A real-world architecture for finding sensitive data hidden inside medical images at scale. Jordan and Riley cover how Clario (part of Thermo Fisher) auto-detects PHI/PII across thousands of DICOM slices in clinical trials, where sensitive data hides in three surfaces: standard metadata tags, custom/vendor private tags, and text burned into the image pixels themselves. The architecture: images in S3, API Gateway at the edge, an EKS detection backend (a single series can span thousands of slices, so it's long-running and memory-intensive), RDS PostgreSQL for auditable compliance metadata, Amazon Textract for OCR, and Anthropic's Claude Sonnet 4.5 on Amazon Bedrock to identify PHI/PII in extracted text and deep-scan pixels for burned-in text, returning type + precise bounding boxes. The key design call: detection is deliberately separated from redaction — the AI does high-recall flagging, while irreversible masking happens in a separate human-in-the-loop QC flow. Evaluated against production-representative data (with and without PHI, to measure false alarms) using spatial-proximity matching: F1 of 0.975 on burned-in image text, 0.995 on metadata tags. Lessons: evaluate on real-world variability (off-the-shelf models degrade), never let AI drive irreversible redaction alone, and mind data minimization (S3 lifecycle auto-delete). Source: How Clario technology detects PHI/PII in DICOM images using Amazon Bedrock — AWS Architecture Blog, Aug 19 2026, by Alex Boudreau, Cuong Lai, Matthew Agard & Praveen Haranahalli — https://aws.amazon.com/blogs/architecture/how-clario-automates-phi-pii-detection-in-dicom-images-using-amazon-bedrock/ This is commentary/summary in the hosts' own words, not a reproduction of the article.