Remove personal information before AI reads it

Before an AI tool reads a document, take out everything that points to one person: names, the numbers a government agency or a business assigned to them, contact details, bank and card numbers, file numbers, photographs and signatures. Then read what is left for the small facts that narrow a crowd to one.

Most lists skip that second pass, and an American study showed why it matters: a ZIP code, a birth date and a sex were enough to single out most of the country. So the answer to what personal information to remove before AI has two parts, the values and the combinations, and this guide takes them in that order.

The list below is built on the identifiers you meet on US paperwork. How to take them out of a file is covered in redacting a PDF so the words are really gone and the same job in Word. What a provider keeps once you upload is a separate question, answered for OpenAI in the guide to ChatGPT and your files.

What personal information to remove before AI: the list in one table

Seven groups cover almost everything an ordinary office document carries about a person. The left column is what the value is, the middle column is how it shows up on American paper, and the right column is where it tends to hide when you are sure you already got it.

What it is	On US paperwork	Where it hides
Names	Client, spouse, children, witnesses	Signature block, quoted email thread
Government numbers	SSN, ITIN, driver’s license, passport, Medicare number	Intake forms, W-9s, copies of ID
Contact details	Street address, email, cell number	Letterhead, forwarded headers, footers
Money	Routing and account numbers, card numbers	Direct deposit forms, invoices, voided checks
File numbers	Docket, claim, policy, medical record	Subject line, running header
Pictures and online traces	Face photos, signatures, IP addresses	Embedded images, screenshots, logs
Combinations	ZIP code, birth date, sex, job title	The narrative, almost always

Our grouping, from NIST SP 800-122 section 2.2 and HIPAA’s safe harbor list.

The first six rows are values with a shape. A search can find most of them, and most people remember most of them. The last row has no shape at all, which is why a document can pass every search you run and still describe exactly one human being.

Why the list starts before the upload

Everything in the table is cheaper to remove than to explain later. Once the file is in a chat, what happens to it depends on the account, the settings and the provider’s terms, and none of those are in your hands on the day something goes wrong. On a personal Claude account, for example, training is on unless you switch it off, and what Claude does with your data explains that switch.

What counts as PII in the United States, in NIST’s words

No American privacy statute defines personal information for every business at once. The definition most agencies and many companies borrow comes from NIST Special Publication 800-122, published in April 2010, which adopts the Government Accountability Office’s blend of two OMB memoranda.

It splits PII into two halves. The first is information that can be used to distinguish or trace a person’s identity: a name, an SSN, a date and place of birth, a mother’s maiden name, biometric records. The second is any other information linked or linkable to that person, and NIST gives medical, educational, financial and employment information as examples.

Linkable is the word that catches documents

The first half is what most people picture when they hear PII. The second half is where documents get caught. A memo that never names its subject but describes her employer, her role and the town she works in is full of linkable information, and NIST’s own list of examples includes geographical indicators, employment information and activities alongside the obvious numbers.

NIST also lists asset information such as an IP or MAC address, telephone numbers of every kind, and information identifying personally owned property, with a vehicle registration or title number as its example. A car accident file that has lost every name but kept the plate number has not lost the person.

Partial numbers still count

A footnote in the same section settles a question that comes up in every office. Partial identifiers, NIST says, such as the first few or last few digits of an SSN, are often considered PII, because they remain nearly unique and linkable to one individual. The last four digits are a shorter number, not an anonymous one.

NIST adds a point about combinations. A name next to a credit card number is more sensitive than either field alone, while data made up only of area codes and sex usually would not identify anyone. Sensitivity is a separate axis from identifiability, and which categories a state law treats as sensitive is its own subject, covered in our guide to sensitive personal information.

Numbers with an American shape: SSN, ITIN, EIN, license and passport

The government numbers are the part of the list everyone starts with, and for good reason: they are unique, they follow a person for life and several of them open a credit file. They also come in more varieties than people remember.

