Skip to main content
Use these best practices to improve detection results, produce defensible counts, and reduce rework across matters.

​
Agree the element taxonomy before you run it

  • Define what is reportable for this matter before configuration begins.
  • Decide how expired identifiers, employee data, and residency limits are treated.
  • Confirm whether clinical categories are in scope, not just health identifiers.
  • Record matter-wide scope decisions in the general instruction and element-specific rules in the element definitions.
Scope decisions belong in the configuration. Applying them as manual corrections afterwards is slower and harder to defend.

​
Start with clean inputs

  • Use a dataset that matches the review scope.
  • Verify that documents contain usable extracted text.
  • Identify image-only and scanned material and process it before review, not after.
  • Remove obvious duplicates before running the workflow.
Documents without text cannot be reviewed. In breach populations they are often the documents most likely to carry identifiers.

​
Test on a sample first

  • Run PII Detection on a pilot set before using the full dataset.
  • Check the determination split against what you expect for this population.
  • Read the supporting text behind a representative mix of element hits.
  • Check the exception report early to confirm text extraction coverage.
A definition error found on a sample costs one run. Found on the full population, it costs two.

​
Write definitions that say what does not qualify

  • State exclusions explicitly. The most reliable definitions rule things out as well as in.
  • Be specific about elements that only count in pairs, such as a card number with its security code, or a username with its password.
  • Keep element names and tag names aligned when you rename either.
  • Change one definition at a time and test before making further adjustments.
An element that fires on nearly every document is almost always a definition that is too broad.

​
Review output at each stage

  • Validate the document population before extracting individuals.
  • Sample by confidence level rather than at random — the mid-range bands are where definitions are wrong.
  • Review the documents where the determination and the model score disagree.
  • Look at which elements are driving the population before treating the counts as final.
Early review prevents errors from carrying into the individual population.

​
Verify the affected-individual count before reporting it

  • Check for the same person appearing under two spellings, which shows up as near-identical names with different document sets.
  • Check for two people consolidated under one common name, which shows up as conflicting addresses on a single record.
  • Read the source documents for individuals identified from a single element in a single document.
  • Verify the individuals with the highest element counts by hand — these drive notification obligations.
The individual count is the number that leaves the building. It deserves a deliberate QC pass.

​
Reconcile the exception report

  • Account for every document submitted, not just the ones that produced results.
  • Re-OCR and re-run text extraction failures rather than accepting the gap.
  • Record the reason for any exception that cannot be resolved.
A review that reports on most of a population and cannot explain the remainder has a gap someone will ask about.

​
Use reviewer feedback to improve results

  • Apply reviewer tags to a sample. They override predictions, drive re-evaluation of conflicting documents, and are what the metrics measure against.
  • Refine definitions when the same correction appears repeatedly across documents.
  • Run the metrics analysis against reviewed documents rather than judging a run by its overall counts.
  • Recheck edge cases after making changes.

​
Reuse what works

  • Save successful configurations for similar matters.
  • Keep a standard element taxonomy for common incident types and adapt it per matter.
  • Compare results across matters to spot recurring issues.
  • Keep internal notes on validated definitions and thresholds.