PDF Tools for Healthcare
Merge, redact, OCR and convert medical records entirely in your browser. No PHI is ever transmitted to a third party, because there is no upload.
PDF Vault lets healthcare teams merge, OCR, convert and redact patient documents entirely in the browser, so protected health information is never transmitted to a third-party processor.
Patient records arrive as PDFs and scans, and they constantly need mundane work done to them: combining a referral packet, making a scanned chart searchable, pulling three pages out of a discharge summary, stripping metadata before something goes to a patient or an insurer.
Every one of those tasks is trivially solved by a free online converter, and every one of those converters requires you to hand over protected health information to a company you have no agreement with. Under HIPAA, disclosing PHI to a third party generally requires a Business Associate Agreement. A free web tool does not have one with you.
PDF Vault sidesteps the entire question by never receiving the file. Processing happens in your browser, on your device, using WebAssembly. There is no upload, therefore no disclosure, therefore no third-party processor to paper over with an agreement.
An honest statement about compliance
PDF Vault is not a certified or audited healthcare product, and we are not claiming to be a HIPAA-compliant vendor — any tool that tells you it makes you compliant by itself is overselling.
What we can state precisely is the architecture: because the software never receives your file, there is no disclosure of PHI to us, and no Business Associate Agreement is required for a relationship that does not involve us handling data. Your own obligations around device security, access control and workforce training are unchanged, and remain yours.
That distinction matters. The risk an upload-based tool introduces is a disclosure you then have to justify. Local processing removes the disclosure rather than documenting it.
The work this actually covers
The everyday tasks are all here, and they all run locally.
- Make scans searchable. Run OCR on a scanned chart so it can be searched and copied, without a cloud OCR API ever seeing it.
- Assemble referral packets. Merge multiple documents into one ordered file, then split out only the pages a recipient should receive.
- Strip identifying metadata. Remove author, producer and timestamp data before a document leaves your organisation.
- Protect what you send. Apply password encryption locally, with the password never transmitted anywhere.
Why this matters on a managed device
Clinical environments commonly log outbound file transfers. Uploading a record to a free converter can be a reportable event under your own institution's policy even when nothing bad happens to the file afterwards.
Because no bytes leave the machine, there is no transfer to log, no retention window on someone else's storage, and no vendor employee with access to the document.
The tools this team uses most
Frequently asked questions
Is PDF Vault HIPAA compliant?
Compliance is a property of your organisation's whole process, not of a single tool, so no software can honestly claim to confer it. What PDF Vault does is remove the third-party disclosure: because your file is never uploaded, PHI is never transmitted to us, and there is no processor relationship to cover with a Business Associate Agreement.
Do I need a Business Associate Agreement with you?
A BAA covers a party that creates, receives, maintains or transmits PHI on your behalf. We do none of those things — the processing happens entirely on your device and we never receive the file. If your compliance team wants this in writing, contact support@getpdfvault.com.
Where is the data stored?
On your device only. Recently opened files are held in your browser's local storage so you can reopen them, and clearing your browser data removes them. Nothing is synced or backed up to us.
Can I use this on a shared clinical workstation?
You can, but treat it like any shared machine: the recent-files list lives in that browser profile. Clear browsing data, or use a private window, when working on a shared device.