Number	What it looks like	Who issues it
Social Security number	Nine digits, usually written 3, 2, 4	Social Security Administration
ITIN	Nine digits, laid out like an SSN	IRS, for people who cannot get an SSN
EIN	Nine digits, usually written 2, 7	IRS, for businesses and other entities
Driver’s license or state ID	Letters and digits, different in every state	State motor vehicle agency
Passport number	Printed on the data page	US Department of State
Medicare number (MBI)	11 letters and digits	CMS

Sources: IRS pages on the ITIN and the EIN; CMS, Understanding the MBI format.

Everyone knows the SSN, and the FTC’s advice to companies, Protecting Personal Information, already limits it to required and lawful purposes, such as reporting employee taxes. The one that slips through is the ITIN. It is a nine digit taxpayer number for people who are not eligible for an SSN, it looks exactly like one, and a search for the letters SSN will not find it on a form that labels it TIN.

When a business number is a person’s number

The IRS calls the EIN a federal tax ID number for businesses, tax exempt organizations and other entities, and on a corporation’s return it is business information. A sole proprietorship, however, is not a separate entity from its owner. In a tax file for a plumber who works under his own name, the EIN on the invoices leads to one individual as directly as his SSN does.

The same goes for a single member LLC that exists to hold one person’s rental property. Treat the business number of a one person business as that person’s number, and the CPA file stops leaking through the side door. The tax documents where these numbers sit are walked through for CPA firms using AI.

The Medicare number that replaced the SSN on the card

Medicare used to identify beneficiaries with a number based on their Social Security number. Its replacement, the Medicare Beneficiary Identifier, is 11 characters long, mixes digits with capital letters and is generated at random, so it carries no hidden meaning. CMS’s own example is 1EG4-TE5-MK73.

Random does not mean harmless. An MBI identifies one beneficiary to every provider and insurer that bills Medicare, and HIPAA lists health plan beneficiary numbers as an identifier in their own right. Because its shape is new and unfamiliar, it is also easy to miss when you scan a page for numbers that look like SSNs. How that plays out in a medical office is the subject of which AI plans a practice can use under HIPAA.

Contact details and the address lines people forget

Contact details are easy to find on the first page and easy to miss everywhere else. The client’s address is in the reference line; it is also in the footer of the letter they sent, in the header of the email you forwarded to yourself and in the signature block under their reply.

A single email thread can carry the addresses of everyone copied on it. A Word draft can keep one that somebody struck out, stored as a tracked deletion until someone accepts or rejects the change.

HIPAA’s safe harbor rule is the strictest American standard on geography, and it is useful even outside health care. It removes every geographic subdivision smaller than a state: street address, city, county, precinct and ZIP code. A three digit ZIP prefix may stay only if the area behind it is home to over 20,000 residents; smaller areas get 000 instead.

Email addresses are names with an at sign

An address such as m.tennerby@example.com is a surname with punctuation around it. Replacing the name in the body and leaving the email in the signature undoes the work. The same is true of a personal website, a LinkedIn profile link or a handle in a screenshot, all of which HIPAA covers under web addresses.

Phone numbers deserve the same care. Business letterhead usually shows the firm’s own lines, which are not the issue, but intake notes, callback messages and text transcripts carry the client’s cell number. Where the document started as a Word file, the headers and footers are a separate part of the file, which the Word guide explains.

Routing numbers, account numbers and cards

A bank routing number identifies a bank, not a person, and on its own it is printed on millions of checks. Put an account number beside it and you have pinned down one account, which has an owner. Direct deposit forms, voided checks attached to onboarding packets, ACH authorizations and settlement letters carry both side by side.

Card numbers are the obvious case, and the partial number is the less obvious one. Receipts and statements show the last four digits, which is fine on paper and still a nearly unique fragment when it sits next to a name and a date. NIST singles out the name and card combination as more sensitive than either field.

What a court already asks for

Federal courts have drawn this line for their own filings: Federal Rule of Civil Procedure 5.2 trims a financial account number to its final four digits in a filing, and the Word guide above sets out what else it trims. A court rule is written for a public docket, though, and a summary request to an AI tool rarely needs even four digits.

