Nonimo for US law firms, CPA firms and clinics
The SSN stays in your office. ChatGPT still writes the draft.
Nonimo swaps Social Security numbers, medical record numbers and ITINs for placeholders at the desk, so ChatGPT, Claude or Copilot works with the placeholders and the real values return in the response.
For law firms, CPA firms and healthcare practices.
Mac with Apple silicon and macOS 14 or later · Windows 10 or later, 64-bit (x64) · under 2 MB.
The first time you open Nonimo, Windows may show a SmartScreen notice because the app is new: click “More info”, then “Run anyway”.
The 12 US identifiers it masks by name
Each number shown with the label it carries on an intake sheet, next to the placeholder the AI sees in its place.
| Identifier | Where it shows up | What the model sees |
|---|---|---|
| Social Security number | Intake forms, W-2s, tax returns | [SSN_1] |
| ITIN | Tax returns, W-7 paperwork | [ITIN_1] |
| Medical record number (MRN) | Referrals, chart notes, claims | [MRN_1] |
| Medicare Beneficiary Identifier (MBI) | Medicare cards, patient intake, claims | [MBI_1] |
| Health plan member ID | Insurance cards, eligibility checks, EOBs | [HEALTH_PLAN_MEMBER_ID_1] |
| EIN | W-9s, payroll filings, business returns | [EIN_1] |
| Bank account number | Direct deposit forms, voided checks, wire instructions | [BANK_ACCOUNT_US_1] |
| A-Number (Alien Registration Number) | Green cards, EADs, USCIS notices | [A_NUMBER_1] |
| USCIS receipt number | I-797 notices, case status checks | [USCIS_RECEIPT_1] |
| Driver's license number | Intake notes, accident reports | [REFERENCE_1] |
| Vehicle identification number (VIN) | Vehicle titles, bills of sale, insurance claims | [VIN_1] |
| Federal court case number | Pleading captions, PACER dockets, court orders | [FEDERAL_CASE_NUMBER_1] |
The swap happens at the desk where the prompt is written, and the real values return in the answer. Names, dates of birth, phone numbers, email addresses, payment cards and passports are handled the same way; our security page shows how each is identified.
Which rules decide what can go into ChatGPT
No single US privacy law covers this. Which rule applies depends on who you are: a covered entity under HIPAA, a lawyer under your state version of Model Rule 1.6, or a tax preparer under the FTC Safeguards Rule.
HIPAA
A BAA before any PHI
Protected health information can go to a vendor only under a business associate agreement, per 45 CFR 164.502(e). None of the four big AI providers offers one on a consumer plan, and HHS certifies no product as HIPAA compliant.
Safe harbor
Eighteen identifiers, not three
De-identification under the safe harbor provision means removing all eighteen categories, with no actual knowledge that what is left could point to the patient. Masking the obvious numbers does not get you there.
Model Rule 1.6
Confidentiality, whatever the source
The duty reaches everything tied to the representation, not only names. ABA Formal Opinion 512, issued July 29, 2024, carries it into generative AI and puts informed client consent in front of it.
FTC Safeguards Rule
Tax preparers count
A firm that completes income tax returns is a financial institution under 16 CFR Part 314. The duty follows the customer record, including to any vendor you hand it to.
Taking identifiers out before the paste is the practical half of that. Nonimo does it at the desk, with one keystroke, so the model works on placeholders. It works alongside the BAA, the client's consent and the vendor contract those rules ask for, not in place of them. The HIPAA side, tool by tool, is in which AI tools a covered entity can use.
A summary, not legal advice. Your state's rules sit on top of all this: your bar's ethics opinions and your state's breach notification law.
Guides for US practices
Worked through against HIPAA, the Model Rules and the federal and state rules behind them.
PHI vs PII in HR files: what is sensitive before it goes to AI
PHI vs PII in an HR file: why an FMLA note is not PHI, what California calls sensitive personal information, and what to take out before AI sees it.
AI disclosure language for engagement letters: sample clause
AI disclosure language for engagement letters: when US bars expect the client to be told, and a clause to paste, with the client data sentence in two versions.
Do you have to disclose AI use in court filings? What you sign
Do you have to disclose AI use in court filings? It depends on the court and the judge. What you may be asked to sign, and what must stay in the firm.
Redacting before AI: what it protects, and what it does not
Under US law the same edit has five consequences. Privilege and Rule 1.6 are not about identifiers, and two state breach laws exempt encryption, not masking.
AI in local government: when your prompts are public records
A records request returned thousands of pages of city staff chat logs. What that means for resident data, and which rules actually bind a US agency.
HIPAA compliant AI: BAAs, plans and the 18 identifiers
HIPAA compliant AI is not a product you buy. The ChatGPT plans OpenAI will sign a BAA for, the features each excludes, and the 18 HIPAA identifiers.
Does ChatGPT share or sell your data? What OpenAI says
OpenAI runs two privacy policies at once, and the American one is newer and wider. What it says about sharing, selling, keeping, training and deleting.
Does Claude train on your data? What Anthropic says
Yes on consumer plans unless you turn it off, and no on commercial ones. The opt out has two written exceptions, and the retention ladder runs to seven years.
Does Microsoft Copilot train on your data? Four answers
Copilot is four products with one name, and Microsoft split its consumer documentation on August 18, 2026. Which page applies to you, and what each one says.
What Gemini does with your data, and what deleting does not
Google keeps human reviewed chats for three years after you delete your activity, and says so itself. What the Gemini settings reach, and what they leave alone.
What cyber insurance does not cover, for a US small business
Five carriers, two application forms and a March 2026 court ruling, read: the sublimits, the exclusions, the controls they require, and what they say about AI.
Pricing, and where it stands today
The desktop app is available on both platforms, Mac and Windows; the browser extension and the compliance panel are in development.
Nonimo’s free plan stops at a set number of words each month. Leave an email address on our license page and a free license file comes back that removes the cap through January 31, 2027, with no account to set up.
- Free today, on Mac and Windows
- With a monthly word allowance
- The free license lifts it through January 31, 2027, no account needed
Questions US practices ask
Does Nonimo send PHI or client data to its servers?
No. The text you select is processed locally and none of it is transmitted to us. The app does check in daily with a usage report: words counted against the monthly allowance, which release and platform it runs on, and a per-install identifier, among other fields, every one of them listed on our security page.
Is Nonimo HIPAA compliant?
HHS certifies no product as HIPAA compliant, and we won't claim it either. Compliance is about how a covered entity uses a tool. Nonimo cuts down what reaches an AI vendor, but what it does is not de-identification under the safe harbor, so the BAA question stays with you.
Does removing client names protect privilege?
Not by itself. Privilege depends on who got the communication and in what setting, not on which words were taken out, and Model Rule 1.6 still reaches the rest of what you share about the matter. Removing identifiers lowers the exposure; it does not make a disclosure privileged again.
What does Nonimo cost?
The free plan stops at a set number of words each month, and the license that removes the cap is free through January 31, 2027, with no account to set up.