-long.300/)\.
- 32Ildikó Pilán, Pierre Lison, Lilja Øvrelid, Anthi Papadopoulou, David Sánchez, and Montserrat Batet\.The text anonymization benchmark \(TAB\): A dedicated corpus and evaluation framework for text anonymization\.*Computational Linguistics*, 48\(4\):1053–1101, 2022\.doi:10\.1162/coli\_a\_00458\.
- 33Elizabeth Ford, Simon Pillinger, Robert Stewart, Kerina Jones, Angus Roberts, Arlene Casey, Katie Goddard, and Goran Nenadic\.What is the patient re\-identification risk from using de\-identified clinical free text data for health research?*AI and Ethics*, 5\(5\):4441–4454, 2025\.doi:10\.1007/s43681\-025\-00681\-0\.
- 34Laura Evans, Jack W\. London, and Matvey B\. Palchuk\.The detection of date shifting in real\-world data\.*Applied Clinical Informatics*, 14\(4\):763–771, 2023\.doi:10\.1055/a\-2130\-2197\.
- 35Jes Alexander and Alexis Beatty\.Nonspecific deidentification of date\-like text in deidentified clinical notes enables reidentification of dates\.*Journal of the American Medical Informatics Association*, 29\(11\):1967–1971, 2022\.doi:10\.1093/jamia/ocac147\.
- 36Mehmet Kayaalp, Phong Sagan, Allen C\. Browne, and Clement J\. McDonald\.Guidelines for annotating personal identifiers in the clinical text repository of the national institutes of health\.Technical report, Lister Hill National Center for Biomedical Communications, U\.S\. National Library of Medicine, 2016\.
- 37Mehmet Kayaalp, Allen C\. Browne, Phong Sagan, Tyne McGee, and Clement J\. McDonald\.Challenges and insights in using HIPAA privacy rule for clinical text annotation\.In*AMIA Annual Symposium Proceedings*, pages 707–716, 2015\.
- 38Christina Lohr, Franz Matthies, Jakob Faller, Luise Modersohn, Andrea Riedel, Udo Hahn, Rebekka Kiser, Martin Boeker, and Frank Meineke\.De\-identifying GRASCCO: A pilot study for the de\-identification of the German medical text project \(GeMTeX\) corpus\.*Studies in Health Technology and Informatics*, 317:171–179, 2024a\.doi:10\.3233/SHTI240853\.
- 39Christina Lohr, Franz Matthies, Jakob Faller, Luise Modersohn, Andrea Riedel, Udo Hahn, Rebekka Kiser, Martin Boeker, and Frank Meineke\.GraSCCo\_PHI: Graz synthetic clinical text corpus with protected health information annotations\.Zenodo, version v1, 2024b\.URL[https://doi\.org/10\.5281/zenodo\.11502329](https://doi.org/10.5281/zenodo.11502329)\.
- 40Jason Walonoski, Mark Kramer, Joseph Nichols, Andre Quina, Chris Moesel, Dylan Hall, Carlton Duffett, Kudakwashe Dube, Thomas Gallagher, and Scott McLachlan\.Synthea: An approach, method, and software mechanism for generating synthetic patients and the synthetic electronic health care record\.*Journal of the American Medical Informatics Association*, 25\(3\):230–238, 2018\.doi:10\.1093/jamia/ocx079\.
- 41Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov\.RoBERTa: A robustly optimized BERT pretraining approach\.*arXiv preprint arXiv:1907\.11692*, 2019\.doi:10\.48550/arXiv\.1907\.11692\.
- 42Gary S\. Collins, Karel G\. M\. Moons, Paula Dhiman, Richard D\. Riley, Andrew L\. Beam, Ben Van Calster, et al\.TRIPOD\+AI statement: updated guidance for reporting clinical prediction models that use regression or machine learning methods\.*BMJ*, 385:e078378, 2024\.doi:10\.1136/bmj\-2023\-078378\.
- 43Stig Hellemans, Tom Stroobants, Elyne Scheurwegs, Pieter Meysman, Philippe Jorens, and Kris Laukens\.MedDeID dutch synthetic corpus, synthetic benchmark and annotation guidelines, 2026a\.URL[https://doi\.org/10\.5281/zenodo\.21992866](https://doi.org/10.5281/zenodo.21992866)\.Dataset\.
- 44Stig Hellemans, Tom Stroobants, Elyne Scheurwegs, Pieter Meysman, Philippe Jorens, and Kris Laukens\.MedDeID english synthetic clinical corpus, benchmark and annotation guideline, 2026b\.URL[https://doi\.org/10\.5281/zenodo\.22129255](https://doi.org/10.5281/zenodo.22129255)\.Dataset\.
- 45Stig Hellemans, Tom Stroobants, Elyne Scheurwegs, Pieter Meysman, Philippe Jorens, and Kris Laukens\.MedDeID suite \(version 0\.3\.0\), 2026c\.URL[https://github\.com/stighellemans/meddeid\-suite](https://github.com/stighellemans/meddeid-suite)\.Software\.
- 46Stig Hellemans\.deid\-battery \(version 0\.1\.0\), 2026\.URL[https://github\.com/stighellemans/deid\-battery](https://github.com/stighellemans/deid-battery)\.Software\.
- 47Vincent Menger and Stig Hellemans\.Belgian DEDUCE: MedDeID study snapshot \(version meddeid\-study\-v1\.0\.0\), 2026\.URL[https://github\.com/stighellemans/belgian\-deduce](https://github.com/stighellemans/belgian-deduce)\.Software\.
- 48Stig Hellemans, Tom Stroobants, Elyne Scheurwegs, Pieter Meysman, Philippe Jorens, and Kris Laukens\.meddeid\-dutch\-synth \(version 1\.0\.0\), 2026d\.URL[https://doi\.org/10\.57967/hf/10304](https://doi.org/10.57967/hf/10304)\.Model\.
- 49Stig Hellemans, Tom Stroobants, Elyne Scheurwegs, Pieter Meysman, Philippe Jorens, and Kris Laukens\.meddeid\-english\-synth \(version 1\.0\.0\), 2026e\.URL[https://doi\.org/10\.57967/hf/10306](https://doi.org/10.57967/hf/10306)\.Model\.

### Acknowledgements

S\.H\. is supported by the Research Foundation Flanders \(FWO\) under Grant No\.1SA3226N\. This work was supported by the Flemish Government \(Flanders AI Research Program\)\. The funders had no role in study design, data collection, analysis, interpretation or preparation of the manuscript\. We thank the participating general practice and Co\-Medic for enabling the primary\-care validation and the UZA Data Innovation Lab for the secured research environment\.

S\.H\. conceived the study; developed the MedDeID software, models, datasets and annotation guideline; performed the primary annotation, experiments, analyses and visualisation; and drafted the manuscript\. T\.S\. performed the second hospital\-benchmark annotation, contributed to the annotation guideline and reviewed and edited the manuscript\. E\.S\. facilitated the technical setup at the UZA Data Innovation Lab, contributed methodological input and reviewed the final manuscript\. P\.J\. supported the ethics\-approval process and enabled the study at UZA, and reviewed and edited the final manuscript\. P\.M\. and K\.L\. contributed to the methodology, interpretation and supervision, and reviewed and edited the manuscript\. All authors approved the final manuscript\.

### Competing interests

The authors declare no financial or non\-financial competing interests\.

Table 1 \| Dataset provenance, construction and reviewThe study links governed clinical data with openly shareable synthetic resources\. The real Dutch hospital and primary\-care benchmarks test performance in distinct care settings, while the Dutch and English synthetic resources make training and evaluation reproducible beyond those settings\. Character\-level sub\-annotations and patient or caregiver metadata are available for the MedDeID benchmarks, but not for the two external English benchmarks\.

\*MedDeID datasets created for this study\.

†In the original ASQ\-PHI study, three clinicians or domain experts each audited 100 records \(300 of 1,051\); this audit was not conducted by the present authors, and the complete dataset was not reviewed\.