Amounts are a different matter. A payment of $1,250 is not an identifier. A settlement of $1,437,209.18 paid on a named day might be, for anyone who worked on the file. The combination section below comes back to this, and a loss notice with its numbers covered is on the page for agents and brokers.

File numbers: the docket, the claim, the chart

A file number is a pointer. On its own it looks like noise; followed to its source, it opens a record with a name at the top. Federal civil case numbers such as 2:25-cv-01487 lead to a public docket that lists the parties, and many state court systems publish their dockets too. In a memo, the case number is the client’s name by lookup.

Claim numbers and policy numbers work the same way inside an insurer or an agency. A medical record number opens a chart. HIPAA gives chart numbers, health plan beneficiary numbers and account numbers a letter each, and its final letter sweeps in every other code unique to a person, which is where claim numbers, policy numbers and matter numbers belong.

Internal numbers are identifiers to insiders

A law firm’s matter number or an accounting practice’s client code means nothing to a stranger. To anyone inside the firm, it is the client. That matters because an AI conversation is rarely read only by the person who started it: colleagues share threads, workspaces have administrators and exports end up in folders.

Replace file numbers with labels that keep the structure, such as Matter 1 or Claim 1, so the AI can still keep two files apart. A matter file gets the same treatment on the page for law firms, and what a judge may ask about how a brief was drafted is answered in whether courts require AI disclosure.

HIPAA’s eighteen categories, read as a checklist for any file

HIPAA’s safe harbor method, set out in paragraph (b)(2) of section 164.514 of Title 45, is the most concrete list of identifiers anywhere in US law. It binds health plans, providers, clearinghouses and the vendors working for them, not a law firm drafting a demand letter or a CPA preparing a return. As a checklist, though, it works on any document, and it catches things a homemade list forgets.

18

The rule letters its categories from (A) to (R). Grouped by what they are, with where each group turns up in an office that is not a clinic, they fit in one table.

Letters	What they cover	Outside a clinic
(A)	Names	Parties, witnesses, family members
(B)	Geography smaller than a state	Street, city, county, ZIP code
(C)	Dates tied to the person, ages over 89	Birth date, date of injury or death
(D) to (F), (N), (O)	Phone, fax, email, web and IP addresses	Signature blocks, profile links, logs
(G) to (J)	Account, health plan, chart and Social Security numbers	W-2s, bills, claim forms
(K) to (M), (P), (Q)	Licenses, vehicles, devices, biometrics, face photos	Plate, VIN, voice recordings, photo IDs
(R)	Every other code unique to the person	Claim, policy and matter numbers

Title 45, section 164.514(b)(2)(i), grouped by us.

The people around the person

Two details lift the rule above a list of fields. The first is whose identifiers count: the rule covers the individual and also their relatives, employers and household members. A medical history that names the daughter who drives the patient to appointments fails, and so does an employment memo that names the spouse who runs the family company.

The second is the actual knowledge condition in paragraph (b)(2)(ii). Clearing all eighteen still fails if the organization knows that what survived, alone or joined to other data, reveals who the patient is. The letter by letter reading, with clinical examples and the traps HHS points out, is in our HIPAA guide.

ZIP code, birth date and sex: three harmless fields that name a person

In 2000, Latanya Sweeney of Carnegie Mellon University published a working paper with a plain title: simple demographics often identify people uniquely. Using 1990 census data, she estimated that 87 percent of the US population, 216 million of 248 million people, were likely to be uniquely identified by three fields alone: a five digit ZIP code, sex and full date of birth.

ZIP code, sex, date of birth87%

City or town, sex, date of birth53%

County, sex, date of birth18%

Widening the geography helps less than people expect. With the city or town in place of the ZIP code, the same paper put the share at 53 percent. Even at county level, county, sex and date of birth were likely to single out 18 percent of the population, which is still tens of millions of people.

The governor in the hospital data

Sweeney’s best known demonstration is in her 2002 paper on k-anonymity. The Massachusetts Group Insurance Commission held hospital data on about 135,000 state employees and their families. Believing it anonymous, it shared the data with researchers and sold a copy to industry. Sweeney bought the Cambridge voter list for twenty dollars, which gave names, addresses, ZIP codes, birth dates and sex.

