​
Changelog

The version is tacit_deid.__version__. Install a specific one with pip install "tacit-deid==<version>".

​
0.5.1

A patch release; upgrade with pip install -U "tacit-deid[detector,gliner,llm]". No change to the boundary artifact: the schema stays 1.2.
  • Your own formats always win. A hit on a pattern in custom_identifiers is never refused by a detection guard. In 0.5.0 a letters-only code (such as ward-kowh) or a local date style (such as clinic day 14) could be dropped by a guard and cross verbatim. If you use custom_identifiers, upgrade.
  • The audit provenance names every Stage-0 recognizer, including the UK postcode and day-month date recognizers.
See Your own identifier formats.

​
0.5.0

Includes every change listed under 0.4.0, which was not published on its own. No change to the boundary artifact: the schema stays 1.2. Upgrade: the default detector stack is now [presidio, gliner-pii-open]. Install with pip install -U "tacit-deid[detector,gliner,llm]". The model downloads about 0.7 GB on first use, or loads from a local directory named by TACIT_DEID_GLINER_PII_OPEN_MODEL. To keep the previous behaviour, set detectors: [presidio].
  • Higher recall by default. gliner-pii-open (knowledgator/gliner-pii-base-v1.0, Apache-2.0) joins Presidio. In Tacit’s tests it found 97.0% of the planted identifiers in 294 synthetic health records against 77.4% for Presidio alone, and 65.2% against 44.9% in 20 synthetic doctor and patient dialogs (one run each). Without the gliner extra the first command stops and names the fix.
  • Clinical facts stay. A clinician role (“the GP”, “a consultant”), a generic department or facility (“A&E”, “gastroenterology”), a pronoun or kin word tagged as a name (“I”, “mum”), and a word tagged as a number (“blood pressure” as a health-plan number) stay in the text. A patient’s own occupation (“I’m a doctor”) and a named institution (“Christchurch Hospital”) are replaced.
  • More identifiers caught. UK postcodes; dates said with an ordinal or in words (“the 18th of November”, “twenty-third of April, nineteen seventy-five”); phone numbers and dates written with Unicode spaces or hyphens.
  • Speaker labels. Diarization labels such as SPEAKER_00: are no longer tagged as names.
  • Long transcripts. Model windows start and end on whole words, so part of a word is never replaced.
See Configuration.

​
0.4.0

No change to the boundary artifact: the schema stays 1.2.
  • Fewer refused transcripts. The judge loop applies a number the judge wrote as digits to the spoken form in the transcript (54 to “fifty-four”, 1986 to “nineteen eighty-six”), and a proposal whose words are split by a hyphen where the transcript has a space (fifty-three to “fifty three”).
  • Clinical facts stay. A proposal the judge itself labels as clinical content (SYMPTOM, CONDITION, ACTION_ADVICE) is ignored. Any other label still applies.
  • Rare conditions. The clinical-rarity check knows about 10,800 names and synonyms of disorders Orphanet confirms are rare (CC BY 4.0). A beat naming one is dropped. Before, only tuberculosis fell below the floor.
  • NZ NHI numbers are checked against their check character, in the current format and the expanded format issued from 2027. A number that fails is still detected, because a misheard NHI still identifies the patient. validate: nhi is available to custom_identifiers. NHI surrogates always fail the check, so a surrogate is never a real NHI.
  • Five more identifier types with their own token and surrogate: UK NHS numbers, US passport numbers, US ITINs, DEA numbers, and crypto wallets.
  • A warning when detectors leaves out gliner-pii, naming the recall gap (41.5% against 86.2% on 2,000 Nemotron-PII records). The default stays [presidio].
  • The singling-out entry in the audit log says it covers age band and sex only.
See Configuration and Data licenses.

​
0.3.0

  • Your own identifier formats: custom_identifiers in tacit_deid.yaml, each a name, a pattern, and an identifier type, with optional context words and a checksum by name (luhn, abn, tfn, acn, medicare, ssn). A hit takes that type’s token, surrogate, gate, and audit path. A bad entry stops the command when the config loads, naming itself.
  • inspect --survey lists what the detectors left in place that looks like an identifier, by shape with a masked example, never the values: the list to turn into custom_identifiers.
See Your own identifier formats.

​
0.2.0

The artifact contract gained one value, so this is a minor version. Upgrade with pip install -U tacit-deid. If you self-host Tacit, upgrade it first: a deployment from before this change rejects unspecified as an unknown age band.
  • Schema 1.2: age_band may be unspecified, as sex always could. With no age and no date of birth in a transcript, 0.1.x had to guess a band; the extractor now answers unspecified and is told never to guess one. A stated age or date of birth still yields its band.
  • The singling-out gate judges an unstated band against every band, the whole population on that axis, the way it always treated an unstated sex.
  • A sealed 1.1 artifact is still valid, and an artifact that omits schema_version is still read as 1.1.
See The boundary artifact for the fields.

​
0.1.1

Fixes found by running 0.1.0 on an ordinary consultation. Upgrade with pip install -U tacit-deid.
  • A date of birth becomes the patient’s age band and is never taken for the visit date. In 0.1.0 a date of birth that was the only full date in a transcript filled as “today”, and the age band was left to a guess.
  • The extractor answers unspecified for sex unless the transcript states it, and a name whose sex is unknown gets a surrogate that signals neither.
  • The default detector finds street addresses and an employer named after a work cue.
  • A part of a detected name (“Thanks Marigold”) is replaced wherever it stands alone.
  • No detector replaces a speaker label (Doctor:), a generic work word (work, site), or a relative time phrase (last night). With gliner-pii stacked, 0.1.0 wrote beats such as “after a their occupation dinner”.
  • The named-entity and clinical-rarity gates no longer read passed: false on an artifact that crossed; what they repaired is in detail.
  • A beat left with nothing but placeholder phrases (“the patient with an organisation”) is dropped.
  • roundtrip --planted takes the path to a JSON file of plain strings or typed entries, and a wrong path or shape is a one-line message. In 0.1.0 the help said “JSON list” and every mistake was a traceback.
See Detector stacks for what each stack detects.

​
0.1.0

First published version.
  • The de-identification pipeline: Stage-0 detectors (Presidio, optional GLiNER), tokenization to typed placeholders, a judge loop to fixpoint, surrogate fill, beat extraction, singling-out and clinical-rarity gates, and a sealed BoundaryArtifact (schema 1.1, sha256-jcs integrity).
  • Inputs: plain text, the common speech-to-text JSON shapes, JSON Lines, WebVTT, SubRip, CSV, TSV, Word, PDF, directories, and zip archives; a keep list; a preflight (inspect); batch runs with a manifest.
  • Transport to Tacit: send, materialize, regenerate, pull, fidelity, and the round-trip oracle; the tokenized transcript as an opt-in second crossing (send_tokenized_transcript, off by default).
  • The canary tripwire and the defensibility report.
  • Condition prevalence comes from national statistics under licences that allow commercial redistribution (US federal works, CC BY 4.0, Open Government Licence v3.0), one cited page per figure. See Data licenses.