{"resourceId":"aws-xtasis-northwestern-research-deidentification-citegeist-20261109","versions":[{"version":"external-634640bbc8712dafeacf4eee6047847aef8330cd501be10a6a2368479df5cd16","resource":{"id":"aws-xtasis-northwestern-research-deidentification-citegeist-20261109","title":"AWS profiles Xtasis, a Northwestern researcher's company, whose de-identification and citation tools run on AWS, with claimed 60-75% literature-time savings","organization":"Amazon Web Services (profile of Xtasis / Northwestern University researcher)","sector":"Higher education research enterprise / medical research","geography":"United States (Northwestern University, Illinois) with users worldwide (claimed)","publishedAt":"2026-11-09","publicationDate":"2026-11-09","eventDate":"2026-11-09","sourceName":"AWS Public Sector Blog","sourceLabel":"Xtasis accelerates medical research and scientific writing with AWS","sourceUrl":"https://aws.amazon.com/blogs/publicsector/xtasis-accelerates-medical-research-and-scientific-writing-with-aws/","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["knowledge-work","data-security","developers-agents"],"finding":"AWS's November 9 Public Sector Blog post profiles three tools built by Xtasis, the company of Northwestern research assistant professor Adrienne Kline. PixelGuard de-identifies medical images, with a crosswalk log and low-confidence changes flagged for human review, and deploys inside the customer's own environment; NoteGuard redacts all 18 HIPAA identifiers from clinical notes. Both are sold through AWS Marketplace. CiteGeist manages literature, verifies that references exist and uses NVIDIA Nemotron via Bedrock and SageMaker AI for summaries. Claims include 'hundreds of hours' of redaction saved and a roughly 60-75% cut in literature-management time; no method or sample is given.","sledRelevance":"Relevant to research universities and academic medical centers preparing clinical data for NIH-funded studies and to research-integrity offices concerned about fabricated citations. Cross-tagged to the research stream because the use case is the university research enterprise. Northwestern is private; applicability to public universities is plausible but not shown.","evidence":"Vendor customer story with company quotes; metrics are self-reported without methodology, baseline or independent validation.","architectureImplications":"PixelGuard: CloudFront/S3 front end, Cognito, API Gateway, Lambda, DynamoDB, EventBridge, ECS on Fargate, KMS, WAF, CloudWatch; deployed in the customer's own account. CiteGeist: Amplify, API Gateway, Lambda, Step Functions, Nemotron via Bedrock and SageMaker AI.","governanceImplications":"In-account deployment keeps PHI under institutional control; IRB and privacy offices still need to validate de-identification quality.","securityPrivacyImplications":"Customer-account deployment reduces data sharing; residual re-identification risk from missed identifiers is not quantified.","caveats":"Vendor marketing with unverified metrics; private-university origin; no de-identification accuracy figures.","streamIds":["aws","research"],"roles":{"sales":"Interpretation: this is a research-enterprise conversation about data preparation and research integrity. The customer problem is months spent de-identifying clinical images and notes before research can start, plus growing worry about fabricated citations. Stakeholders are the vice president for research, IRB, privacy office and research computing. Discovery should ask how de-identification is done today and how accuracy is validated. A bounded engagement is an evaluation on a sample dataset. Do not repeat the 60-75% or hours-saved figures as established results.","engineering":"Interpretation: architecture fit is good for universities with existing AWS research accounts, because PixelGuard deploys in the customer's own environment. Prerequisites include an AWS account approved for PHI, a signed BAA, KMS key policy and an identity integration through Cognito SSO. Constraints include unpublished accuracy and no detail on how missed identifiers are measured. A proof of value should run the tools on a pre-labeled sample of images and notes and measure missed identifiers, false redactions and reviewer time against the current process.","delivery":"Interpretation: delivery work is a validation pilot owned jointly by research computing and the privacy office. Dependencies are IRB approval for using test data, a labeled sample and reviewers. Ownership of the deployed tool sits with research computing. Governance checkpoints include de-identification accuracy review, crosswalk-log retention rules and approval before production cohort use. Proposed acceptance criteria are measured identifier miss rates and reviewer time against baseline. Risks include re-identification from missed identifiers and over-reliance on summaries."},"roleDetails":{"sales":{"customerProblem":"Research teams spend months de-identifying clinical images and notes and managing citations, delaying studies.","stakeholders":["Vice president for research","IRB / privacy office","Research computing director","Research integrity office"],"discoveryQuestions":["How is de-identification done and validated today?","Is there an AWS account approved for PHI with a BAA?","How are citation errors detected now?"],"valueHypothesis":"In-account de-identification and citation tools may shorten study preparation; savings are self-reported.","potentialEngagement":"Validation pilot on a labeled sample of clinical images and notes.","unsupportedClaims":["60-75% time savings as an established result","De-identification accuracy","Applicability to public universities"]},"engineering":{"fit":"Good architectural fit for universities with AWS research accounts.","architectureIntegration":"Marketplace deployment into the institution's account using Cognito SSO, ECS Fargate and KMS; CiteGeist uses Bedrock and SageMaker AI.","prerequisites":["PHI-approved AWS account","BAA","KMS key policy","SSO integration"],"constraints":["No published accuracy","Private-university origin","Pricing not stated"],"security":"PHI stays in the customer account; validate redaction completeness and protect crosswalk logs.","proofOfValue":["Measure missed identifiers on labeled sample","Measure false redactions","Compare reviewer time with current process"]},"delivery":{"work":"Run a de-identification validation pilot with privacy oversight.","dependencies":["IRB approval","Labeled sample","Reviewers"],"ownership":"Research computing, with privacy office oversight.","skillsAdoption":"Reviewers need training on crosswalk logs and low-confidence flags.","governanceCheckpoints":["Accuracy review","Crosswalk-log retention rules","Approval before production cohorts"],"acceptanceCriteria":["Proposed: identifier miss rate at or below agreed threshold","Proposed: reviewer time measured against baseline"],"risks":["Re-identification from missed identifiers","Over-reliance on AI summaries","Unverified vendor metrics"]}},"retrievedAt":"2026-11-10T04:05:48Z","enrichedAt":"2026-11-10T04:11:25Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Not addressed.","procurementImplications":"PixelGuard and NoteGuard are available in AWS Marketplace; pricing not stated.","operatingModelImplications":"Human review of flagged changes remains part of the workflow.","sourceVerification":{"openedUrl":"https://aws.amazon.com/blogs/publicsector/xtasis-accelerates-medical-research-and-scientific-writing-with-aws/","referenceExcerpt":"CiteGeist has cut the time researchers spend wrangling their literature by roughly 60–75 percent","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}