The Surrogator: Using Clinical Documents for Research While Protecting Patient Privacy
Interview with Research Associate Christina Lohr
Clinical documentation contains valuable data for medical research. However, its use is restricted by the General Data Protection Regulation (GDPR), which requires strict protection of personal information.
The GeMTeX project of the Medical Informatics Initiative (MII) aims to make clinical texts safely available for research and artificial intelligence (AI) applications. To strike an appropriate balance between data protection, data quality and scientific usability, the GeMTeX team further developed the open-source tool Surrogator, originally created within the SMITH Consortium. The tool replaces information that could reveal a patient’s identity with semantically similar pseudonyms.
Christina Lohr, a research associate at the Institute for Medical Informatics, Statistics and Epidemiology at Leipzig University, played a leading role in developing the Surrogator. In this interview, she explains why the tool is important for research using clinical texts and how it works.
Within the GeMTeX project, you developed an approach for de-identifying medical texts by removing personal information. The Surrogator supports this process. What motivated you to further develop the tool?
The tool is essential for making the texts in GeMTeX available for research and AI applications while maintaining a high level of data quality. Conventional de-identification methods often remove essential information from clinical texts. Typically, personal information is replaced with generic or cryptic placeholders. For example, a patient’s name might simply become [Patient_Name], while dates are replaced with [Date]. As a result, information about a patient’s sex may be lost, and longitudinal analyses are no longer possible. In addition, age and sex are valuable biometric variables that can be important for data analysis.
The Surrogator supports several strategies for replacing sensitive information. Instead of generic placeholders, identifying information such as names and dates of birth is replaced with equivalent fictional information. This preserves the natural flow of the text, maintains semantic consistency and retains its statistical properties, while ensuring that the document can no longer be traced back to the real patient.
For example, Inge Schmidt in the original document becomes Tina Meyer, the date of birth 20 May 1950 becomes 1 April 1950, and University Hospital Dresden becomes Leipzig University Hospital. The relationships and consistency within the documents are preserved—only the identifying information is completely replaced.
How does the Surrogator work in practice?
Before processing, the Surrogator framework receives texts in which personal information has already been annotated or marked. Based on predefined rules, the framework determines equivalent replacements for different types of sensitive information. For example, names are replaced with names of the same structure and gender using curated name lists. Dates can be shifted consistently by a fixed parameter so that the temporal relationships within the documents remain intact. In GeMTeX, we currently use a mode in which dates of birth and dates of death are rounded to the beginning of their respective quarter. For locations, we use OpenStreetMap to generate replacement addresses within the same postal code region while ensuring that the original addresses are replaced with different ones.
Texts containing highly context-specific and sensitive personal information that does not follow a standardized pattern are filtered out before automatic processing with the Surrogator.
How was the Surrogator evaluated, and what were the results?
We evaluated the Surrogator using the synthetic GraSCCO text corpus. To assess the effectiveness of the pseudonymization, we asked an AI-based language model to re-identify the pseudonymized texts. The result: the model achieved an accuracy of approximately 50%. In other words, it was no better at tracing the pseudonymized texts back to their original identities than random guessing. The test corpus also performed well in an evaluation focusing on data usability. This shows that the tool can reliably be used to pseudonymize clinical texts while preserving their value for research. We are currently working on evaluating the Surrogator in routine clinical practice.
Surrogator source code (Open Source):
https://github.com/medizininformatik-initiative/GeMTeX/tree/main/surrogator
Evaluation code:
https://github.com/dieterich-lab/SurrogatorEval
Publication: Lohr C, Seiferling M, Wiesenbach P, Faller J, Dieterich C. The SURROGATOR Framework for Context-Aware Surrogation of Privacy Sensitive Information in Medical Text. Stud Health Technol Inform. 2026 May 21;336:1405–1409. DOI: 10.3233/SHTI260440.