6Cambridge voters with the governor's birth date

3of them men

1in his five digit ZIP code

William Weld, then governor, lived in Cambridge and his records were in the hospital data. Six people on the voter list shared his birth date, only three of them were men, and he was the only one in his ZIP code. No name had been left in the medical file, and none was needed.

The same thing in an ordinary document

Office documents rarely hold a birth date and a ZIP code in neat columns. They hold sentences. The only payroll manager at a roofing company with 12 employees in Worthington, Ohio, is one person, and anyone who knows the town or the trade can say who. Job title, employer size and place do the work that ZIP code, birth date and sex did in Sweeney’s study.

That is why the last row of the first table matters more than its size suggests. After the search for names and numbers, read the text again as someone who knows the client’s world would read it. The argument for doing this before the upload, and not after, is made in our guide on client data and breaches.

What to keep so the AI can still do the job

Removing everything is its own failure. A letter with every date, amount and role deleted cannot be summarized, and a spreadsheet with every column blanked cannot be analyzed. The goal is to take out who the document is about while keeping what the task needs, and most identifiers can be swapped for a coarser value instead of being deleted. In a workbook, that usually means swapping names for codes and birth dates for birth years.

Value	Swap it for	Keep more only when
Full name	Client A, used the same way throughout	Never: the AI does not need it
Date of birth	Age, or the year	The task turns on an exact age
Street address and ZIP code	The state	The task turns on local rules
Dates of events	Day 1, day 14, day 30	Real deadlines: keep the date, drop the name
Account and card numbers	Account 1, Card 1	Reconciling transactions, then the last four
Employer and job title	Industry and headcount band	The role is the question itself

Our working rules. HIPAA’s safe harbor keeps the year of a date, and a ZIP prefix only for areas over 20,000 residents.

Consistent labels do most of the work

The single most useful habit is consistency. If the client is Client A in the first paragraph, she has to be Client A in the last, and her husband has to be Spouse A everywhere. An AI tool reads a document by following references, and a text where the same person is called three different things produces answers that confuse them. In a client list exported to CSV, that means one code per person on every row.

Swapping values for labels that only you can turn back into names is pseudonymization, which falls short of making the text anonymous. Why that gap matters in a policy or a contract is the whole subject of our comparison of the two terms.

Hidden file properties, the author field and the company name among them, are a separate check with their own guide in this series.

Three shortcuts that leave a person in the file

The first shortcut is keeping the last four digits because a form or a court does. As NIST’s footnote on partial identifiers says, a fragment can still be nearly unique. Four digits of an SSN next to a name and a birth year is not a masked number; it is a good part of what a bank’s phone check asks for.

The second is treating a document without names as a document without people. Sweeney’s governor had no name in the hospital file. Every combination row in the first table is a version of the same problem, and it is the one no search box finds.

Public does not mean safe to paste

The third shortcut is assuming that information already public does not count. A docket number is public by design, and so is an address in a property record. NIST’s definition has no exception for public sources, and linking public pieces together is exactly how the Cambridge voter list did its work.

Public pieces also say more once they are joined in one conversation, next to the private facts of the matter. If your firm writes rules for what staff may put into AI tools, a written AI policy is the place to settle which of these shortcuts it forbids.

Before you upload: what personal information to remove before AI, in order

Run these eight checks on a copy of the file, the one you will actually send. Knowing what personal information to remove before AI is only useful if the check happens on that copy. Checking after the upload is the weaker route, since what a ChatGPT chat deletion leaves behind can include the uploaded file itself, saved in its Library.