Fig\. 1 \| De\-identification systems, shared post\-processing and evaluation metrics\.Our compact neural de\-identifiers combine a transformer encoder with separate heads for token\-level span boundaries and span labels; the Dutch models use RobBERT\-2023, whereas the separately trained English model uses RoBERTa\-base\. Belgian DEDUCE instead adapts the rule\-based Dutch DEDUCE system to the Belgian context\. We compared these approaches with published Dutch systems \(DEDUCE anddeidentify\), zero\-shot or general\-purpose multilingual detectors \(GLiNER\-PII, OpenAI Privacy Filter and OpenMed\), a locally deployed generative model \(Qwen3\-8B\), and English systems \(OBI RoBERTa i2b2 and UCSF Philter\)\. Although these systems detect PII in different ways, each produces candidate character spans that follow the same MedDeID post\-processing path\. Healing joins or extends detections using deterministic rules, while metadata injection adds detections for known patient and caregiver names without inserting metadata into the text\. This common path allows the evaluation to answer three practical questions: how much PII is found, how much non\-PII text is removed, and how quickly the notes are processed\. Dutch benchmarks use core PII recall; English benchmarks use annotation\-character recall because the external English datasets lack sub\-annotations\.Table 2 \| De\-identification performance on three annotated test setsThe hospital\-trained model has the highest recall on the hospital benchmark, whereas the synthetic\-trained model has the highest recall on the synthetic and primary\-care benchmarks\. Both models retain low non\-PII redaction, so their recall is not achieved by indiscriminately removing ordinary text\. Values are percentages\. Bold indicates the best\-performing model in each column; annotators are excluded from this comparison\. Results use metadata; dashes indicate that a system was not evaluated\. Corresponding 95% document\-clustered bootstrap confidence intervals are reported in Supplementary Table S4d\. Metadata\-free results and the non\-PII redaction decomposition are reported in Supplementary Tables S4a–c\.

Table 3 \| External synthetic English portability benchmarksThe synthetic\-trained MedDeID English model has the highest recall on both benchmarks\. Systems with lower non\-PII redaction generally miss more annotated PII\.\*Raw non\-PII redaction rates are shown\. ASQ\-PHI leaves explicit ages below 90 unannotated, so redacting these ages increases this rate\. To compare the systems fairly, we recalculated the rate for every system after excluding the same age characters\. MedDeID’s rate after excluding these ages was 0\.89% \(0\.75–1\.03%\), second to OBI RoBERTa i2b2 at 0\.55% \(0\.45–0\.66%\); the full comparison is reported in Supplementary Table S12\. The comparison therefore supports portability to synthetic English data while showing why recall and benchmark taxonomy must be read together; it does not establish performance on real English clinical text\. Values are percentages\. Recall is label\-agnostic annotation\-character recall\. Bold indicates the best result in each column\. Corresponding 95% document\-clustered bootstrap confidence intervals are reported in Supplementary Tables S11–S12\. Full taxonomy\-aligned sensitivity results are reported in Supplementary Section S10\.

Fig\. 2 \| Stability across evaluation datasets\.Orange and blue circles show recall loss in each eligible perturbation cell formeddeid\-dutch\-uzaandmeddeid\-dutch\-synth, respectively; improvements are plotted at zero\. Diamonds show the average loss\. Within each benchmark, experiments containing more target spans contribute more to this average\. The overall average gives equal weight to each of the three benchmarks\. The synthetic\-trained model has the smaller mean loss in each benchmark and overall \(1\.2 versus 3\.0 percentage points\), whereas the hospital\-trained model shows both a larger average loss and the most extreme perturbation response\. Thus, the aggregate advantage reflects consistently greater stability rather than a single benchmark\. Lower values indicate greater stability\. Cell\-level effects, 95% confidence intervals and adjusted tests are reported in Supplementary Fig\. S9 and Tables S7b–d\.
Fig\. 3 \| Recall and processing time on the hospital benchmark\.Core PII recall versus the time required to de\-identify all 300 hospital notes; time is shown on a logarithmic scale\. Blue and orange markers denote CPU and GPU runs, respectively\. Measurements for the same system are connected\. The compact MedDeID neural models occupy the high\-recall, low\-runtime region, withmeddeid\-dutch\-uzaproviding the strongest combination\. GPU use shortens processing for several systems, but the locally deployed Qwen3\-8B remains both slower and less accurate than the compact models\.
Fig\. 4 \| MedDeID software and data workflow\.Shared schemas and language profiles connect data import or generation, annotation, training, inference, benchmark construction and evaluation through consistent JSONL and versioned model artefacts\. Annotated data can therefore support either model development or benchmark creation; trained models feed local inference, and their predictions return to the same evaluation contract\. This shared foundation turns otherwise separate tools into a repeatable workflow in which language profiles, datasets or models can change without rebuilding every stage\. GitHub and Hugging Face symbols indicate public code and model or data artefacts, respectively\.
## Supplementary Material

## Supplementary Information

MedDeID enables locally governed clinical\-text de\-identification from real or synthetic training data

Hellemans et al\.

This Supplementary Information provides extended dataset summaries, benchmark tables, additional analyses and figures, and the complete English annotation guideline in its original styled layout\. Both the Dutch\- and English\-language versions of the annotation guideline are available in the Zenodo archive[1](https://arxiv.org/html/2609.10049#as1_bib.bib1),[2](https://arxiv.org/html/2609.10049#as1_bib.bib2)\. All study methods are reported in the main manuscript\. Personally identifiable information is abbreviated as PII throughout; Antwerp University Hospital is abbreviated as UZA\.

Contents

- •S1\. Dataset summary — Fig\. S1, Table S1
- •S2\. Annotation scheme — Tables S2–S3
- •S3\. Benchmark results — Tables S4a–d
- •S4\. Per\-label performance — Table S5, Figs S2–S3
- •S5\. Label fidelity — Table S6, Fig\. S4
- •S6\. Perturbation stability — Tables S7a–d, Figs S5–S9
- •S7\. Non\-PII redaction — Fig\. S10
- •S8\. Model and timing specifications — Tables S8 and S9
- •S9\. Pseudonymisation validation — Tables S10a–b, Fig\. S11
- •S10\. English portability — Tables S11–S13
- •Appendix A\. Annotation guidelines

### S1\. Dataset summary

We compared annotation volume and mapped label composition across all six evaluation datasets \(Fig\. S1\)\. The clinical department or specialty composition of the hospital benchmark and development corpus is reported in Table S1\. Annotation density divides the number of gold spans by all documents or queries, including the 219 ASQ\-PHI hard\-negative queries without annotations\. The composition analysis maps the canonical labels to nine broad categories solely to support comparison across taxonomies\. It is descriptive: differences can reflect clinical setting, document type, synthetic\-generation design and source\-label coverage, and should not be interpreted as estimates of identifier prevalence in clinical practice\.

Hospital benchmark composition\.Of the 579,920 characters in the 300\-note hospital benchmark, 55,379 \(9\.55%\) fall within a gold annotation and 42,093 contribute to the core PII denominator; the remaining 524,541 characters form the denominator for the non\-PII redaction rate\. For comparison, the open synthetic benchmark contains 419,578 characters, including 37,443 core PII characters\.

