How to redact a case brief before sharing it

On NurseTide Legal, a case brief is visible to consultants before you hire one. It has to describe the case well enough for a nurse to judge whether it fits their specialty, without identifying the patient. This guide covers what to leave out, what to keep, and how to describe a case so it stays useful.

What counts as identifying

HIPAA's Safe Harbor de-identification standard (45 CFR 164.514(b)(2)) lists 18 types of identifiers to remove for the patient and their relatives, employers and household members:

1. Names
2. Geographic subdivisions smaller than a state: street address, city, county, ZIP code (the first three digits may stay in some cases)
3. All elements of dates except the year (birth, admission, discharge, death), and ages over 89
4. Telephone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate and license numbers
12. Vehicle identifiers, including license plates
13. Device identifiers and serial numbers
14. Web addresses (URLs)
15. IP addresses
16. Biometric identifiers, such as fingerprints and voiceprints
17. Full-face photographs and comparable images
18. Any other unique identifying number, characteristic or code

Safe Harbor also requires that you have no actual knowledge that what remains could identify the person. A rare condition plus a small town plus a news story can identify someone with no names at all.

What to keep: the clinical picture

A nurse needs enough to judge fit and scope:

• Age range and sex: "woman in her 70s", not a birth date
• Setting: "community hospital ICU", "skilled nursing facility", "freestanding ED"
• Relative timeline: "Day 1, 14:00", "post-op day 2", "about 6 hours after admission"
• Clinical course in plain terms: diagnosis, procedures, the deterioration or injury, and the outcome
• The nursing questions you want answered: escalation, monitoring, medication, documentation
• Specialties involved, which decide who sees the case first
• Record volume, approximate page count and record types, so proposals can price the work
• Which side you represent, the deliverable and your deadline

Before and after

Identifying: Mary Jones, 78, DOB 3/4/1947, admitted to St. Luke's in Springfield on 6/12/2025 after a fall at home on Elm Street. MRN 445821.

Redacted: Woman in her late 70s admitted to a community hospital after a fall at home. Developed a stage 4 sacral pressure injury over a 19-day stay. About 2,400 pages of records, including wound photographs.

Facility and party names

Consultants need to rule out conflicts: someone who works at the defendant hospital shouldn't review the case. On NurseTide Legal, facility, health system, physician group and insurer names go in the parties for the conflict check field, not in the brief. Consultants see that list and must confirm they have no conflict before proposing. Never put patient names there.

Checks before you publish

• The automatic check. When you post a brief, NurseTide Legal scans it for Social Security, phone and record numbers, email and street addresses, and full dates, and blocks publishing until they're removed. It warns about likely personal names and asks you to confirm they're not patients. It is a safety net, not a substitute for reading the brief.
• Read it as a stranger would. Could someone who knows the area or followed local news recognize the case?
• Leave out documents. Records are uploaded to the private workspace after you hire, not attached to the brief.

Redacting documents themselves

When you do need to share redacted documents, for example with a consultant before engagement terms are final, or in discovery:

• Use a real redaction tool that removes the underlying text. Black boxes drawn over a PDF leave the text in place, where it can be copied or searched.
• Check headers, footers, Bates stamps, file names and document metadata, which often carry names and record numbers.
• Flatten the file and search it for the patient's name and record number before sending.

After you hire, consultants work with the full records in an encrypted workspace that only your team and the consultant can open, and every view and download is logged. For what to request, see the medical record request checklist.

Frequently asked questions

Is a case brief subject to HIPAA?

HIPAA applies to covered entities and their business associates, and whether it reaches a law firm's case brief depends on the circumstances. Either way, state privacy laws, professional duties and your client's interests point the same way: keep identifying details out of anything shared before you hire.

Can I mention the state?

Yes. States are not identifiers under Safe Harbor, and the state often matters for expert qualification rules. Leave out the city and county.

What about dates? The timeline matters.

Keep the relative timeline (Day 1, Day 2, hours since admission) and the year if it matters to the standard of care. Exact dates can go to the consultant you hire, with the records.