Beyond Regex: Smarter Strategies for Detecting PII and PHI in eDiscovery

Consider this common challenge: During document review, sensitive details like Social Security numbers or medical records can easily slip through traditional detection methods. When that happens, the risk isn’t abstract; it can lead to compliance issues or even a data breach that impacts both clients and organizations.

Safeguarding personally identifiable information (PII) and protected health information (PHI) isn’t just about meeting regulatory requirements; it’s about reducing breach risk and maintaining trust. Yet accurately identifying and redacting this data remain among the most persistent challenges for legal teams.

The Limitations of Traditional Search

Many workflows still rely heavily on keyword lists and regular expressions to flag potential PII or PHI. While these methods are familiar, they come with two major limitations:

• Overinclusiveness: Traditional keyword and Regex-based searches often return thousands of false positives. A simple pattern for Social Security or phone numbers might pull in a huge volume of unrelated numeric strings, creating an overwhelming review burden.
• Underinclusiveness: Conversely, these searches can miss nuanced or context-dependent information as well as legitimate PII if not formatted in the expected manner. Medical details embedded in narrative text or identifiers hidden in images often slip through the cracks, leaving organizations vulnerable to inadvertent disclosure and potential breaches.

This combination of noise and blind spots highlights the need for more context-aware approaches.

The Role of AI in Modern Detection

Advances in artificial intelligence offer practical solutions to these challenges. Two technologies stand out:

• Language Models: Language models analyze linguistic patterns to identify sentences that likely contain medical or personal details. Instead of relying solely on keyword matches, they interpret context, distinguishing between “patient ID” in a clinical note and a random number in a spreadsheet.
• Computer Vision: Sensitive data isn’t always text-based. IDs, passports, and medical intake forms often appear as images. Computer vision algorithms can detect these visual cues, flagging documents that traditional text searches would miss.

Together, these techniques create a layered approach that reduces false positives while capturing edge cases, helping organizations minimize breach risk without overwhelming review teams.

Best Practices for Implementation

Organizations looking to modernize their privacy workflows should consider:

• Hybrid Detection Models: Combine pattern recognition with AI-driven context analysis for maximum coverage.
• Continuous Model Training: Update detection models on a regular cadence with domain-specific terminology and emerging data types to maintain accuracy.
• Integrated Review Dashboards: Present flagged content in intuitive panels that streamline escalation and redaction decisions.
• Auditability and Reporting: Ensure every detection and redaction step is logged for defensibility in litigation or regulatory audits.

An Example in Practice

Tools like ProSearch’s Privacy Suite exemplify these principles. By blending language models for nuanced text analysis with computer vision for image-based detection, Privacy Suite moves beyond static keyword lists. It identifies medical sentences, government IDs, and even photo-based PII, enabling legal teams to act decisively while minimizing review fatigue. The takeaway isn’t about one product; it’s about adopting workflows that prioritize precision, scalability, and breach prevention.

The Final Word

As data volumes grow and privacy regulations tighten, relying on yesterday’s methods is no longer sustainable. AI-powered detection isn’t a luxury; it’s a practical step toward defensible, efficient eDiscovery and reducing breach risk.

Strategic Considerations for Migrating to RelativityOne

As legal technology continues its steady shift to the cloud, RelativityOne has emerged as a leading platform for eDiscovery. With its modern architecture, robust security features, and scalable infrastructure, many legal teams are evaluating when and how to make the move.

But while the benefits of the platform are clear, the path to RelativityOne is not always straightforward. Migrating large volumes of data from legacy systems, especially those with complex integrations or active matters, requires careful planning, specialized knowledge, and cross-functional coordination.

Migration Is Not Just a Technical Project

Every organization brings a unique set of circumstances to its migration journey. Legacy environments often include customized workflows, tightly integrated tools, or idiosyncratic file structures that make a lift-and-shift approach impractical. Instead, successful migrations require a tailored strategy, one that balances technical requirements with operational stability.

Starting with Pilots: Building Confidence Through Early Wins

One effective approach is to begin with a pilot phase. Migrating a selection of representative workspaces allows teams to evaluate workflows, estimate timing, and identify any unexpected complexities early in the process. Pilots can help build internal confidence, validate assumptions, and provide a solid foundation for scaling the effort.