1. Every name. Clients, relatives, employers, witnesses, signature blocks, quoted emails. Search surnames and first names apart.
2. Government numbers. SSN, ITIN, a sole proprietor’s EIN, license, passport, Medicare number, partial digits too.
3. Contact details. Addresses, emails and phones, forwarded headers and footers included.
4. Money. Account and card numbers, check images, direct deposit forms.
5. File numbers. Docket, claim, policy, chart and matter numbers, as labels.
6. Pictures. Photos, signatures, scanned IDs, screenshots. A photo uploaded to ChatGPT can outlive the chat it was sent in.
7. The combinations. ZIP, birth date and sex; job, employer and town. Generalize.
8. Whatever the page hides. Comments, tracked changes, text under black boxes: see the PDF guide.

The FTC puts it first among its five principles for companies: take stock, know what personal information you have in your files. A document is a small file system, and this list is how you take stock of one before it leaves. In a slide deck, taking stock includes the notes pane, the hidden slides and the comment threads.

Nonimo and an intake sheet, before and after

The Nonimo app runs locally, and a file you hand it stays on your computer. It returns the text in a form you can paste, where each personal detail has become a label such as [PERSON_1], along with a masked copy of the file itself. A Word file stays a Word file, title and properties included; a PDF becomes a new PDF holding only the text. Driver’s license photos have their own redaction tool. Text pasted into the tool on this page comes back masked, ready to copy, and is discarded as soon as you have the result.

Here is an invented intake sheet, every value made up, through the app.

Before                                           What goes to the AI
Client: Marisol Tennerby                         Client: [PERSON_1]
SSN: 000-38-6705                                 SSN: [REFERENCE_1]
Driver license number: TK482915                  Driver license number: [REFERENCE_2]
Date of birth: 03/14/1981                        Date of birth: [RECORD_FIELD_1]
Address: 2280 Larchmere Drive,                   Address: [ADDRESS_1]
  Worthington, OH 43085
Email: m.tennerby@example.com                    Email: [EMAIL_1]
Account number: 7730018824                       Account number: [REFERENCE_3]
Card on file: 4111 1111 1111 1111                Card on file: [CARD_1]
Policy number: HO-4471-829-03                    Policy number: [REFERENCE_4]
Ms. Tennerby is the only payroll manager         Ms. [PERSON_2] is the only payroll manager
at her husband's roofing company.                at her husband's roofing company.

The app pseudonymizes: paste the AI’s answer back into it and it swaps the labels for the real values, on your machine. The job line stays as written, and that is what step 7 is for. What the app keeps on disk is listed on the security page, and a clinical note goes through it on the healthcare page.

Sources

Checked September 28, 2026.

• NIST, SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information, April 2010. The two part definition of PII (distinguish or trace, and linked or linkable); the examples in section 2.2; footnote 21 on partial SSN digits; section 3.2.1 on ZIP codes and dates of birth; section 3.2.3 on name plus card number.
• 45 CFR 164.514, eCFR. The eighteen safe harbor identifiers (A) to (R), covering relatives, employers and household members; the three digit ZIP rule and the 20,000 threshold; dates except the year; the actual knowledge condition in (b)(2)(ii).
• L. Sweeney, Simple Demographics Often Identify People Uniquely, Carnegie Mellon University, Data Privacy Working Paper 3, 2000. 87% (216 of 248 million) likely unique on five digit ZIP, sex and date of birth; 53% on place; 18% on county; 1990 census data.
• L. Sweeney, k-anonymity: a model for protecting privacy, 2002. The Group Insurance Commission data on about 135,000 state employees and families, the twenty dollar Cambridge voter list, and Governor Weld: six with his birth date, three men, one in his ZIP code.
• FTC business guide, Protecting Personal Information, October 2016. The five principles, starting with take stock; SSNs only for required and lawful purposes.
• IRS, Individual Taxpayer Identification Number. A nine digit number for people who need a US taxpayer number and are not eligible for an SSN.
• IRS, Employer Identification Number. A federal tax ID number for businesses, tax exempt organizations and other entities.
• CMS, Understanding the Medicare Beneficiary Identifier (MBI) Format. 11 characters, randomly generated, replacing the SSN based number; the example 1EG4-TE5-MK73.
• FRCP 5.2, Cornell LII. The redaction rule for federal filings: SSNs, taxpayer and account numbers cut to four digits, birth dates to the year, minors to initials.