## 4 Discussion
The first approach is to apply regular expressions and other handcrafted rules to remove references, which requires manual effort and is unlikely to transition into different contexts. The second approach is to use machine learning and train generalized models to remove references with their own decision-making. However, this approach is often challenging to execute because it requires a large database of labeled medical text data, which would be difficult or time-consuming to compile. The recent publications of two open-source German medical text databases (CARDIO:DE [27] and GGPONC 2.0 [28]) are a crucial step forward for model development and also for model evaluation in the future. With more databases like this, a gold-standard AI model for German medical free-text de-identification could emerge in the future. In the current absence of such a model, the _Masketeer_ algorithm constitutes an example of how handcrafted rules--albeit highly time-consuming--and domain expert knowledge can be used to remove identifiable data effectively and efficiently from unstructured German medical texts. Although the algorithm was fine-tuned for the application on \"_HerzMobil_\" clinical notes, it was designed to be flexible even in other scenarios. Therefore, the algorithms can be configured with any kind of specialized name dictionaries. Although the manual additions and handcrafted exceptions required (e.g., blacklist of names, medical site additions by hand) were time-consuming, they ensured that the _Masketeer_ algorithm could handle colloquial language, nicknames, and non-standard abbreviations correctly. Developing the de-identification logic around a masking ensemble had a range of advantages from a software design point of view. **Efficiency:** The _Masketeer_ algorithm called the individual _Masker_ subclasses in the order displayed in Table 3. Since the algorithms stopped as soon as the first class voted for token removal, computational resources were saved since subsequent _Maskers_ could be omitted. The results depicted in Figure 3 confirm a linear runtime complexity in terms of the number of tokens and corpus size. **Testability:** Separating and splitting the logical calls into multiple smaller units allowed for more convenient development. Debugging induvial errors was significantly easier since logic checks were compartmentalized and it is easier to debug five small algorithms with four logic checks each than one large algorithm with twenty checks. Further, it simplified test writing because individual unit tests could be written for each _Masker_ class. **Scalability:** For similar reasons, the ensemble made _Masketeer_ easier to scale. If new de-identification rules or a new logic were developed, they could independently be inserted into the ensemble without the risk of breaking the logic of other _Maskers_. Overall, the ensemble made complex logic checks clearer and more manageable. However, as a consequence of using multiple _Maskers_, the ensemble's calling order mattered. After experimentation, the order seen in Table 3 was found to work best but was not flawless in all cases. In most cases, increasing patient privacy comes with the cost of reducing the utility of data. Text pseudonymization is also subject to this dilemma, as redacting certain elements from the text is equivalent to removing information. A previous study based on the same corpus as the one used in the present study found that pseudonymization impacts the classification performance [25]. Therefore, it is critical to strike a balance between patient privacy and data utility. This was considered in _Masketeer's_ development too, for example by applying pseudonymization instead of anonymization, although the latter would offer even higher levels of privacy. In the same spirit, corpus-wide pseudonyms allowed readers to follow communication pathways across multiple notes even in pseudonymized form. The same consideration applies for NER, as the differentiation between HCP-, patient- and person-specific pseudonyms also technically reduces privacy.