Managing Complexity Without Disruption

Whether migrating an archive or active matters with firm deadlines, the goal is always the same: ensure data integrity, minimize downtime, and avoid disruption. That requires not only technical skill, but also a consultative mindset. Open communication, clear expectations, and iterative validation steps can all help reduce risk and keep projects on track.

Collaboration Across Functions

Migration success depends on more than tools and scripts. It hinges on effective collaboration between legal, IT, project managers, and data specialists. Teams that approach migration as a shared initiative, rather than a one-time handoff, are better positioned to adapt and problem-solve in real time.

Lessons from Experience

At ProSearch, we’ve helped clients migrate more than a petabyte of data and over 600 workspaces into RelativityOne. While each project presents its own challenges, several lessons consistently hold true:

• Early alignment on goals and success criteria prevents confusion later.
• Pilot workspaces reduce surprises and clarify workload estimates.
• Migration should not be rushed; careful sequencing can avoid unnecessary disruption.
• Stakeholder involvement is essential from planning through post-migration validation.

The shift to RelativityOne offers real advantages—but to realize them fully, organizations must approach migration as a strategic initiative, not just a technology task. By planning thoughtfully and partnering effectively, legal teams can transition smoothly while laying the groundwork for long-term success.

ProSearch RelativityOne Services Manager Adarsh Haltore wrote about these issues and more in the recently published article, “Making the Leap: Practical Guidance for Migrating to RelativityOne.”

The Results Speak for Themselves

With every RelativityOne migration, ProSearch continues to deliver on what matters most: reduced downtime, maximized performance, and full access to all that RelativityOne offers. Learn more about our RelativityOne Expertise and our RelOne Migration Services.

Curious about making the move? Let’s talk about how we can make your migration streamlined, strategic, and completely yours.

LOS ANGELES – October 14, 2025 – ProSearch, a leading provider of comprehensive discovery and compliance solutions to corporate legal departments and law firms, announces it has earned the Relativity aiR for Privilege solution competency, becoming one of few Relativity partners worldwide to achieve this distinction. This milestone underscores ProSearch’s leadership in advancing AI-powered privilege review across the legal industry.

Partners recognized with the aiR for Privilege solution competency have demonstrated proven expertise in integrating RelativityOne’s generative AI technology to more accurately and rapidly identify privileged content, improving outcomes and reducing risk for clients.

“We’re honored to be recognized for our advanced proficiency with Relativity aiR for Privilege,” says Julia Hasenzahl, CEO of ProSearch. “By leveraging Relativity’s industry-leading generative AI, our team can streamline privilege review processes, identify sensitive content more effectively, and mitigate risk for our clients. This competency reinforces our continued commitment to innovation and partnership as legal teams navigate increasingly complex data challenges.”

With a track record of success and deep RelativityOne expertise, ProSearch is trusted by clients for its sophisticated approach to discovery and review. As legal matters grow more complex and data volumes expand, ProSearch’s achievement of the aiR for Privilege competency further demonstrates its mission to empower organizations with scalable, cutting-edge solutions for every matter. This latest recognition positions ProSearch at the forefront of best-in-class AI adoption throughout the eDiscovery life cycle.

The new competency builds on ProSearch’s prior recognition as a Relativity partner for both the aiR for Review and Data Migration solution competencies, demonstrating unparalleled depth in technical and client-facing eDiscovery expertise. With this achievement, ProSearch strengthens its leadership in enabling legal teams to confidently meet privilege review challenges in today’s data-driven world.

Reflecting on the 12th Annual Buying Legal Conference: The AI Moment in Legal Ops Has Arrived

A recap by ProSearch’s Farhat O’Neill

 

Two weeks ago, I had the privilege of attending the 12th Annual Buying Legal Conference at 3 Times Square in the heart of New York City—a gathering that, true to form, brought together forward-thinkers from the world’s leading corporate legal departments and law firms. With the backdrop of Manhattan’s iconic skyline, this year’s program drilled down into perhaps the hottest topic in legal operations today: the emergence and impact of internal AI teams at corporations and law firms.

 A New Era: Internal AI Teams & Predictability in Legal Ops

What resonated throughout the sessions was a collective recognition: legal functions are being called upon to deliver more predictability and insight, and AI—especially when developed with proprietary data and thoughtful governance—is our leverage. Multiple speakers emphasized how harnessing AI can unlock new insights to make us all better, safer, and faster at what we do.

