How to anonymise case notes before using AI

The ICO’s test is not "is there a full name". It is whether a person is identifiable, directly or indirectly, taking into account all the means reasonably likely to be used. A care note usually identifies someone several times over. Work through the categories rather than scanning for names:

• People: the person, family members, carers, staff, professionals. Names, initials, nicknames and relationships ("mum", "her key worker Dan").
• Reference numbers: NHS number, local authority case reference, looked-after-child reference, placement reference, Ofsted URN, court case number.
• Places: home address, placement address, postcode, the name of a school, GP practice, hospital, day centre or care home.
• Health: diagnoses, medication names and doses, CAMHS or mental health services, disabilities.
• Dates: date of birth, but also dates of incidents, hearings, admissions and visits that pin a record to a person.
• Contact details: phone numbers, email addresses, social media handles.
• Free-text clues: a rare condition, an unusual job, "the only Somali family on the street". Rare combinations identify as surely as a name.

Copy the note into a document. Replace each identifier with a consistent placeholder, keeping the same placeholder for the same person throughout so the AI can still tell people apart:

Keep the mapping in a separate, secured document, never in the same file and never in the chat. Send only the placeholder version. When the AI returns its draft, put the real details back by hand, then delete the mapping if you no longer need it.

For a single short note this takes a few minutes. Done properly, it is a legitimate way to work, and it is exactly what the ICO describes as pseudonymisation.

• Misses. People check for names and forget the school, the street or the medication. One missed identifier undoes the whole exercise.
• Inconsistency. If "Amelia" becomes [PERSON_1] in one paragraph and [CHILD] in the next, the AI treats them as two people and the draft is wrong.
• Time. The point of using AI was to save time. Ten minutes of redaction before every note removes the saving, so people skip it.
• No record. If a regulator asks what was sent to the AI last March, a manual process has no answer.
• Restoring errors. Putting the real details back by hand introduces exactly the transcription mistakes the process was meant to avoid.

The DfE’s review of AI in case recording made the general point: "AI generated output can be inaccurate or lack nuance, and users must quality assure the output, which can be time consuming." Manual anonymisation adds a second layer of the same problem on the way in.

This distinction decides how much protection you have actually gained.

So in your hands the note is still personal data, and the mapping is the sensitive part: the ICO expects you to hold that additional information separately and keep it secure, because unauthorised reversal of pseudonymisation is a recognised harm. In the AI provider’s hands the picture changes:

That "may" is doing real work. It holds only if the recipient cannot reasonably re-identify the person from what you sent plus whatever else they have. A note with the name removed but the school, the street and a rare diagnosis left in is not anonymous. That is why the categories list above is long, and why a tool that only finds names is not enough.

Caredact automates the manual method and fixes its failure modes. The steps are the same; a machine does the tedious parts and a person does the judgement.

• Paste the note. Every category above is detected, including care-specific identifiers such as Ofsted URNs, looked-after-child references, school names and medication names, plus a learned layer that catches names and relationships in context.
• Review. Every detection is highlighted. You confirm, correct or add before anything is sent. Placeholders are numbered and consistent, so [PERSON_1] is the same person throughout.
• Send. Only the placeholder version goes to the AI, which runs in the UK.
• Export. The finished document comes back with the real details restored, fully redacted, or with only the categories you choose restored. The mapping is encrypted, never sent to the AI, and deleted when you finish or when the document reaches its retention date.
• Record. Every action is logged, so the question "what was sent and by whom" has an answer.

Whichever route you take, write it into the policy. Staff follow the route that is easiest, so make the compliant one the quick one.