Fig\. S1 \| PII annotation volume and composition across evaluation datasets\.a, Absolute numbers of mapped gold PII spans on a logarithmic scale\.b, Gold spans per document or query\.c, Percentage composition after mapping canonical labels to nine broad categories\. Although the primary\-care benchmark contains 100 notes, compared with 300 in the hospital, Dutch synthetic and English synthetic benchmarks, its longer notes yield the highest annotation density \(40\.1 gold annotations per note\)\. The benchmarks differ by several orders of magnitude and by identifier mix, showing why performance must be tested across datasets rather than inferred from a single benchmark\. Counts refer to annotation records; overlapping source annotations are retained\. In the dataset labels,nndenotes the number of evaluated documents or queries\.
#### Table S1 \| Clinical specialty distribution in the hospital datasets

Clinical department or specialtyHospital benchmark, nDevelopment corpus, nNot available42357Cardiology20318Otorhinolaryngology \(ear, nose and throat\)19218Paediatrics17210Orthopaedics17187Ophthalmology16118Emergency admissions15209Gastroenterology and hepatology14161Neurology11122Pulmonology9125Thoracic and vascular surgery9109Urology978Neurosurgery877Magnetic resonance imaging \(MRI\)846Oncology7141Gynaecology793Haematology6100Intensive care5291Abdominal, paediatric and plastic surgery582Cardiac surgery575Hepatobiliary, transplant and endocrine surgery557Endocrinology, diabetology and metabolism4103Physical and rehabilitation medicine437Dermatology386Immunology, allergology and rheumatology356Radiology355Gynaecological oncology341Nuclear medicine336Pain centre335Oral and maxillofacial surgery318Fertility medicine312General internal medicine2275Neonatology226Central phlebotomy222Dentistry26Anaesthesiology168Nephrology outpatient clinic139Sleep centre129Obstetrics120Geriatrics113Cardiac rehabilitation19Psychiatry0240Thoracic oncology032Medical genetics014Chronic dialysis centre07Tropical medicine05Multidisciplinary sports medicine centre03Clinical biology laboratory02Hearing and speech rehabilitation02Stomatology and maxillofacial surgery02Sexual Assault Care Centre02Medical check\-up01The clinical department or specialty was available for 258 of 300 notes \(86\.0%\) in the hospital benchmark and 4,113 of 4,470 notes \(92\.0%\) in the hospital development corpus\. The benchmark included 40 distinct mapped departments or specialties, compared with 51 in the development corpus\. Counts use English translations of the source labels; missing or unmapped information is retained as “Not available”\. Psychiatry and general internal medicine were deliberately enriched in the development corpus with small additional note sets\. These counts therefore describe the study corpus and not the underlying distribution of hospital documentation\.

### S2\. Annotation scheme

The annotation scheme has two levels\. A span\-level label records what type of identifier was found and, where relevant, the entity to whom it refers \(Table S2\)\. A character\-level sub\-annotation then records the role of each part of that span \(Table S3\)\. This second layer separates the characters that carry identifying information from punctuation, titles and clinically useful context captured inside the same span\.

The scheme draws on the NIH/NLM Scrubber clinical\-text annotation guidelines[3](https://arxiv.org/html/2609.10049#as1_bib.bib3),[4](https://arxiv.org/html/2609.10049#as1_bib.bib4), the HIPAA 18\-identifier set[5](https://arxiv.org/html/2609.10049#as1_bib.bib5), and the GraSCCo/GeMTeX framework[6](https://arxiv.org/html/2609.10049#as1_bib.bib6),[7](https://arxiv.org/html/2609.10049#as1_bib.bib7), adapted to the Belgian and Dutch context\. The complete rulebook with worked examples is Appendix A\. Use ofAnonymize\_Otherwas deliberately minimised and treated as a signal that a span required further consideration rather than as a destination label\.

The character\-level sub\-annotation scheme used to define the core PII denominator is illustrated below\. These sub\-annotations are applied within the span\-level annotation labels described in Appendix A\.

How sub\-annotations define core PII content

ExampleFull annotated spanCharacters countedNameDr\.⊔\\sqcupEmma⊔\\sqcupPeetersEmmaPeetersExcluded: title and both whitespace characters\.Telephone\+32⊔\\sqcup\(0\)493⊔\\sqcup23⊔\\sqcup20⊔\\sqcup82493232082Excluded: country code, trunk\-prefix notation, punctuation and all whitespace\.OrganisationGeneral⊔\\sqcuppractice⊔\\sqcupDe⊔\\sqcupLindeDeLindeExcluded: descriptive context and every whitespace character\.Core

included in core PII recall

Excludedomitted from core PII recall

Sub\-annotation schematic\.The symbol⊔\\sqcupmarks a literal space, which remains part of the full span but is excluded from the core PII denominator\. Dark boxes are included and light boxes are excluded\. The right\-hand strings concatenate included characters for illustration; evaluation uses their original offsets\.

#### Table S2 \| Annotation labels and definitions

Annotation labelDefinitionName:PatientGiven names, family names or initials referring to the patient whose record is being annotated\.Name:CaregiverNames or initials of clinicians and other healthcare or social\-care workers involved in care\. A directly adjacent professional title may be included in the span\.Name:OtherNames or initials of relatives, friends, other patients and external people who are not care providers\.Address\_Location:PatientPostal addresses and other locations officially linked to the patient, including home address and place of birth\.Address\_Location:CaregiverAddresses or locations linked to a caregiver or care institution when they are not part of the organisation name\.Address\_Location:OtherAddresses and locations linked to relatives, external bodies, events, accidents or travel\.Organization:HealthcareNamed healthcare or social\-care organisations, insurers, departments, units and institution\-specific locations relevant to the patient\.Organization:OtherNamed non\-healthcare organisations such as employers, companies, schools, clubs and associations\.DateCalendar dates or date fragments, including public holidays and weekdays when directly attached to a date\.Age\_BirthdateA date of birth or an expressed age, including the accompanying age unit\.ProfessionOccupation, professional status, education, voluntary role or hobby of the patient or a relative; treating\-caregiver specialisms are excluded\.ContactdetailsCommunication details such as e\-mail addresses, telephone or fax numbers, pagers and URLs; postal addresses are labelled asAddress\_Location\.ID:PatientIdentifiers traceable to the patient, including patient or national\-register numbers, record identifiers, study identifiers and patient\-specific access links\.ID:CaregiverIdentifiers assigned to a professional, such as a registration, licence or institutional staff number\.Anonymize\_OtherExceptional identifying information that materially raises re\-identification risk but does not fit another label\.Concise definitions are shown here; the complete annotation rules and worked examples are provided in Appendix A\.

#### Table S3 \| Sub\-annotations included in core PII recall

Sub\-annotationParent annotation\(s\)DefinitionCore PII?Context and span structureformattingAnyNon\-identifying separators and syntax, including whitespace, punctuation, brackets and telephone\-formatting or country\-code characters\.Noadditional\_infoAnyNon\-identifying descriptive or contextual words captured within the annotation boundary\.Nomedical\_infoAnyClinical information included inside a broader annotated span but not identifying on its own\.NoPerson\-name componentsgivenName; ContactdetailsGiven\-name component of a person name or contact identifier\.YesfamilyName; ContactdetailsFamily\-name component of a person name or contact identifier\.YesinitialsName; ContactdetailsInitials representing a person’s given or family names\.YestitleNameHonorific or professional title adjacent to a name, such as “Dr” or “Prof”\.NoProfessional and social contexthobbyProfessionRecreational, educational or voluntary activity used as a personal descriptor\.YesprofessionProfessionOccupation, job title, educational field or named professional role\.Yesemployment\_stateProfessionEmployment\-status descriptor such as retired, unemployed or self\-employed\.YesOrganisation componentscompanyOrganizationNamed commercial company or employer\.YesinstitutionOrganization; ContactdetailsNamed \(healthcare\) institution, including an institution\-identifying component of an e\-mail address or URL\.Yeshospital\_locationOrganizationInstitution\-specific campus, department, ward, unit or room/location code\.YesAddress and geographic componentscountryAddress\_LocationCountry component when it occurs within an annotated address or location\.YesprovinceAddress\_Location; OrganizationProvince or equivalent first\-level administrative area\.YesregionAddress\_Location; OrganizationNamed region or other subnational area distinct from a province\.YesmunicipalityAddress\_Location; OrganizationCity, town, village or municipality\.Yespostal\_codeAddress\_LocationPostal or ZIP code\.YesstreetAddress\_LocationStreet or road name\.Yeshouse\_numberAddress\_LocationBuilding or house number\.Yesbus\_numberAddress\_LocationApartment, unit or Belgian “bus” number\.Yespostal\_officeAddress\_LocationPost\-office, delivery\-office or locality suffix forming part of an address\.YesContact componentsinternal\_phoneContactdetailsInternal telephone extension or institution\-only telephone number\.Yespublic\_phoneContactdetailsPublicly dialable telephone or mobile number\.Yesfax\_numberContactdetailsFax number\.YesIdentifier componentspublic\_idIDExternally recognised person\-specific identifier, such as a national\-register or provider number\.Yesinternal\_idIDLocally assigned record, patient, admission, study or staff identifier\.YesCalendar, time and age componentsdayDate; Age\_Birthdate; IDDay component in a date, birth date or identifier\.YesweekDate; Age\_Birthdate; IDCalendar\-week component in a date, birth date or identifier\.YesmonthDate; Age\_Birthdate; IDMonth component in a date, birth date or identifier\.YesyearDate; Age\_Birthdate; IDYear component in a date, birth date or identifier\.YesweekdayDate; Age\_BirthdateNamed weekday when included with a calendar date or date of birth\.YestimeDate; Age\_BirthdateClock time occurring within a broader date or birth\-date span\.NoseasonDateNamed season in a season–year expression used as an imprecise calendar reference\.Yesage\_typeAge\_BirthdateLexical age unit or marker, such as “years”, “months” or “y”\.Yesage\_yearAge\_BirthdateAge component expressed in years\.Yesage\_monthAge\_BirthdateAge component expressed in months\.Yesage\_weekAge\_BirthdateAge component expressed in weeks\.Yesage\_dayAge\_BirthdateAge component expressed in days\.YesAll sub\-annotation categories are included in core PII recall unless marked “No”\. The five excluded categories areformatting,additional\_info,medical\_info,titleandtime\. Parent annotations indicate where each sub\-annotation was observed in this study and are not exhaustive\.