 Standout Session: PiperAI’s Real-World Impact

A big highlight for me was the DLA Piper session. The firm unveiled PiperAI—an in-house platform developed to help their attorneys strategize and resolve cases more effectively. The numbers spoke volumes: in one use case, PiperAI helped drive $2M in savings off a settlement simply by surfacing key facts in medical records faster than any human reviewer could. This is AI at its most practical and business-impactful.

 Reverse Auctions and Building Vendor Relationships

A recurring (and hotly debated) topic was the place of reverse auctions in law firm selection and fee arrangements. I learned from fellow attendees they use reverse auctions for law firm intake (almost always), while using them only occasionally with other vendors. Panel discussions suggested auction outcomes can be mixed: they might drive prices down but, if misused, can actually damage the trust and collaboration needed for great legal outcomes. The consensus? Pick your auction moments, and don’t shy away from negotiation for high-impact, complex work.

 Core Muscles for Modern Legal Ops

If there was one rallying cry to take back, it’s this: success in legal operations now requires a few key muscles:

• Leading through rapid change
• Embedding AI adoption into the organizational DNA
• Championing constant experimentation
• Establishing agile governance and vetting for AI in an environment that changes by the minute

 Why GenAI, Why Now?

Multiple sessions drilled into the why. The answer? GenAI adoption is redefining speed—keeping legal operating at the pace of modern business. The benefits are clear: improved productivity, faster business opportunity realization, and streamlined practices.

 Getting AI Off the Ground: A Playbook

For those looking to launch or expand internal AI programs, several good practices emerged:

1. Uncover potential use cases. Start with what’s painful, inefficient, or high-impact in your workflow.
2. Find internal champions. Get buy-in from people who can inspire and drive the change.
3. Test and celebrate wins. Let users experiment; share results often; and reward early success.
4. Narrow in on scalable use cases. Once you find gold, focus on the opportunities with real, industry-grade impact.

In short, the 2025 Buying Legal Conference was proof that operational excellence is no longer about simply managing costs or negotiating better rates—it’s about harnessing AI to deliver value faster, safer, and more intelligently. I walked away energized and equipped, ready to experiment, champion, and lead my team into this AI-powered future for legal. Here’s to the next step forward.

In legal proceedings, the need to exchange information is inevitable, and often that information is private, sensitive, or protected. Many law firms and organizations lean heavily on protective orders during discovery, assuming these court-issued safeguards provide a sort of immunity against risks related to personal data exposure. The reality is much more complex: while protective orders are crucial tools in litigation, they do not absolve your independent obligation to protect private data.

Understanding the Limitations of a Protective Order

The intent of a protective order is to allow parties to exchange even the most confidential of materials while limiting unnecessary public exposure or misuse. A protective order will typically restrict who may access the designated data, how it may be used, and sometimes may require documents to be destroyed or returned after litigation concludes.

However, the benefits of a protective order have their limits. They do not erase or override regulatory responsibilities such as those outlined in the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), HIPAA, or any other privacy law. A protective order is not a magic shield—it is a disclosure control mechanism, not a safeguard against data breach, misuse, or compliance failures.

One of the biggest limiting factors in protective orders is the language of the order itself, as a poorly drafted protective order can exacerbate these risks. For example, if the order does not include explicit requirements on the receiving parties to maintain strict cybersecurity standards, this may itself be a liability.

Ongoing Duty: Privacy and Security Remain Paramount

Regardless of any court order, attorneys and organizations remain bound by stringent and multifaceted privacy obligations:

• Ethical Requirements: Legal professionals are ethically required to maintain client confidentiality—even under the pressure of discovery deadlines. Mishandling or inadequate protection of private data (like personally identifiable information or protected health information) can carry consequences ranging from disciplinary action to reputational damage.
• Regulatory Compliance: Global and local privacy laws continue to evolve, placing explicit requirements on organizations to ensure secure handling, storage, and transmission of personal and sensitive data. Data minimization remains one of the core tenets of privacy, even when disclosure is permitted or even mandated. Breaches can be costly—not just in fines, but also in lost trust.
• Risk Mitigation: Beyond regulatory frameworks, the real-world risk of exposing data can be severe. Data breaches don’t discriminate by firm size or intent, and the repercussions can affect parties, third parties, and even unrelated individuals. Because breaches are essentially a fact of life, being proactive is essential.

