The Surrogator🐊: Using Clinical Documents in a Data-Protection-Compliant Manner Without Losing Information

Texts from clinical records contain valuable data for medical research. However, their use is restricted by the General Data Protection Regulation (GDPR), which mandates strict protection of personal information.

The GeMTeX project of the Medical Informatics Initiative (MII) aims to make clinical texts safely usable for research purposes and for artificial intelligence (AI) applications. To strike an appropriate balance between data protection, data quality, and scientific usability, the GeMTeX team has further developed the open-source tool “Surrogator,” which was originally created in SMITH. It replaces information that could be traced back to patients’ identities with semantically similar pseudonyms.

Christina Lohr, a research associate at the Institute for Medical Informatics, Statistics, and Epidemiology at the University of Leipzig, played a leading role in the development of Surrogator. In this interview, she explains why the tool is important for research involving clinical texts and how it works.

As part of the GeMTeX project, you developed a method for de-identifying medical texts, in which personally identifiable information is obscured. This process is supported by the Surrogator. What motivated you to further develop the tool?

The tool is essential for ensuring that the texts in GeMTeX are of high enough quality to be used for research and AI applications.

Conventional de-identification methods can result in the loss of essential information from clinical texts. In these methods, personally identifiable information is replaced with generic or cryptic codes. For example, a patient’s name is simply replaced with a string such as [Patient_Name], and dates are replaced with [Date]. This can result in the loss of information about gender and make time-series analyses no longer possible. Furthermore, age and gender are valuable biometric data in their own right that could be used for analyses.

The Surrogator supports various methods for replacing information that needs to be protected. For example, personally identifiable information such as names and dates of birth is replaced with equivalent, fictitious details rather than codes. This ensures that the texts remain natural, consistent in content, and retain their statistical properties, without the texts being traceable back to the actual patient. In the original document, “Inge Schmidt” becomes “Tina Meyer,” the date of birth “May 20, 1950” becomes “April 1, 1950,” and “Dresden University Hospital” becomes “Leipzig University Hospital.” The context of the documents remains intact; only the data has been completely replaced.

How exactly does the Surrogator work?

Texts in which personal data has been annotated or marked are entered into the Surrogator framework in advance. For these text documents, an equivalent substitute for different types of information is determined according to defined rules. For example, based on curated lists of names, the names in the document are replaced with names of the same structure and gender.

Dates can be consistently shifted using a fixed parameter, ensuring that the temporal integrity of the texts is preserved. In GeMTeX, we have currently agreed on a method in which birth or death dates are rounded to the beginning of their respective quarter.

For location data, we use OpenStreetMap to obtain addresses within a ZIP code region but replace them with different addresses.

Texts containing highly context-specific and sensitive personal data that deviate from a standardized schema are filtered out using the Surrogator before automatic processing.

How was the Surrogator evaluated, and what were the results?

We tested the Surrogator using the synthetic GraSCCO text corpus. To do this, we had our pseudonymized texts re-identified by an AI-powered language model. The result: The hit rate was approximately 50 percent. This means the language model was no better at tracing the pseudonymized texts than would be possible by random guessing. Our test corpus also performed well in a usability test. This means the tool can be reliably used for the pseudonymization of clinical texts. We are currently working on testing the tool in routine clinical practice.
 

The code for Surrogator is available as open source at: https://github.com/medizininformatik-initiative/GeMTeX/tree/main/surrogator

Evaluation Code: https://github.com/dieterich-lab/SurrogatorEval

Publication: Christina Lohr, Marvin Seiferling, Philipp Wiesenbach, Jakob Faller, Christoph Dieterich. The SURROGATOR Framework for Context-Aware Surrogation of Privacy Sensitive Information in Medical Text. Stud Health Technol Inform. 2026 May 21;336:1405-1409. DOI: 10.3233/SHTI260440.