### S3\. Full Dutch benchmark results

Tables S4a–c report character\-level performance and Table S4d reports uncertainty for the primary Dutch benchmark outcomes; all values are percentages\. Tables S4a–c give point estimates for the full metric decomposition and both metadata configurations\. Table S4d gives intervals for core PII recall and non\-PII redaction in the metadata\-enabled configuration used in the main analysis\. For the hospital and primary\-care benchmarks, intervals are reported for every system\. The Dutch synthetic benchmark tests the complete workflow in\-domain; the uncertainty analysis therefore covered the headlinemeddeid\-dutch\-synthresult\. The narrower English tables retain their intervals inline\. Core PII recall is the percentage of identifying information hidden\. Its denominator excludes the five non\-identifying or clinically meaningful sub\-annotation categories listed in Table S3\. Overall recall instead covers all characters in the complete annotated PII spans, including those five categories\. The non\-PII redaction rate is the percentage of characters outside annotated PII spans that are redacted\. It is decomposed into characters redacted by*false\-positive spans*, which do not overlap any annotated PII span, and*PII boundary extensions*, the excess characters redacted by predicted spans that overlap an annotated PII span but extend beyond its boundary\. These two components sum to the total non\-PII redaction rate\. Metadata\-enabled rows are the deployed, main\-text configurations in which patient and caregiver names from note metadata are injected into the detection layer; dashes indicate not applicable\. The non\-PII denominator includes every evaluated document, including hard\-negative notes without gold PII\.

#### Table S4a \| Hospital benchmark \(300 notes\)

MethodMeta\.Core PII recall \(%\)Overall recall \(%\)Non\-PII redaction rate \(%\)False positives \(%\)Boundary extensions \(%\)meddeid\-dutch\-uza \(ours\)no98\.898\.40\.2260\.0670\.159meddeid\-dutch\-uza \(ours\)yes98\.998\.50\.2360\.0670\.168meddeid\-dutch\-synth \(ours\)no95\.394\.50\.8150\.6300\.185meddeid\-dutch\-synth \(ours\)yes96\.195\.20\.8250\.6300\.195Belgian DEDUCE \(ours\)no78\.577\.50\.5940\.4010\.193Belgian DEDUCE \(ours\)yes88\.085\.70\.6340\.4230\.211Qwen3\-8B \(Yang et al\.\)no81\.881\.40\.8720\.4510\.420Qwen3\-8B \(Yang et al\.\)yes84\.283\.60\.8770\.4510\.426deidentify \(Trienes et al\.\)no82\.874\.60\.5460\.5390\.007deidentify \(Trienes et al\.\)yes86\.478\.80\.5580\.5390\.019GLiNER\-PII \(Zaratiana et al\.\)no75\.075\.42\.1081\.7960\.313GLiNER\-PII \(Zaratiana et al\.\)yes76\.676\.82\.1131\.7960\.317DEDUCE \(Menger et al\.\)no65\.565\.80\.4650\.3170\.148DEDUCE \(Menger et al\.\)yes75\.974\.90\.5020\.3320\.169OpenAI privacy filterno66\.263\.30\.6070\.5270\.080OpenAI privacy filteryes72\.168\.50\.6110\.5270\.084OpenMed multilingual filterno37\.633\.50\.9460\.9270\.019OpenMed multilingual filteryes49\.144\.10\.9550\.9270\.028Annotator 1–98\.898\.50\.1740\.0070\.167Annotator 2–98\.598\.50\.3590\.1230\.236Values are percentages\. Meta\., metadata injection; non\-PII redaction is the sum of false positives and boundary extensions\. Annotator rows are descriptive\.

#### Table S4b \| Synthetic benchmark \(300 notes, openly released\)

MethodMeta\.Core PII recall \(%\)Overall recall \(%\)Non\-PII redaction rate \(%\)False positives \(%\)Boundary extensions \(%\)meddeid\-dutch\-uza \(ours\)no96\.295\.40\.3950\.1840\.210meddeid\-dutch\-uza \(ours\)yes96\.695\.80\.3950\.1840\.210meddeid\-dutch\-synth \(ours\)no99\.899\.70\.2790\.0460\.233meddeid\-dutch\-synth \(ours\)yes99\.899\.70\.2790\.0460\.233Belgian DEDUCE \(ours\)no65\.765\.40\.7910\.3090\.482Belgian DEDUCE \(ours\)yes70\.269\.61\.6961\.0890\.607Qwen3\-8B \(Yang et al\.\)no90\.490\.41\.2840\.4950\.790Qwen3\-8B \(Yang et al\.\)yes90\.990\.91\.2840\.4950\.790deidentify \(Trienes et al\.\)no74\.971\.80\.3710\.3060\.065deidentify \(Trienes et al\.\)yes76\.774\.50\.3710\.3060\.065GLiNER\-PII \(Zaratiana et al\.\)no82\.281\.91\.5801\.0240\.555GLiNER\-PII \(Zaratiana et al\.\)yes83\.083\.11\.5801\.0240\.555DEDUCE \(Menger et al\.\)no35\.636\.30\.4050\.2730\.132DEDUCE \(Menger et al\.\)yes45\.946\.10\.5760\.4080\.168OpenAI privacy filterno53\.353\.30\.5170\.3890\.128OpenAI privacy filteryes58\.958\.90\.5170\.3890\.128OpenMed multilingual filterno48\.846\.31\.0120\.9640\.048OpenMed multilingual filteryes53\.050\.61\.0120\.9640\.048Values are percentages\. Meta\., metadata injection; non\-PII redaction is the sum of false positives and boundary extensions\.

