How to Redact Medical Records Before Sharing Them

Sharing medical records happens more than most people expect: disability claims, FMLA paperwork, insurance disputes, workplace accommodations, and legal cases all require them. The records you send contain far more than the recipient needs -- your Social Security number, insurance IDs, and a detailed clinical history that has nothing to do with the claim.

Redacting medical records before sharing is standard practice, and in most cases it is entirely legal: you are sharing the minimal necessary subset. This guide covers what to redact, what to keep, and why the tool you use matters more than it does with any other document.

What to Redact on Medical Records

1. Your Social Security number -- almost never needed by the recipient of a claim review.
2. Insurance policy and group numbers -- unless the recipient is the insurer processing the claim.
3. Your full name and address -- if the recipient already has them from the request form, redact them on the records.
4. Unrelated treatment details -- a disability claim about a back injury does not require your unrelated test results or prescriptions.
5. Provider notes and references to third parties -- family members mentioned in notes have privacy rights too.

What to Keep Visible

• Dates of treatment -- what reviewers use to confirm the timeline.
• Diagnoses and treatments related to the claim -- the substance of the request.
• Provider names and credentials -- needed to verify the records are genuine.

Is It Legal? (And When It Isn't)

In most countries, sharing a minimal necessary subset of your own records is permitted and normal. The exceptions:

• Your treating provider may be entitled to the full record to continue care.
• An insurer processing a claim may require specific full sections -- ask what they need before redacting.
• Court orders and subpoenas override personal redaction choices.

When in doubt, ask the recipient in writing what they require, and redact only what falls outside that scope.

How to Redact Them Safely

1. Open the records in the LanaPDF editor at lana-pdf.com. Processing happens locally -- the file is never uploaded while you work on it.
2. If the records are scans, run OCR first so there is a real text layer. Scans often carry an invisible OCR layer underneath that survives visual redaction.
3. Redact with the Redaction tool -- not the rectangle tool. LanaPDF removes the covered text from the file itself on save.
4. Flatten the document with the repair tool's Deep mode so no hidden text or metadata can survive.
5. Verify: on the exported file, press Ctrl+F / Cmd+F and search for a fragment of the SSN. Nothing should be found. Then select all and copy -- no hidden values should appear.
6. Send through a secure portal or password-protected file, with the password shared separately.

The same verification workflow is detailed in why redacted text is still in your PDF.

Why Local Processing Matters for Health Data

Medical records are protected health information in many jurisdictions, with legal duties attached to who holds and transmits them. Uploading them to a free online PDF editor moves that protected data onto third-party servers -- the very exposure laws are designed to prevent. A browser-based editor that processes everything locally keeps the records on your device from start to finish. The principle is the same one we describe for bank statements and tax documents: the file that never leaves your device is the file that cannot be breached.

Conclusion

Redacting medical records is routine, legal, and increasingly expected. Remove the SSN, insurance IDs, and unrelated treatment details; keep the dates, diagnoses, and provider info the reviewer needs; and do the work locally so the records never touch a third-party server. Then verify, flatten, and send through a channel you control.