Redacting PHI from PDFs means deleting the identifying text, images and hidden data from the file itself, not covering them. Use a real redaction tool to remove each item, sanitize the document to strip metadata and hidden content, save a new copy, then prove the result by extracting its text and reading its metadata.
Why black boxes fail when redacting PHI from PDFs
A black box drawn over a patient name hides it from the eye but leaves it in the file. A PDF stores page content as separate objects: text, images and vector shapes stacked on top of each other. A rectangle is one more shape on the stack, and the text underneath it is still there for any program to read.
Adobe's own list of the types of redactable data in Acrobat Pro names this case directly. It counts "Hidden Text" as text "that is transparent, covered by other content, or matches the background color", and it lists overlapping objects as a separate category. A shape on top of a name turns the name into hidden text. It does not remove it.
That is why the usual recovery is so easy. Anyone who opens the file can select across the box and copy, run a text extractor, or search for a surname, and the name comes back. The same holds for a black highlight, a white box over a member ID, or a shape added in an image editor that saved the result back to PDF as a layer.
The other common failure is a black bar drawn on a page that was printed and scanned. That version does remove the text, because the scan is a new picture of the page. But it also turns every remaining word into an image, so the file loses its searchable text, and anything the bar did not fully cover is still legible to a person reading the scan.
Knowing which items to remove is a separate question. The post on the 18 HIPAA identifiers in one list walks through each one with document examples, so this post covers how to remove them, not which ones they are.
Redacting PHI from PDFs step by step
The order of the steps decides whether redaction works. Mark every item first, apply the redactions so the marked content is deleted, sanitize the file to remove hidden data, and save the result under a new name. Each step removes something the previous one leaves behind, so skipping one leaves a trace.
Adobe's help page for how to redact sensitive content in Acrobat Pro gives the basic sequence: open the Redact a PDF tool, choose Redact text and images, drag over the text or image, select Apply, choose whether to sanitize and remove hidden information, then save the sanitized document under a filename you enter. Other tools use different menus, but the same four stages apply.
- Work on a copy. Keep the original where your organization stores PHI and redact a duplicate. Adobe's page on redacting and sanitizing PDFs says redaction "is permanent and cannot be undone once applied and saved", so a mistake on the only copy cannot be fixed.
- Find every instance. Search for each name, member ID, account number and date you plan to remove, not only the ones you can see in the header. A patient's name on an EOB often repeats in the claim block, on each page footer and in the remarks.
- Mark, then apply. Marking an item only flags it. The content is deleted when you apply the redactions. A file saved with marks but no applied redactions still holds everything.
- Sanitize. The same Adobe page says redaction "removes only visible text and graphics" and that hidden data "must be sanitized separately". Adobe's guide to sanitizing PDFs in Acrobat Pro describes a Remove all option and a Selectively remove option for metadata, comments, hidden layers and similar content.
- Save as a new file. Give it a name that marks it as redacted, and never overwrite the original with it.
- Verify. Run the checks in the verification section below before the file leaves your hands.
A worked example
Take a fictional two-page EOB for an example patient, Dana Rivera, member ID XQW448812907, claim number CLM-2026-0041187, date of service 03/14/2026. All of these values are made up. The name appears in the header, the claim block and a page footer. The member ID appears twice. The date appears in the claim block and on each service line. A search for "Rivera" finds three hits, a search for "448812907" finds two, and a search for "03/14/2026" finds four. Each hit is marked and applied, the document is sanitized with Remove all, and the result is saved as eob-0041187-redacted.pdf.
What should PHI redaction software do?
PHI redaction software should delete content rather than cover it, find every instance of a term across the whole file, and remove the hidden data that a page view never shows. A tool that only lets you draw boxes, or that saves boxes as a layer, is an annotation tool, not a redaction tool.
These are the features worth checking before you rely on a tool:
| Feature | Why it matters for PHI |
|---|---|
| Removes text and images under the mark | A box over content is not removal |
| Search and redact across all pages | Names and IDs repeat in footers and remarks |
| Pattern search | Member IDs, phone numbers and dates follow patterns a reviewer can miss |
| Sanitize or remove hidden information | Metadata, comments, attachments and layers survive page-level redaction |
| Redacts images, not only text | Scanned pages hold PHI as pictures |
| Saves a new file | Keeps the original intact and the redacted copy separate |
| Batch processing | A sample set or a records request may run to hundreds of files |
The hidden-data list is longer than most people expect. Adobe's list of redactable data includes metadata such as the author's name and keywords, file attachments, bookmarks, comments and markups, form field data, hidden layers, an embedded search index, deleted or cropped content, and links, actions and JavaScripts. Any of those can carry a name or an ID. A cropped page, for example, can still hold the content outside the crop.