#### Table S4c \| Primary\-care external validation \(100 notes\)

MethodMeta\.Core PII recall \(%\)Overall recall \(%\)Non\-PII redaction rate \(%\)False positives \(%\)Boundary extensions \(%\)meddeid\-dutch\-uza \(ours\)no86\.784\.80\.2850\.2250\.060meddeid\-dutch\-uza \(ours\)yes87\.085\.00\.2880\.2270\.061meddeid\-dutch\-synth \(ours\)no89\.987\.01\.2191\.1440\.075meddeid\-dutch\-synth \(ours\)yes90\.387\.31\.2241\.1490\.075Belgian DEDUCE \(ours\)no73\.069\.30\.8810\.8290\.052Belgian DEDUCE \(ours\)yes74\.971\.20\.9050\.8550\.050Qwen3\-8B \(Yang et al\.\)no58\.458\.00\.3060\.1510\.155Qwen3\-8B \(Yang et al\.\)yes60\.860\.00\.3120\.1560\.156deidentify \(Trienes et al\.\)no67\.962\.45\.7275\.6500\.077deidentify \(Trienes et al\.\)yes68\.662\.95\.7285\.6510\.077GLiNER\-PII \(Zaratiana et al\.\)no70\.169\.13\.4233\.3270\.095GLiNER\-PII \(Zaratiana et al\.\)yes70\.469\.43\.4243\.3280\.095DEDUCE \(Menger et al\.\)no54\.452\.40\.5220\.4780\.044DEDUCE \(Menger et al\.\)yes57\.254\.90\.5430\.4960\.047OpenAI privacy filterno64\.561\.911\.46111\.2960\.165OpenAI privacy filteryes66\.963\.911\.46411\.2990\.165OpenMed multilingual filterno34\.131\.48\.2448\.2360\.008OpenMed multilingual filteryes37\.133\.98\.2478\.2380\.009Values are percentages\. Meta\., metadata injection; non\-PII redaction is the sum of false positives and boundary extensions\.

#### Table S4d \| Confidence intervals for Dutch benchmark outcomes

BenchmarkMethodCore PII recall, % \(95% CI\)Non\-PII redaction, % \(95% CI\)Hospitalmeddeid\-dutch\-uza \(ours\)98\.9 \(98\.5–99\.3\)0\.24 \(0\.16–0\.32\)Hospitalmeddeid\-dutch\-synth \(ours\)96\.1 \(95\.3–96\.9\)0\.83 \(0\.64–1\.03\)HospitalBelgian DEDUCE \(ours\)88\.0 \(86\.6–89\.4\)0\.63 \(0\.46–0\.84\)HospitalQwen3\-8B \(Yang et al\.\)84\.2 \(82\.0–86\.4\)0\.88 \(0\.71–1\.09\)Hospitaldeidentify \(Trienes et al\.\)86\.4 \(85\.0–87\.7\)0\.56 \(0\.37–0\.80\)HospitalGLiNER\-PII \(Zaratiana et al\.\)76\.6 \(74\.8–78\.4\)2\.11 \(1\.87–2\.38\)HospitalDEDUCE \(Menger et al\.\)75\.9 \(74\.0–77\.9\)0\.50 \(0\.34–0\.70\)HospitalOpenAI privacy filter72\.1 \(69\.5–74\.6\)0\.61 \(0\.41–0\.87\)HospitalOpenMed multilingual filter49\.1 \(47\.2–51\.0\)0\.96 \(0\.85–1\.06\)Syntheticmeddeid\-dutch\-synth \(ours\)99\.8 \(99\.5–100\.0\)0\.28 \(0\.21–0\.35\)Primary caremeddeid\-dutch\-uza \(ours\)87\.0 \(83\.9–90\.0\)0\.29 \(0\.23–0\.38\)Primary caremeddeid\-dutch\-synth \(ours\)90\.3 \(88\.4–92\.3\)1\.22 \(0\.88–1\.71\)Primary careBelgian DEDUCE \(ours\)74\.9 \(71\.4–78\.4\)0\.90 \(0\.67–1\.20\)Primary careQwen3\-8B \(Yang et al\.\)60\.8 \(56\.1–65\.5\)0\.31 \(0\.18–0\.51\)Primary caredeidentify \(Trienes et al\.\)68\.6 \(62\.6–74\.1\)5\.73 \(2\.13–9\.54\)Primary careGLiNER\-PII \(Zaratiana et al\.\)70\.4 \(67\.2–73\.3\)3\.42 \(2\.57–4\.37\)Primary careDEDUCE \(Menger et al\.\)57\.2 \(51\.7–62\.6\)0\.54 \(0\.40–0\.67\)Primary careOpenAI privacy filter66\.9 \(62\.7–71\.2\)11\.46 \(3\.03–20\.33\)Primary careOpenMed multilingual filter37\.1 \(34\.5–39\.8\)8\.25 \(3\.64–13\.22\)Values are point estimates with 95% percentile\-bootstrap confidence intervals in parentheses\. Complete documents were sampled with replacement in 10,000 replicates, using the same document multiplicities for every system within each analysis; rates were recalculated from summed character counts\. Metadata\-enabled configurations are shown\. Hospital and primary\-care analyses include every system; the Dutch synthetic analysis includes the headlinemeddeid\-dutch\-synthresult only\. The annotator comparison is descriptive\.

### S4\. Per\-label performance

#### Table S5 \| Core PII recall by gold label in hospital notes

Gold labelSpansUZASynth\.Bel\. DEDUCEQwen3\-8BOpenAIAnn\. 1Ann\. 2Date146399\.999\.787\.577\.882\.599\.398\.8Name:Caregiver102399\.495\.392\.987\.084\.799\.299\.4Name:Patient337100\.098\.296\.898\.597\.4100\.0100\.0Age\_Birthdate33599\.498\.687\.389\.877\.799\.196\.7ID:Patient31496\.894\.179\.478\.067\.998\.898\.9Organization:Healthcare29694\.777\.067\.362\.312\.693\.596\.4Contactdetails13299\.8100\.075\.692\.846\.4100\.099\.7Address\_Location:Patient127100\.099\.794\.289\.436\.0100\.0100\.0ID:Caregiver107100\.097\.573\.887\.476\.799\.397\.0Address\_Location:Caregiver81100\.099\.397\.290\.745\.199\.899\.8Profession3172\.747\.80\.028\.80\.073\.847\.8Name:Other12100\.090\.3100\.091\.073\.191\.0100\.0Organization:Other721\.466\.17\.117\.90\.071\.494\.6Address\_Location:Other4100\.082\.6100\.0100\.069\.6100\.0100\.0Values are percentages from metadata\-enabled configurations\. Gold span counts are shown because several categories are small and should not be over\-interpreted\. Abbreviations: UZA,meddeid\-dutch\-uza; Synth\.,meddeid\-dutch\-synth; Bel\. DEDUCE, Belgian DEDUCE; Ann\., annotator\.

For gold\-label categories containing more than 100 spans,meddeid\-dutch\-uzaachieved recall of at least 96\.0%, except for Organization:Healthcare \(94\.7%; 296 spans\)\. Recall was 100\.0% for patient names, caregiver identifiers, and patient and caregiver addresses\. Lower recall was observed for Profession \(72\.7%; 31 spans\) and Organization:Other \(21\.4%; 7 spans\)\. These estimates are based on small numbers of spans and should be interpreted cautiously\. The two annotators also differed for these small categories\. For Profession, they identified 73\.8% and 47\.8% of the annotated text; for Organization:Other, they identified 71\.4% and 94\.6%\.

The general\-purpose OpenAI neural PII detector achieved 12\.6% recall for healthcare organisations and 0\.0% for professions; Belgian DEDUCE also achieved 0\.0% for professions\. These categories are not represented in the corresponding general\-purpose or rule\-based detector taxonomies\.

Fig\. S2 \| Recall by gold label, hospital benchmark\.Core PII recall for each system and gold\-label category\. Cell values are percentages; circle area at left represents the character\-level core PII denominator, with the exact character count shown beside it\. The strongest systems perform consistently on common names, dates and identifiers, but differences widen for rarer or clinically specific categories\. Overall recall therefore conceals category\-specific gaps\. Rows with few gold spans should be interpreted cautiously\.Fig\. S3 \| Recall by sub\-annotation category, hospital benchmark\.Character recall by gold sub\-annotation category\. Cell values are percentages\. The two leftmost columns show the physician annotators\. Circle area represents the number of gold sub\-annotation characters, with the exact count printed beside each category\.

### S5\. Span detection and label fidelity

Core PII recall measures the fraction of core identifying characters redacted, irrespective of the predicted label\. To analyse span\-level detection and label assignment separately, predictions and annotations were paired one\-to\-one when their core\-PII character positions overlapped\. Label fidelity is the proportion of detected spans assigned the correct identifier type and role\. The confusion matrices include only detected spans; missed annotations are reflected in the span detection\-recall values in Table S6\. Only gold spans containing at least one core\-PII character entered this analysis\. Table S6 therefore includes 4,263 of the 4,269 hospital annotation records and 4,008 of the 4,010 primary\-care records; the remaining six and two records, respectively, contained only sub\-annotations excluded from core PII recall\.

