What Is Redacted Information in Legal Documents?

Redacted information is any part of a document that has been permanently blacked out or removed before the document is filed, released, or published, so that sensitive details are hidden while the rest of the record stays readable. Instead of withholding a whole file, redaction strips out the pieces that need protection — a Social Security number, a classified source, a patient’s address — and leaves everything else in place. You’ll see it in court filings, government records released under public records laws, medical charts, and corporate contracts, and in many of those settings federal law requires it.

What Redaction Does

Redaction makes specific data within a document unreadable or unrecoverable while leaving the surrounding content intact. The point is selective removal, not blanket secrecy. A 50-page FBI report released under a public records request might arrive with names and investigative techniques blacked out, but the timeline, the general findings, and the agency’s conclusions remain visible.

This is different from sealing a document. When a court seals a record, no one outside authorized parties can view any of it. When a court requires redaction, the document stays publicly available with the sensitive details stripped out. Federal courts sometimes use both tools at once: a party files an unredacted version under seal for the judge, plus a redacted version that goes into the public record.¹

Why Information Gets Redacted

Most redactions fall into a handful of categories, and a single document often triggers several of them at once.

Personal privacy. Removing identifiers that could enable identity theft or expose individuals to harm. This is the largest category by volume, showing up in nearly every court filing, government record release, and medical disclosure.
National security. Keeping classified intelligence sources, defense information, and diplomatic communications out of public view. Federal agencies routinely redact these details before releasing records.
Trade secrets and business data. Shielding formulas, client lists, pricing strategies, and internal assessments from competitors, which comes up constantly in commercial litigation.
Legal privilege. Protecting attorney-client communications, work product, and other privileged exchanges the law treats as confidential.
Law enforcement operations. Hiding informant identities, investigative techniques, and details of ongoing cases that could be compromised by disclosure.

A federal investigation file might contain classified material, a confidential informant’s name, and personal data about uninvolved third parties, each requiring its own legal justification for being blacked out.

What Kinds of Information Are Typically Redacted

Personal Identifiers

Personally identifiable information is the most frequently redacted category. In federal civil filings, Social Security numbers are trimmed to the last four digits, birth dates reduced to the year, financial account numbers cut to the last four digits, and minor children identified only by initials.² Federal criminal filings follow similar rules, with the added requirement that home addresses be reduced to city and state.³ Bankruptcy filings, which are public records, carry the same redaction requirements for Social Security numbers, taxpayer identification numbers, financial accounts, birth dates, and names of minor children.⁴

Medical and Health Information

HIPAA’s Safe Harbor method for de-identifying health information lists 18 categories of identifiers that must be removed before protected health information can be shared without patient authorization. The list goes well beyond names and dates. It includes telephone and fax numbers, email addresses, medical record numbers, health plan beneficiary numbers, vehicle identifiers, device serial numbers, IP addresses, biometric data like fingerprints, full-face photographs, and any other unique identifying number or code.⁵ An IP address logged during a patient portal visit counts as protected information.

Classified and Law Enforcement Material

Government documents released under the Freedom of Information Act often arrive with entire paragraphs blacked out. The statute provides nine specific exemptions that let agencies withhold portions of records, including properly classified national defense information, confidential source identities, and law enforcement techniques whose disclosure could help people circumvent the law.⁶ Agencies must release everything that doesn’t fall under an exemption; one sensitive paragraph is not grounds for withholding an entire page.

The Laws That Require Redaction

Redaction isn’t a courtesy. It’s driven by overlapping federal laws, each addressing a different slice of sensitive information.

Freedom of Information Act

FOIA creates the default rule that federal agency records are open to the public, then carves out nine categories where agencies may withhold information. The exemptions most relevant to redaction cover national security secrets, trade secrets and confidential commercial data, personal privacy in personnel and medical files, and several categories of law enforcement records.⁶ When an agency invokes an exemption, it redacts the protected portions and releases the rest. Most states have their own versions of FOIA with similar exemption structures.

HIPAA

The Health Insurance Portability and Accountability Act requires covered entities — hospitals, insurers, clearinghouses, and their business associates — to protect individually identifiable health information. When health records are shared for research, public health, or other permitted purposes, HIPAA’s de-identification standards dictate exactly what must be stripped out.⁵ Even when patients request their own records, covered entities may redact psychotherapy notes and information compiled for litigation before handing over the file.⁷

The Privacy Act of 1974

The Privacy Act restricts how federal agencies can disclose records about individuals. As a default, no agency may share a record from its systems without the written consent of the person the record is about. The law lists 12 exceptions, including disclosures to employees who need the record for their duties, disclosures required under FOIA, law enforcement requests, and congressional inquiries.⁸ When a record is released under one of these exceptions, redacting irrelevant personal details is typically how agencies comply with the Act’s broader privacy protections.