If you send redacted pages to an outside service, the software's job is only half the question. Whether that service should see the pages at all, and under what contract, belongs to the guide on choosing a BAA OCR vendor.
How do you verify a redacted PDF is clean?
You verify a redacted PDF by trying to recover what you removed. Extract all its text and search it for each name and ID, list the images it contains, and read its metadata. If any check returns a removed value, the redaction failed and the file must not be shared.
The checks below use free command-line tools. The pdftotext manual page describes a tool that converts PDF files to plain text, and its -layout option keeps the physical layout. The pdfinfo manual page says the tool prints the document's Info dictionary, which holds the title, subject, keywords, author, creator and producer, and that -meta prints the document-level metadata stream. The pdfimages manual page describes -list, which lists the images in a file instead of writing them out. ExifTool reads metadata from many file types, PDF among them.
Here is the checklist for the fictional example, with the example values from above:
# 1. Extract all text and search for each removed value
pdftotext -layout eob-0041187-redacted.pdf - | grep -i -E "rivera|dana"
pdftotext -layout eob-0041187-redacted.pdf - | grep -E "448812907|0041187|03/14/2026"
# 2. Count the text that is left, so an empty result is not mistaken for a pass
pdftotext eob-0041187-redacted.pdf - | wc -w
# 3. Read the Info dictionary and the metadata stream
pdfinfo eob-0041187-redacted.pdf
pdfinfo -meta eob-0041187-redacted.pdf
# 4. Read every metadata tag ExifTool can find
exiftool -a -G1 eob-0041187-redacted.pdf
# 5. List the images, to see which pages are pictures
pdfimages -list eob-0041187-redacted.pdf
Read the results this way. The two grep commands should print nothing. The word count should be greater than zero on a digital document, because a redacted EOB still has its column headings and amounts; a count of zero means the text layer is gone or was never there, and the next section explains why that matters. The pdfinfo and exiftool output should not show a patient's name in the title, subject, author or keywords fields. A title such as "Rivera EOB March" is a leak even when every page is clean, because the title travels with the file and shows in a viewer's document properties.
Search for fragments as well as whole values. Text extraction can split a member ID across two lines or insert spaces, so search for the last six digits as well as the full number. Then open the file in a viewer and look at every page, because the commands cannot read a name printed inside a picture.
Checking a whole de-identified set, rather than one file, is a separate task with its own sampling questions. The post on how to check that de-identified PHI stays de-identified covers that.
Scanned PDFs, OCR text layers and metadata: PDF redaction edge cases
Scanned and OCR'd PDFs hide PHI in more places than digital ones. A scanned page is a picture, so the name lives in pixels that text tools cannot see. An OCR'd scan adds an invisible text layer on top of the picture, so the name lives in two places, and redacting one leaves the other.
Scanned pages with no text layer
A scan straight from a copier usually holds one image per page and no text. Running pdftotext on it returns nothing, which looks like a clean result and proves nothing. Use pdfimages -list to confirm the pages are images, then check each page by eye. In the redaction tool, use image redaction or an area selection so the pixels under the mark are removed, not covered.
OCR text layers
A scan that has been through OCR carries a hidden text layer so the file can be searched. Adobe's list of redactable data describes hidden text as text that is transparent, and an OCR layer is exactly that. Redacting the visible picture of a name without removing the matching OCR text leaves the name searchable, and redacting the OCR text alone leaves the name visible. Search the text layer for each value, redact every hit, and redact the image area too. The guide to lab report OCR explains how OCR builds that text layer from a scanned report.
Metadata that tools cannot remove
Some tools that read metadata do not truly remove it from PDFs. The ExifTool documentation states that changes to PDF files are reversible "because the original metadata is never actually deleted from these files". Use ExifTool to read a PDF's metadata, and use the redaction tool's sanitize step to remove it.
Other places PHI survives
Fax headers printed across the top of each page carry the sender's name and phone number, and sometimes the patient's name in the cover subject. Attached files, such as a PDF of an intake form attached to a referral packet, keep their own content and their own metadata. Comments and sticky notes added during review often repeat a member ID. A filename such as rivera-dana-eob.pdf travels with the file even after the contents are clean.
Where redacted files go next
Redacted pages are often the raw material for a sample set used to test document software. The post on building de-identified sample documents for a pilot explains which layouts to include and how redaction marks can skew a test. Schema Care's free plan is for de-identified sample documents, and real patient pages wait for a paid plan, each of which includes a BAA, as Schema Care's plans and pricing show.