#### Table S6 \| Span detection and label fidelity

All values use the metadata\-enabled configuration and the matching current evaluator export for each benchmark\.

Fig\. S4 \| Exact\-label confusion among detected PII spans\.Columns compare the hospital\-trainedmeddeid\-dutch\-uzaand synthetic\-trainedmeddeid\-dutch\-synth\.a,b, Hospital benchmark;c,d, primary\-care benchmark\. Rows are reference labels and columns are predicted labels\. Percentages are normalised within detected spans; blue diagonal cells indicate exact\-label assignment and orange off\-diagonal cells indicate misclassification\. Circle area shows the number of annotated spans and blue fill the detected fraction; exact detected / annotated counts are printed alongside\.

### S6\. Stability under input perturbations

Coverage\-selected subsets of up to 100 notes per scope were perturbed along name source, name capitalisation, name format, date format, date value and age format\. Asterisks below indicate statistically significant degradation; interval construction and hypothesis testing are described in Methods\.

Sign convention\.Tables S7b–c report recall loss as baseline minus perturbed recall: positive values therefore indicate worse performance\.Losses onlyandworst dropare non\-negative loss magnitudes\. Table S7d instead reports recall change as perturbed minus baseline recall: negative values indicate worse performance and positive values indicate an improvement\.

#### Table S7a \| Perturbation\-analysis sample sizes

Test setNotes selected for testing \(nn\)Baseline–perturbation span pairs per analysis \(nn, range\)Notes represented per analysis \(nn, range\)Hospital10027–51919–98Synthetic10030–50823–97Primary care10087–112728–91For each test set, 100 notes were selected to cover the six perturbation dimensions\. An analysis included only notes containing the relevant target identifier\. Ranges give the smallest and largest sample sizes across the nine analyses listed for that test set in Table S7d\. A span pair is the same identifier in the original and perturbed note\.

#### Table S7b \| Aggregate stability across test sets

ModelBaseline recall \(%\)Net loss \(pp\)Losses only \(pp\)Worst drop \(pp\)Significant cellsmeddeid\-dutch\-uza \(ours\)97\.82\.872\.9619\.237 / 27meddeid\-dutch\-synth \(ours\)96\.90\.601\.254\.565 / 27Each model contributes 27 cells\. Positive loss denotes worse performance\.Net lossis the signed, target\-span\-weighted mean of baseline minus perturbed recall;losses onlyuses the same weighting but replaces gains with zero\. Metrics are calculated within each test set and then averaged equally across the three test sets\. Significant cells have Benjamini–Hochberg\-adjustedq<0\.05q<0\.05\. Formeddeid\-dutch\-synth, perturbations caused 1\.25 pp of average loss, while gains in other analyses reduced the net loss to 0\.60 pp\.

#### Table S7c \| Aggregate stability by test set

ScopeModelBaseline \(%\)Net loss \(pp\)Worst drop \(pp\)Significant cellsHospitalmeddeid\-dutch\-uza \(ours\)99\.12\.667\.532 / 9Hospitalmeddeid\-dutch\-synth \(ours\)95\.20\.454\.022 / 9Syntheticmeddeid\-dutch\-uza \(ours\)98\.23\.0319\.234 / 9Syntheticmeddeid\-dutch\-synth \(ours\)99\.90\.322\.861 / 9Primary caremeddeid\-dutch\-uza \(ours\)96\.32\.937\.771 / 9Primary caremeddeid\-dutch\-synth \(ours\)95\.51\.034\.562 / 9Positive loss denotes worse performance\. Each test set contributes nine cells per model\. Significant cells have Benjamini–Hochberg\-adjustedq<0\.05q<0\.05\.

#### Table S7d \| Cell\-level recall changes under perturbation

ScopeDimensionRolennpairsnnnotesHospital\-trained modelΔ\\Deltarecall, pp \(qq\)Synthetic\-trained modelΔ\\Deltarecall, pp \(qq\)Hospitalage\_formatage2719\-7\.53 \(0\.126\)\-3\.70 \(0\.982\)Hospitalcapitalizationcaregiver16466\-1\.52 \(0\.086\)\-3\.81\* \(0\.044\)Hospitalcapitalizationpatient4032\-3\.75 \(0\.342\)\+4\.17 \(1\.000\)Hospitaldate\_formatdate51998\-0\.66 \(0\.099\)\+0\.25 \(1\.000\)Hospitaldate\_value\_shiftdate41196\-4\.83\* \(0\.001\)\-4\.02\* \(0\.001\)Hospitalformatcaregiver16166\-6\.83\* \(0\.033\)\+2\.91 \(1\.000\)Hospitalformatpatient4032\-2\.50 \(0\.126\)\+14\.50 \(1\.000\)Hospitalname\_sourcecaregiver16466\+0\.40 \(0\.735\)\+1\.34 \(1\.000\)Hospitalname\_sourcepatient4032\-2\.30 \(0\.086\)\+2\.80 \(1\.000\)Syntheticage\_formatage8784\-1\.51 \(0\.333\)\-0\.57 \(0\.982\)Syntheticcapitalizationcaregiver3225\-8\.33 \(0\.086\)\-2\.86 \(0\.839\)Syntheticcapitalizationpatient9189\-6\.04\* \(0\.008\)\-0\.55 \(0\.982\)Syntheticdate\_formatdate50897\-0\.46 \(0\.099\)\-0\.50\* \(0\.001\)Syntheticdate\_value\_shiftdate35786\-2\.10\* \(0\.001\)\-0\.16 \(0\.063\)Syntheticformatcaregiver3023\-9\.00\* \(0\.040\)\+3\.33 \(1\.000\)Syntheticformatpatient9189\-19\.23\* \(0\.001\)\-0\.00 \(1\.000\)Syntheticname\_sourcecaregiver3225\-1\.01 \(0\.413\)\-0\.50 \(0\.982\)Syntheticname\_sourcepatient9189\-0\.09 \(0\.550\)\-0\.00 \(1\.000\)Primary careage\_formatage8728\-4\.94 \(0\.333\)\-0\.56 \(0\.982\)Primary carecapitalizationcaregiver23653\-2\.68 \(0\.213\)\-4\.56 \(0\.487\)Primary carecapitalizationpatient16343\-1\.02 \(0\.333\)\+2\.51 \(1\.000\)Primary caredate\_formatdate112791\+0\.64 \(0\.785\)\-0\.96\* \(0\.008\)Primary caredate\_value\_shiftdate98487\-7\.77\* \(0\.001\)\-4\.06\* \(0\.001\)Primary careformatcaregiver22953\-5\.66 \(0\.291\)\+2\.42 \(1\.000\)Primary careformatpatient16343\+0\.03 \(0\.550\)\+7\.61 \(1\.000\)Primary carename\_sourcecaregiver23653\-0\.43 \(0\.413\)\+2\.16 \(1\.000\)Primary carename\_sourcepatient16343\-2\.28 \(0\.414\)\-0\.05 \(0\.982\)Recall change is perturbed minus baseline recall; negative values denote worse performance\. Parentheses contain Benjamini–Hochberg\-adjustedqqvalues; asterisks denoteq<0\.05q<0\.05\. Rows containing at least one significant degradation are bold\.