Best Practices for Private Data in Discovery

To meet these obligations and contend with ever-expanding volumes and types of electronically stored information, organizations should combine process rigor with the best available technology:

• Know Your Data: Data mapping serves as a first defense. Understanding what data exists, where it’s stored, and how it could be exposed is critical.
• Deploy Technology Wisely: Natural language processing, computer vision, and advanced analytics enable finer, more precise identification and classification of sensitive content buried in massive datasets.
• Limit Access: Implement strict controls so only those with a clear need to know can view protected information.
• Train and Monitor: Privacy solutions are not “set it and forget it.” Continuous model training, process review, and spot audits help keep systems robust as threats—and regulations—evolve.
• Have a Response Plan: Even with the best tools and intentions, data breaches can happen. Anticipate them; plan your response; and ensure incident protocols are ready to launch at a moment’s notice.

Protective Orders Are No Excuse for Lax Data Security

The bottom line is clear: a protective order might help manage how information is shared during litigation, but it does not erase your fundamental duties to protect private, sensitive, or regulated data. Legal teams, IT, and privacy officers must work collaboratively to ensure that compliance is maintained at every stage—before, during, and after discovery.

 

Want to learn more about how you can strengthen your organization’s approach to data privacy and eDiscovery? [Click here] to explore ProSearch’s data privacy solutions.

As law firms and corporate legal teams increasingly face the need to modernize, many are migrating their eDiscovery platforms to the cloud. This shift, while complex, offers significant opportunities to improve efficiency, scalability, and security.

This post explores some of the key challenges and best practices that can make or break a migration project.

 

Why Migration Matters

The decision to move away from legacy systems is rarely optional. Aging platforms may no longer meet evolving business requirements, vendors may discontinue products, or organizations may be under mandates to adopt cloud-based solutions. Migration isn’t simply a technical process of moving files. It’s a business-critical transition that impacts workflows, security, compliance, and ongoing litigation timelines. Given that eDiscovery platforms are always active, downtime or errors can translate into significant legal risks.

 

Plan Early, Plan Thoroughly
Early planning is the most consistent trait of successful migrations. Teams should begin with a full assessment of their current environment, including data size, case activity, and custom workflows. This “spring cleaning” stage offers the chance to decommission inactive matters, archive closed cases, and evaluate which workflows should be rebuilt, reimagined, or retired.

 Build the Right Team
Migration success relies on more than technology—it depends on people. Engaging certified migration vendors early allows them to work closely with procurement, information security, and governance teams. Appointing a dedicated project manager and involving stakeholders from across legal, IT, and client-facing teams ensures coordination and alignment.

 Addressing Technical Hurdles
From metadata compatibility to deduplication challenges, technical complexities abound in eDiscovery migrations. Pilot migrations—starting with smaller, closed matters—are essential for identifying issues, refining timelines, and familiarizing users with the new platform before high-priority cases are moved.

 Communication, Training, and Support
Migration affects people as much as systems. Tailored training for attorneys, project managers, and technical staff helps build confidence. Transparent communication, frequent status updates, and “change champions” within teams keep morale high. After cutover, a dedicated “hyper care” phase provides added support and ensures stability.

 Security and Defensibility
At every stage, security is paramount. From encrypted transfers to chain-of-custody documentation, maintaining rigorous compliance builds trust and protects client interests. Thorough documentation of decisions, exceptions, and retained data ensures defensibility and provides a reference for future projects.

 The Strategic Takeaway
Cloud migration for eDiscovery is both a challenge and an opportunity. Done right, it streamlines workflows, reduces costs, and strengthens information governance. The keys to success are early planning, careful inventorying, stakeholder engagement, pilot testing, robust training, and strict security protocols. By treating migration as an opportunity to modernize, law firms and legal departments can transform their practices into more efficient, secure, and future-ready operations.

ProSearch’s RelativityOne Services manager, Adarsh Haltore, took a deeper dive into these issues and more in an article published recently by the ALM/Law.com Law Journal Newsletter, Cybersecurity Law & Strategy. Read the full article here.