Redaction That Wasn't
A hospital's legal department must release 340 pages of a malpractice case file to opposing counsel. The file contains patient names, dates of birth, and account numbers on roughly 60 pages. A junior analyst uses a PDF editor's black-highlight annotation tool to cover the sensitive text, then flattens the file and emails it. Opposing counsel later extracts the underlying text and finds every redacted name intact. Separately, the hospital must keep the unredacted master for 10 years under its retention policy, and only three named attorneys may access it.
1. Explain precisely why the redaction failed and what a correct redaction workflow requires.
Read the worked answer
The failure is a category error: drawing a black box is not redaction. An annotation or shape drawn over text leaves the text layer intact underneath. Flattening renders the visual appearance but does not necessarily remove the text object - and even when it does, the metadata and any prior versions may retain content.
Correct redaction requires true redaction that removes the underlying text and image content, not covers it:
- Apply redaction marks using the dedicated redaction tool.
- Apply the redactions - this is the step that actually deletes content.
- Sanitize the document to strip hidden metadata, annotations, and embedded content.
- Verify by searching the output for each sensitive term and by attempting to select text in the redacted regions.
A correct workflow also includes a second reviewer before release. The lesson: visual coverage is not removal, and verification is mandatory, not optional.
2. Design access control and retention for the unredacted master.
Read the worked answer
Two distinct needs: confidentiality (only three attorneys) and retention (10 years, defensible).
Access control:
- Store the master in a repository with named-user permissions, not a shared drive. Grant access to exactly the three attorneys and no group-level inheritance that could widen it.
- Apply document-level protection (password/permissions or a rights-management policy) so the file stays protected even if copied out of the repository.
- Log access. For a malpractice file, an audit trail of who opened the master matters as much as the lock.
Retention:
- A 10-year hold means the file must survive staff turnover and system migrations. Document the retention rule, the custodian, and the destruction date.
- Keep the redacted release copy and the unredacted master as separate records with separate retention rules; do not let the release copy become the system of record.
- On expiry, destruction must be verifiable and complete - including any copies pulled for review.