Automating Medical-Image Redaction Without Losing Human Control
Fusion is FDA-regulated clinical-trial software that collects and stores patient data while researching new drugs and devices. Before any of it reaches an external regulatory board, every piece of protected health information (PHI) has to be removed. I designed a new imaging redaction module inside Fusion that turned a slow, manual, error-prone process into an auditable one. It cut review sessions roughly in half while keeping human reviewers in final control.
Every medical image has to have its protected health information removed before a regulator sees it. At Fusion that redaction was done by hand, one file at a time, across teams in different parts of the world, and a single study could hold close to 100,000 images. The real problem was never just speed. It was making automation trustworthy enough to hold up in an FDA-regulated review.
The redaction workflow was where the product slowed down. It was manual, error-prone, and expensive, and mistakes carried real consequences because this was the step that removed protected health information before a regulator saw it.
A manual process that could not scale
Every image was redacted by hand, and each one required specialized software just to open and edit. As studies approached 100,000 images, the work grew faster than any team could reasonably staff for.
Distributed teams, fragile output
Redaction teams worked globally, moving between several disconnected programs. Every tool switch and handoff was another chance for PHI to slip through, or for a valid image to be over-redacted.
Three principles that made automation trustworthy.
Before designing a single screen, I defined the rules the automation had to follow. They were grounded in Axiom’s product vision, and they let the team move quickly without giving up the confidence a regulated review depends on. They also gave everyone one consistent way to judge a tradeoff.
- 01
Human authority over automation
Reviewers keep final control at every critical moment, so a regulatory board can validate the tool no matter how much it automates.
- 02
Trust before speed
No efficiency gain is worth compromising confidence or auditability. Speed only counts once the output can be trusted.
- 03
Reversibility as safety
Every automated action stays reviewable and fully undoable, so no single click can quietly put patient data at risk.
Two users and one regulatory standard.
To ground a new tool in reality, I ran a full research phase: 34 questionnaires, 14 interviews, and 7 shadowing sessions watching people redact images in their own environment. Three findings shaped the decisions that followed.
Data managers are measured by efficiency
They have to confirm every trace of PHI is gone across enormous volumes of images, all while moving between separate, specialized programs.
Site users need speed above all
They upload images and need to get in and out of the EDC fast, because they are managing real patients in real time.
FDA rules were the baseline requirement
With most clients based in the US, the FDA rules for electronic signatures and audit trails became the standard behind every decision.
Every objective, delivered.
A blind review portal inside Fusion
- Blinded reviewers view, read, redact, and audit every image without leaving Fusion.
Redaction in under three clicks
- AWS Rekognition, AWS Medical Transcribe, and the LeadTools medical viewer clear PHI across many image instances at once, retiring the old download, redact locally, and re-upload loop.
Auditable and reversible by design
- A full audit trail sits on every page, and every automated action stays reviewable and undoable.
Ready to scale
- Responsive down to web tablet, with scalability phased so scope stayed honest.
The module cut redaction sessions roughly in half and kept the false-negative rate under 1%, with a full audit trail on every page. Because reviewers kept authority at every control point, it earned the confidence of both internal teams and the regulatory boards it had to satisfy.
In a regulated product, trust is a design material. Auditability and reversibility have to be designed in from the first sketch, not bolted on at the end.
Clear principles turn ambiguity into decisions. Naming “human authority,” “trust before speed,” and “reversibility” up front let me disqualify slick ideas that quietly added risk.
Constraints sharpen the work. With UI changes off the table, focusing purely on workflow and reviewer decision-making produced a faster, safer tool than a full redesign would have.