Only mask date-of-birth (not visit dates); readable redaction labels

Reported: a visit date ("reviewed on 07/01/26") was being redacted even though
it isn't a DOB, and "NMC number: 18D6896L" rendered as "[ORGANIZATION] number:
[NMC]".

- recognizers.py: dates are PII only in a date-of-birth context (_DOB_RE). Visit
/ encounter / admission dates are clinically useful and left intact.
- detect.py: drop DATE_TIME from PresidioDetector.KEEP so spaCy's generic date
detection no longer flags visit dates.
- transform.py: human-readable redaction placeholders ("[NMC number]",
"[NHS number]", "[name]", "[date of birth]" …) instead of raw entity codes.
- tests: update for new labels; date-shift test now uses DOB-context dates.
- docs: date-shift now applies to DOB only (visit-date interval preservation no
longer claimed).

(The "NMC"→ORGANIZATION issue was already fixed by the prior ORGANIZATION removal.)

README.md

@@ -24,9 +24,10 @@ layer** Presidio leaves to you:
 2. **Domain adaptation to messy clinical text.** NHS-aware recognisers: checksum-validated NHS numbers
    **plus** context-anchored detection for the dataset's 9-digit synthetic numbers Presidio's `UK_NHS`
    misses, plus GMC/NMC clinician IDs, ODS org codes and record UUIDs.
-3. **Patient-consistent, longitudinal de-identification.** Same patient → same surrogate across their
-   whole admission journey, with each patient's dates shifted by one consistent offset so clinical
-   intervals survive — *useful* data, not just safe data. Realistic en_GB fakes (or `[TYPE]` redaction).
+3. **Patient-consistent de-identification.** Same patient → same surrogate across their whole
+   admission journey. Only date-of-birth is treated as PII (shifted by a consistent per-patient
+   offset); visit / admission dates are clinically useful and left intact. Realistic en_GB fakes
+   (or `[label]` redaction).
 4. **Pluggable + degrades gracefully.** One `Detector` interface (Rule / Presidio); the pure-Python
    rule layer + eval run even if spaCy/Presidio are unavailable.
 5. **Governance wrapper.** Per-note audit of what was removed + the dataset-level leakage report,

noteguard/detect.py

@@ -39,8 +39,10 @@ class PresidioDetector:
     # over-tags abbreviations/labels ("NHS", "DOB …", "GMC") as ORG, which both creates
     # false positives and swallows precise rule spans (dates, NHS numbers). NHS site
     # names are caught instead by the _SITE_RE LOCATION rule (incl. "… Trust").
+    # DATE_TIME is also EXCLUDED: only date-of-birth dates are PII (caught by the _DOB_RE
+    # rule); visit / encounter / admission dates are clinically useful and left intact.
     KEEP = {
-        "PERSON", "DATE_TIME", "EMAIL_ADDRESS", "PHONE_NUMBER",
+        "PERSON", "EMAIL_ADDRESS", "PHONE_NUMBER",
         "LOCATION", "UK_NHS", "UK_NINO", "UK_PASSPORT",
         "UK_VEHICLE_REGISTRATION", "IP_ADDRESS", "URL",
     }

noteguard/recognizers.py

@@ -66,11 +66,14 @@ _EMAIL_RE = re.compile(r"\b[\w.+-]+@[\w-]+\.[\w.-]+\b")
 _PHONE_RE = re.compile(r"\b(?:\+?44\s?|0)(?:\d\s?){9,10}\b")
 # UK postcode (simplified but standard) e.g. SW1A 1AA, M1 1AE
 _POSTCODE_RE = re.compile(r"\b[A-Z]{1,2}\d[A-Z\d]?\s*\d[A-Z]{2}\b", re.IGNORECASE)
-_DATE_RE = re.compile(
-    r"\b(\d{1,2}[/-]\d{1,2}[/-]\d{2,4}"
+# Dates are PII only in a DATE-OF-BIRTH context. Visit / encounter / admission dates
+# are clinically useful and NOT identifiers on their own, so they're left intact.
+# Captures the date itself as group 1.
+_DOB_RE = re.compile(
+    r"(?i)\b(?:DOB|D\.O\.B\.?|date\s+of\s+birth|born(?:\s+on)?)[\s:]*"
+    r"(\d{1,2}[/-]\d{1,2}[/-]\d{2,4}"
     r"|\d{4}-\d{2}-\d{2}"
-    r"|\d{1,2}\s+(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)[a-z]*\.?\s+\d{2,4})\b",
-    re.IGNORECASE,
+    r"|\d{1,2}\s+(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)[a-z]*\.?\s+\d{2,4})"
 )
 # --- NHS staff / organisation identifiers (context-anchored to avoid noise) ---
 _GMC_RE = re.compile(r"(?i)\bGMC(?:\s*(?:no|number|#))?[:\s#]*(\d{7})\b")
@@ -97,7 +100,7 @@ _PLAIN = [
     (_EMAIL_RE, EMAIL, 0),
     (_PHONE_RE, PHONE, 0),
     (_POSTCODE_RE, POSTCODE, 0),
-    (_DATE_RE, DATE, 0),
+    (_DOB_RE, DATE, 1),
     (_GMC_RE, GMC, 1),
     (_NMC_RE, NMC, 1),
     (_NMC_BARE_RE, NMC, 1),

