Rule-Based Redaction and Verification for Structured Clinical Notes on IoMT Edge Gateways
Keywords:
Edge computing, Healthcare security, Internet of Medical Things, Output verification, Prompt orchestration, Small language models, Smart computing environmentAbstract
Small language models (SLMs) on hospital Internet of Medical Things (IoMT) edge gateways can receive identifiers, ignore SOAP or SBAR layouts, and add unsupported gendered titles or pronouns, yet no simple auditable control exists. The study proposes MedEdgePrompter, a four-stage, rule-based pipeline implemented using the Python standard library: redaction, template injection, model execution, and verification, followed by clinician review or flagging. Redaction replaces nine-digit Social Security Number-format numbers, medical record numbers, and dates of birth with placeholders; templates wrap text in SOAP or SBAR instructions. Verification checks header order and that gendered honorifics and pronouns in the output occur in the input. A scripted function replaced the model. Redaction was tested on 1,050 synthetic sentences and verification on 1,200 scripted outputs, with exact 95% Clopper-Pearson intervals. All 550 in-scope identifiers were redacted (CI 0.993 to 1.000). None of the 250 out-of-scope identifiers (names, telephone numbers, email addresses, street addresses, month-name dates) were redacted, whereas all 50 accession numbers were incorrectly redacted. The verifier flagged 500 of 500 injected faults versus 152 of 500 for baseline checks, but flagged helium “He” as a pronoun in all 100 cases. Guardrails took a median 0.077 ms per note (95th percentile 0.118 ms) on one vCPU, excluding model time. The rules are auditable but cover only defined patterns, do not satisfy HIPAA Safe Harbor, miss clinical errors, and need clinician review. Real SLM testing under clinical governance could support privacy-protective drafting, reduce documentation burden, and give auditable evidence for HIPAA, FDA, GDPR, EU MDR, and EU AI Act compliance.
References
A. J. Thirunavukarasu, D. S. J. Ting, K. Elangovan, L. Gutierrez, T. F. Tan, and D. S. W. Ting, “Large language models in medicine,” Nature Medicine, vol. 29, no. 8, pp. 1930–1940, Jul. 2023.
S. B. Baker, W. Xiang and I. Atkinson, “Internet of Things for smart healthcare: technologies, challenges, and opportunities,” in IEEE Access, vol. 5, pp. 26521–26544, 2017.
G. J. Joyia, R. M. Liaqat, A. Farooq, and S. Rehman, “Internet of Medical Things (IOMT): Applications, benefits and future challenges in healthcare domain,” Journal of Communications, vol. 12, no. 4, pp. 240–247, Apr. 2017.
W. Shi, J. Cao, Q. Zhang, Y. Li and L. Xu, “Edge Computing: Vision and Challenges,” in IEEE Internet of Things Journal, vol. 3, no. 5, pp. 637-646, Oct. 2016.
U.S. Department of Health and Human Services, “Other requirements relating to uses and disclosures of protected health information,” Code of Federal Regulations, Title 45, Section 164.514.
European Parliament and Council of the European Union, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation),” Official Journal of the European Union, vol. L 119, pp. 1–88, May 2016.
C. Van Nguyen et al., “A survey of small language models,” arXiv, 2024.
G. Xiao, J. Lin, M. Seznec, H. Wu, J. Demouth, and S. Han, “SmoothQuant: Accurate and efficient post-training quantization for large language models,” in Proceedings of the 40th International Conference on Machine Learning, PMLR, vol. 202, pp. 38087–38099, 2023.
Z. Ji et al., “Survey of hallucination in natural language generation,” ACM Computing Surveys, vol. 55, no. 12, pp. 1-38, Mar. 2023.
T. Rebedea, R. Dinu, M. N. Sreedhar, C. Parisien, and J. Cohen, “NeMo Guardrails: A toolkit for controllable and safe LLM applications with programmable rails,” Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, 431–445, 2023.
Microsoft, “Presidio: Data protection and de-identification SDK,” Presidio Documentation.
I. Neamatullah et al., “Automated de-identification of free-text medical records,” BMC Medical Informatics and Decision Making, vol. 8, 2008.
L. Sweeney, “Simple demographics often identify people uniquely,” Carnegie Mellon University, Data Privacy Working Paper 3, Pittsburgh, PA, USA, 2000.
K. M. Haig, S. Sutton, and J. Whittington, “SBAR: A shared mental model for improving communication between clinicians,” Joint Commission Journal on Quality and Patient Safety, vol. 32, no. 3, pp. 167–175, 2006.
E. Tabassi, “Artificial intelligence risk management framework (AI RMF 1.0),” National Institute of Standards and Technology, Gaithersburg, MD, USA, NIST AI 100-1, Jan. 2023.