Substituting one set of names for another did not significantly reduce recall after multiple\-testing correction\. The main vulnerabilities were changes to name formatting and shifted date values, especially for the hospital\-trained model\. The synthetic\-trained model was more stable overall, although it was not better under every individual perturbation\.

a

b

Fig\. S5 \| Name recall by capitalisation\.a, Hospital benchmark\.b, Primary\-care benchmark\. Error bars show 95% note\-level cluster\-bootstrap confidence intervals\. Higher recall indicates better performance\. Descriptively, the largest reduction shown is for the synthetic\-trained model with all\-uppercase names in primary care; other capitalisation effects vary by model and benchmark\.Fig\. S6 \| Name recall by written format\.The models fail in different ways: initials cause the largest drop for the hospital\-trained model, whereas first\-name\-only forms reduce recall more for the synthetic\-trained model\.a, Hospital benchmark\.b, Primary\-care benchmark\. Error bars show 95% note\-level cluster\-bootstrap confidence intervals\.
ab

Fig\. S7 \| Date recall by written format\.Both models remain close to their unperturbed baselines across most written formats, so formatting alone explains little of the larger date\-stability differences\.a, Hospital benchmark\.b, Primary\-care benchmark\. Error bars show 95% note\-level cluster\-bootstrap confidence intervals\.
a

b

Fig\. S8 \| Date recall under year shifts\.Recall for the hospital\-trained model falls as dates are shifted towards earlier years, while the synthetic\-trained model remains comparatively stable\. This identifies date value, rather than merely formatting, as a source of sensitivity\.a, Hospital benchmark\.b, Primary\-care benchmark\. Shaded bands show 95% note\-level cluster\-bootstrap confidence intervals\.a

b

Fig\. S9 \| Cell\-level recall change under controlled perturbation\.Year\-shifted dates produce the clearest consistent degradation, particularly for the hospital\-trained model; most name effects include little or no change\.a, Hospital benchmark\.b, Primary\-care benchmark\. Points and horizontal lines show mean paired changes and 95% note\-level cluster\-bootstrap confidence intervals\. Negative values indicate worse performance\. Asterisks denote Benjamini–Hochberg\-adjustedq<0\.05q<0\.05in the 27\-cell cross\-scope family for each model\.

### S7\. Non\-PII redaction analysis

Fig\. S10 \| Absolute non\-PII redactions by predicted label in the hospital and primary\-care benchmarks\.a, Hospital benchmark, including the two human annotators\.b, Primary\-care benchmark; separate human\-annotator outputs were unavailable\. Cell colour indicates the absolute number of non\-PII characters redacted on a logarithmic scale shared by both panels; compact values are printed in non\-zero cells\. Empty cells represent zero\. Values above the columns show the exact total number of non\-PII characters redacted by each system or annotator\. Non\-PII redaction includes both false\-positive spans and extensions of predicted PII spans beyond the annotated boundaries\.
On primary\-care text, the OpenAI neural PII detector redacted 11\.46% of non\-PII characters and the OpenMed detector 8\.25%, compared with 0\.29% formeddeid\-dutch\-uza\(Table S4c\)\. Most of this excess came from false\-positive spans concentrated in a few predicted categories; boundary extensions made only a small contribution \(Tables S4a–c and Fig\. S10\)\.

### S8\. Model and timing specifications

#### Table S8 \| MedDeID training and model\-selection settings

“Same” repeats the first model\-column value\. Zero data\-loader workers made prefetching inapplicable\. Selected epoch counts determined final\-refit duration; benchmarks were withheld until final evaluation\.

#### Table S9 \| Time to de\-identify 300 hospital notes

SystemDeviceTime \(s\)Throughput \(notes/s\)meddeid\-dutch\-uza \(ours\)CPU320\.310\.937meddeid\-dutch\-uza \(ours\)GPU18\.3816\.322meddeid\-dutch\-synth \(ours\)CPU318\.740\.941meddeid\-dutch\-synth \(ours\)GPU18\.4716\.243Belgian DEDUCE \(ours\)CPU17\.9016\.760Qwen3\-8B \(Yang et al\.\)GPU11,411\.460\.026deidentify \(Trienes et al\.\)GPU100\.662\.980deidentify \(Trienes et al\.\)CPU5,483\.290\.055GLiNER\-PII \(Zaratiana et al\.\)CPU380\.250\.789GLiNER\-PII \(Zaratiana et al\.\)GPU34\.488\.700DEDUCE \(Menger et al\.\)CPU11\.0627\.125OpenAI privacy filterCPU1,156\.350\.259OpenAI privacy filterGPU145\.132\.067OpenMed multilingual filterCPU999\.850\.300OpenMed multilingual filterGPU72\.314\.149Warm end\-to\-end timings using the definition and computing environments described in Methods\.

### S9\. Pseudonymisation validation

The gold\-span evaluation supplied every Date and Age\_Birthdate span directly to the transformation layer, independently of detector recall\. The predicted\-span evaluation instead used the metadata\-enabledmeddeid\-dutch\-synthpredictions\. Both evaluations used a fixed creation date \(15 January 2025\), a\+371\+371\-day shift and birthdate\-to\-age replacement\.

#### Table S10a \| Gold\-span transformation and predicted\-span end\-to\-end failures

DatasetTargetGold spansGold\-transformfailed, n \(%\)Predicted end\-to\-endfailed, n \(%\)Gold spans withunredactedcharacters, n \(%\)SyntheticOverall16930 \(0\.00\)25 \(1\.48\)12 \(0\.71\)Date12810 \(0\.00\)22 \(1\.72\)9 \(0\.70\)Age/birthdate4120 \(0\.00\)3 \(0\.73\)3 \(0\.73\)UZAOverall179814 \(0\.78\)61 \(3\.39\)39 \(2\.17\)Date146313 \(0\.89\)33 \(2\.26\)26 \(1\.78\)Age/birthdate3351 \(0\.30\)28 \(8\.36\)13 \(3\.88\)Primary\-careOverall121936 \(2\.95\)73 \(5\.99\)29 \(2\.38\)Date104723 \(2\.20\)45 \(4\.30\)23 \(2\.20\)Age/birthdate17213 \(7\.56\)28 \(16\.28\)6 \(3\.49\)All percentages use gold Date and Age\_Birthdate spans as the denominator\. Gold\-transform failure isolates the deterministic transformation layer by supplying the gold span directly\. Predicted end\-to\-end failure counts a gold span unless one predicted span covers it completely, has the correct label and produces a protocol\-valid transformation\. Gold spans with unredacted characters are identifiers for which at least one original character remained outside the model’s predicted redactions\. These cases are included among end\-to\-end failures\. Other end\-to\-end failures were fully redacted but failed because the identifier was split across predictions, assigned the wrong label or transformed incorrectly\. Gold\-transform failures comprised 14 UZA cases and 36 primary\-care cases\.

Fig\. S11 \| Pseudonymisation failures with gold versus model\-predicted spans\.Paired rows use the same denominator of all gold Date and Age\_Birthdate spans\. Gold\-span rows bypass detection and isolate the deterministic transformation layer; predicted\-span rows evaluate the full end\-to\-end pipeline\. Stacked widths are failure rates, segment labels are counts and labels to the right give the total failure rate and count\. A colour\-blind\-friendly palette encodes failure mode\. The detailed format categories retain the transformation\-layer failure analysis in both setups\. No prediction overlap and incomplete coverage are the two modes that leave gold\-span characters unredacted and occur only in the predicted\-span setup\. Fragmented full coverage and incorrect labels can fail end to end without leaving source characters unredacted\. Gold\-span failures comprised 13 apostrophe\-year dates and one other invalid format in UZA; in primary care they comprised 12 apostrophe\-year dates, one trailing\-punctuation date, 22 other invalid formats and one birthdate that was not converted to age\.

#### Table S10b \| Age\-dependent retained granularity

AgeRetained granularity12 years or olderWhole years2 to less than 12 yearsYears and months6 months to less than 2 yearsMonthsMore than 90 days to less than 6 monthsMonths and weeksMore than 28 through 90 daysWeeks and days28 days or youngerDaysAge and birth\-date values are reduced more aggressively as age increases, while finer units are retained when clinically important in early childhood\. MedDeID Suite allows users to customise these groups and retained levels of detail for local clinical or governance requirements\.

### S10\. English synthetic benchmark results

Complete benchmark results are reported in Tables S11–S13\.