Federal Court Rules

Both civil and criminal federal court rules require parties to redact personal identifiers before filing documents. Federal Rule of Civil Procedure 5.2 covers civil cases, and Federal Rule of Criminal Procedure 49.1 covers criminal cases.²³ Both rules were adopted under the E-Government Act of 2002, which recognized that electronic filing systems made court documents far more accessible to the public than they had been when records sat in courthouse file cabinets.

The responsibility to redact rests entirely on the filing party and their attorney. Court clerks are not required to review documents for compliance. A party who files an unredacted document by mistake must seek relief from the court, which may order the document sealed or require a redacted replacement. Filers can also submit a sealed reference list that links each redacted identifier to its full version, giving the court access to the complete information without exposing it publicly.²

How Redaction Is Actually Done

On paper, redaction means physically covering text with opaque tape or heavy black marker and then photocopying or scanning the result. The photocopy is the redacted version; the original stays secured. This sounds simple, but holding a marked-up page up to bright light has revealed supposedly redacted text more than once. The physical original should never be the document that gets distributed.

Digital redaction is more complex. Proper redaction software doesn’t just draw a black box over text. It permanently removes the underlying data layer from the file. In a correctly redacted PDF, selecting and copying the blacked-out area produces nothing, because the text no longer exists in the file. Good redaction tools also strip metadata: author names, revision history, comments, tracked changes, and hidden layers that can betray information the filer intended to conceal.

The distinction between a document that looks redacted and one that is redacted matters enormously. Simply covering text with a black rectangle in a word processor or image editor is not redaction. The text remains embedded in the file, waiting for someone to copy and paste it into a plain text editor. The same trap catches people who black out text with a highlight tool set to black and then export to PDF: the text is still there, just black on black, and selecting the entire document and pasting into another application exposes everything underneath. Scanned documents carry their own risk when a PDF includes an OCR text layer beneath the image; blacking out the visible scan leaves the invisible text layer intact for anyone running text extraction.

When Redaction Fails

Failed redaction has produced some genuinely spectacular leaks. In January 2019, attorneys for Paul Manafort filed a court document whose redactions were nothing more than black overlays. Reporters copied and pasted the “hidden” text within minutes, revealing allegations that Manafort had shared campaign polling data with a foreign intelligence-linked associate and held secret meetings in Madrid. In 2009, the TSA accidentally published its entire airport screening manual with redactions that could be bypassed the same way, exposing covert testing procedures and screening exemptions.

The legal consequences of failed redaction depend on what gets exposed. HIPAA violations carry civil penalties that the Department of Health and Human Services adjusts annually for inflation, and knowing violations can carry criminal penalties including imprisonment. In federal court, the rules don’t spell out specific fines; instead, the court can order the non-compliant document sealed and require a properly redacted replacement.² But once a document has been publicly accessible on an electronic filing system, even briefly, the damage is done. Opposing counsel, journalists, and the public may have already downloaded it. An attorney whose redaction failure exposes confidential client information also faces potential malpractice claims and professional discipline for breaching the duty of confidentiality.

For classified government information, the stakes are higher. Improper disclosure of national security material can trigger investigations, security clearance revocations, and criminal prosecution under federal espionage and classified information statutes.

1
United States District Court for the Eastern District of Pennsylvania. Redaction Requirements and Sealed Documents
2
Office of the Law Revision Counsel. 28 USC App Fed R Civ P Rule 5.2 – Privacy Protection For Filings Made with the Court
3
Legal Information Institute. Federal Rule of Criminal Procedure 49.1 – Privacy Protection For Filings Made with the Court
4
United States Bankruptcy Court Northern District of Florida. Privacy Policy and Redaction Requirements
5
U.S. Department of Health and Human Services. Guidance Regarding Methods for De-identification of Protected Health Information
6
Department of Justice. The Freedom of Information Act, 5 USC 552
7
U.S. Department of Health and Human Services. Individuals’ Right under HIPAA to Access their Health Information
8
Office of the Law Revision Counsel. 5 U.S. Code 552a – Records Maintained on Individuals