noteguard/transform.py

@@ -2,10 +2,10 @@
 
 Presidio anonymises per-document; the value NoteGuard adds is *cross-note,
 patient-consistent* de-identification — the same patient maps to the same
-surrogate across their whole admission journey, and their dates are shifted by a
-single consistent offset so intervals (and therefore clinical timelines) survive.
-That utility-preserving longitudinal property is what makes the cleaned data
-useful for downstream / federated training instead of just safe.
+surrogate across their whole admission journey. Only date-of-birth is treated as
+PII; it is shifted by a single consistent per-patient offset (visit / admission
+dates are clinically useful and left intact). That utility-preserving property is
+what makes the cleaned data useful for downstream / federated training, not just safe.
 
 Surrogates are realistic en_GB fakes (folded in from the Presidio branch's Faker
 vault) so the output reads like a real note — better for training than `Patient_001`
@@ -26,6 +26,31 @@ from .recognizers import Span
 REDACTION = "redaction"
 PSEUDONYM = "pseudonym"
 
+# Human-readable placeholders for redaction — clearer than raw entity codes
+# (e.g. "NMC number: [NMC number]" instead of "[ORGANIZATION] number: [NMC]").
+_REDACT_LABEL = {
+    "PERSON": "name",
+    "DATE_TIME": "date of birth",
+    "UK_NHS": "NHS number",
+    "UK_NINO": "NI number",
+    "UK_POSTCODE": "postcode",
+    "UK_PASSPORT": "passport number",
+    "UK_VEHICLE_REGISTRATION": "vehicle registration",
+    "GMC": "GMC number",
+    "NMC": "NMC number",
+    "NHS_ODS": "ODS code",
+    "RECORD_ID": "record ID",
+    "LOCATION": "location",
+    "EMAIL_ADDRESS": "email",
+    "PHONE_NUMBER": "phone",
+    "IP_ADDRESS": "IP address",
+    "URL": "URL",
+}
+
+
+def redaction_label(entity_type: str) -> str:
+    return _REDACT_LABEL.get(entity_type, entity_type)
+
 _DATE_FORMATS = ["%d/%m/%Y", "%d-%m-%Y", "%Y-%m-%d", "%d/%m/%y", "%d-%m-%y"]
 _POSTCODE_INWARD = re.compile(r"\s*\d[A-Za-z]{2}\s*$")
 
@@ -172,11 +197,11 @@ def apply_transform(
     for s in sorted(spans, key=lambda x: x.start, reverse=True):
         original = text[s.start:s.end]
         if method == REDACTION:
-            repl = f"[{s.entity_type}]"
+            repl = f"[{redaction_label(s.entity_type)}]"
         else:  # PSEUDONYM
             if s.entity_type == "DATE_TIME":
                 shifted = _shift_date(original, offset)
-                repl = shifted if shifted else "[DATE_TIME]"
+                repl = shifted if shifted else f"[{redaction_label('DATE_TIME')}]"
             else:
                 repl = vault.token_for(s.entity_type, original)
         out = out[:s.start] + repl + out[s.end:]

tests/test_transform.py

@@ -11,7 +11,7 @@ from noteguard.transform import (
 def test_redaction_removes_value_and_tags():
     text = "NHS 943 476 5919"
     out, _ = apply_transform(text, find_rule_spans(text), REDACTION)
-    assert "[UK_NHS]" in out
+    assert "[NHS number]" in out
     assert "943 476 5919" not in out
 
 
@@ -41,10 +41,12 @@ def test_vehicle_surrogate_format():
     assert re.fullmatch(r"[A-Z]{2}\d{2} [A-Z]{3}", reg)
 
 
-def test_date_shift_preserves_interval():
-    text = "seen 12/03/1981 and again 20/03/1981"
+def test_date_shift_is_consistent_per_patient():
+    # Only date-of-birth dates are treated as PII, so both need a DOB context. The
+    # per-patient offset is consistent, so the interval between them is preserved.
+    text = "DOB 12/03/1981 ... DOB 20/03/1981"
     out, _ = apply_transform(text, find_rule_spans(text), PSEUDONYM, PseudonymVault(), person_id="p1")
     assert "12/03/1981" not in out and "20/03/1981" not in out
     dates = [datetime.strptime(d, "%d/%m/%Y") for d in re.findall(r"\d{2}/\d{2}/\d{4}", out)]
     assert len(dates) == 2
-    assert (dates[1] - dates[0]).days == 8  # 8-day interval survives the shift
+    assert (dates[1] - dates[0]).days == 8  # consistent offset preserves the interval