#### Table S11 \| Technetium\-I benchmark results

MethodAnnotation\-character recall, %Non\-PII redaction, %meddeid\-english\-synth\(ours\)99\.730 \(99\.725–99\.735\)1\.606 \(1\.605–1\.608\)GLiNER Multilingual PII97\.773 \(97\.754–97\.791\)3\.616 \(3\.610–3\.622\)OpenAI Privacy Filter96\.328 \(96\.307–96\.348\)0\.870 \(0\.869–0\.872\)OpenMed SuperClinical 434M94\.828 \(94\.817–94\.840\)1\.723 \(1\.721–1\.724\)OpenMed Multilingual Privacy Filter92\.032 \(91\.999–92\.065\)1\.086 \(1\.083–1\.089\)OBI RoBERTa i2b291\.595 \(91\.582–91\.608\)0\.868 \(0\.865–0\.870\)UCSF Philter88\.295 \(88\.285–88\.304\)0\.700 \(0\.699–0\.701\)Percentages include 95% document\-clustered bootstrap confidence intervals\. Technetium\-I is template\-generated with PHI in every document, so it is a reproducibility and scale test rather than clinical validation\.

#### Table S12 \| ASQ\-PHI benchmark results

MethodAnnotation\-characterrecall, %Raw non\-PIIredaction, %Non\-PII redaction afterexcluding ages, %meddeid\-english\-synth\(ours\)98\.90 \(98\.59–99\.19\)6\.21 \(5\.99–6\.43\)0\.89 \(0\.75–1\.03\)GLiNER Multilingual PII96\.32 \(95\.84–96\.78\)11\.52 \(11\.11–11\.93\)4\.29 \(3\.94–4\.65\)OBI RoBERTa i2b295\.45 \(95\.08–95\.80\)2\.01 \(1\.90–2\.12\)0\.55 \(0\.45–0\.66\)OpenMed Multilingual Privacy Filter75\.36 \(74\.18–76\.55\)4\.39 \(4\.10–4\.69\)3\.20 \(2\.92–3\.48\)UCSF Philter70\.89 \(70\.03–71\.75\)1\.80 \(1\.59–2\.01\)1\.80 \(1\.59–2\.01\)OpenAI Privacy Filter63\.48 \(62\.12–64\.80\)1\.19 \(1\.02–1\.36\)1\.18 \(1\.01–1\.35\)OpenMed SuperClinical 434M61\.67 \(60\.56–62\.81\)4\.85 \(4\.66–5\.03\)3\.43 \(3\.27–3\.59\)Recall and both non\-PII redaction columns are percentages with 95% document\-clustered bootstrap confidence intervals in parentheses\. The last column reports results after the same unannotated age expressions were excluded for every system, regardless of its predicted labels\. These expressions comprised 8,745 non\-gold characters across 878 queries and captured explicit numeric ages \(values 5–88, including two infant ages expressed in months\) written as year\-old or month\-old phrases,yooryshorthand,age N, compact age–sex expressions, or over/under thresholds; overlapping matches were merged\. None of these characters overlapped a gold annotation, and qualitative descriptors such aselderlyandadolescentsremained included\. For each system, redacted characters inside these age expressions were removed from the numerator while the original denominator of 119,651 non\-PII characters was retained\. Numerators after exclusion, in table order were 1,064, 5,137, 661, 3,826, 2,151, 1,411 and 4,101 characters\.

#### Table S13 \| Held\-out English benchmark with metadata injection

MethodRecall, %No metadataRecall, %Patient/caregiver metadataNon\-PII redaction, %With metadatameddeid\-english\-synth\(ours\)99\.96 \(99\.89–100\.00\)99\.96 \(99\.89–100\.00\)0\.009 \(0\.002–0\.017\)GLiNER Multilingual PII90\.27 \(88\.99–91\.42\)90\.59 \(89\.33–91\.75\)1\.831 \(1\.663–2\.001\)OBI RoBERTa i2b286\.64 \(85\.59–87\.70\)86\.73 \(85\.68–87\.78\)0\.194 \(0\.154–0\.237\)OpenMed SuperClinical 434M75\.10 \(73\.32–76\.81\)75\.12 \(73\.34–76\.83\)0\.480 \(0\.400–0\.563\)UCSF Philter70\.83 \(69\.45–72\.20\)70\.94 \(69\.56–72\.30\)0\.986 \(0\.899–1\.076\)OpenMed Multilingual Privacy Filter64\.26 \(62\.04–66\.45\)69\.45 \(67\.41–71\.48\)0\.347 \(0\.292–0\.405\)OpenAI Privacy Filter64\.38 \(61\.62–67\.17\)68\.45 \(65\.89–71\.01\)0\.051 \(0\.029–0\.076\)Values are percentages with 95% document\-clustered bootstrap confidence intervals in parentheses\. Metadata injection did not affect MedDeID recall or non\-PII redaction\. The largest recall gains were 5\.19 percentage points for OpenMed Multilingual and 4\.06 for OpenAI Privacy Filter\. As an in\-domain synthetic test, this 14\-label benchmark does not constitute clinical validation\.

## References

- 1Stig Hellemans, Tom Stroobants, Elyne Scheurwegs, Pieter Meysman, Philippe Jorens, and Kris Laukens\.MedDeID dutch synthetic corpus, synthetic benchmark and annotation guidelines, 2026a\.URL[https://doi\.org/10\.5281/zenodo\.21992866](https://doi.org/10.5281/zenodo.21992866)\.Dataset\.
- 2Stig Hellemans, Tom Stroobants, Elyne Scheurwegs, Pieter Meysman, Philippe Jorens, and Kris Laukens\.MedDeID english synthetic clinical corpus, benchmark and annotation guideline, 2026b\.URL[https://doi\.org/10\.5281/zenodo\.22129255](https://doi.org/10.5281/zenodo.22129255)\.Dataset\.
- 3Mehmet Kayaalp, Phong Sagan, Allen C\. Browne, and Clement J\. McDonald\.Guidelines for annotating personal identifiers in the clinical text repository of the national institutes of health\.Technical report, Lister Hill National Center for Biomedical Communications, U\.S\. National Library of Medicine, 2016\.
- 4Mehmet Kayaalp, Allen C\. Browne, Phong Sagan, Tyne McGee, and Clement J\. McDonald\.Challenges and insights in using HIPAA privacy rule for clinical text annotation\.In*AMIA Annual Symposium Proceedings*, pages 707–716, 2015\.
- 5Office for Civil Rights, U\.S\. Department of Health and Human Services\.Guidance regarding methods for de\-identification of protected health information in accordance with the HIPAA privacy rule\.Technical report, U\.S\. Department of Health and Human Services, 2012\.URL[https://www\.hhs\.gov/hipaa/for\-professionals/privacy/special\-topics/de\-identification/index\.html](https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html)\.Safe Harbor and Expert Determination methods\.
- 6Christina Lohr, Franz Matthies, Jakob Faller, Luise Modersohn, Andrea Riedel, Udo Hahn, Rebekka Kiser, Martin Boeker, and Frank Meineke\.De\-identifying GRASCCO: A pilot study for the de\-identification of the German medical text project \(GeMTeX\) corpus\.*Studies in Health Technology and Informatics*, 317:171–179, 2024a\.doi:10\.3233/SHTI240853\.
- 7Christina Lohr, Franz Matthies, Jakob Faller, Luise Modersohn, Andrea Riedel, Udo Hahn, Rebekka Kiser, Martin Boeker, and Frank Meineke\.GraSCCo\_PHI: Graz synthetic clinical text corpus with protected health information annotations\.Zenodo, version v1, 2024b\.URL[https://doi\.org/10\.5281/zenodo\.11502329](https://doi.org/10.5281/zenodo.11502329)\.
- 8Pieter Delobelle, Thomas Winters, Bettina Berendt, and François Remy\.RobBERT\-2023: Keeping Dutch language models up\-to\-date at a lower cost thanks to model conversion\.*Computational Linguistics in the Netherlands Journal*, 13:193–203, 2024\.
- 9Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov\.RoBERTa: A robustly optimized BERT pretraining approach\.*arXiv preprint arXiv:1907\.11692*, 2019\.doi:10\.48550/arXiv\.1907\.11692\.

Appendix A\. Annotation guidelines

Complete English annotation guideline

The following pages reproduce the guideline in its original styled layout\.