Turning Case Notes into Outcomes Data
Direct service organizations sit on years of narrative documentation that describes exactly what happened to their clients, and almost none of it reaches a report. AI extraction can finally make that record countable, but only if the privacy architecture comes first. This guide covers what extraction can and cannot do, how to de-identify safely, how to validate results you intend to publish, and how to run a pilot that does not put anyone at risk.

Every direct service organization has the same quiet problem. Caseworkers write detailed notes after every contact, describing what the client is facing, what was tried, what changed, and what came next. Those notes are the richest account of the organization's actual impact that exists anywhere. And when the annual report is due, none of that material makes it in. What gets reported instead is the small set of numbers the database happens to capture: people served, sessions delivered, referrals made.
The gap is not a failure of will. It is a structural mismatch. Case notes are unstructured prose, written under time pressure for a clinical or service purpose rather than an analytical one. Reading several thousand of them and coding what they contain is genuinely expensive work, and it is precisely the kind of work that never gets funded. So organizations report outputs because outputs are what the system counts, and the story of whether anyone's circumstances actually improved stays locked in the narrative.
Language models change the economics of that work substantially. A model can read a case note and reliably identify whether a client obtained stable housing, whether a benefits application was approved, whether a safety concern was raised, or whether a service goal was met. Research on structured pipelines for qualitative analysis has shown that carefully staged LLM workflows, with segmentation, coding, and quote extraction handled as separate steps and validated against expert review, can approximate expert-driven analysis while leaving an auditable trail. What was a six-month coding project can become an overnight batch job.
But case notes are also among the most sensitive documents a nonprofit holds. They contain names, addresses, health information, immigration details, disclosures of abuse, and observations recorded by staff who never imagined a machine would read them. Doing this work badly is not a minor operational error. It is a breach of the trust that makes the service possible. This article treats the privacy architecture as the first design decision rather than a compliance checkbox at the end, because in practice it determines everything else about how the system can be built.
The Data You Already Have and Cannot Currently Use
Before designing anything, it helps to be specific about what is actually sitting in your case notes and why it is valuable. In most human services settings, the structured fields in the case management system capture the transaction: date of contact, service type, duration, referral destination. The narrative captures the substance: why the client came in, what barriers surfaced, what the caseworker attempted, how the client responded, and what changed between visits.
That substance contains at least four categories of information that funders and boards repeatedly ask for and that most organizations cannot produce. The first is outcomes, meaning concrete changes in a client's situation such as securing housing, obtaining employment, resolving a legal matter, or completing a treatment course. The second is barriers, meaning the recurring obstacles that slow or block progress, which is the single most useful input for program design. The third is service pathways, meaning the actual sequences of support that clients move through, which almost never match the linear model in the logic model. The fourth is early warning signals, meaning the patterns that precede disengagement or crisis.
Consider a housing program that reports how many households received rental assistance. The case notes for those households describe which ones stayed housed six months later, which ones were displaced again and why, which landlords repeatedly refused vouchers, and which clients needed benefits advocacy before assistance could stabilize anything. The first number satisfies a grant report. The rest is what would let the organization redesign the program, and it is already written down.
It is worth naming the honest limitation up front. Case notes reflect what staff chose to write, filtered through their training, caseload pressure, and organizational norms. If caseworkers were never asked to note housing status at closure, extraction will not find it, no matter how good the model is. Extraction surfaces what is present in the record; it cannot conjure what nobody documented. That constraint shapes both what you should expect from a first pass and what you should change about documentation practice going forward.
What Structured Fields Capture
The transaction record
- Number of clients enrolled and sessions delivered
- Demographics collected at intake
- Service categories and referral destinations
- Program entry and exit dates
What the Narrative Captures
The substance nobody counts
- Whether a client's circumstances actually changed
- The barriers that recur across a caseload
- The real service pathways, not the idealized model
- Signals that precede disengagement or crisis
Privacy Architecture Comes First, Not Last
Most organizations approach this backwards. They pilot an extraction workflow, get excited about the results, and then ask the compliance question. By that point the sensitive data has already been sent somewhere, and unwinding the decision is far harder than making it correctly at the start. The right sequence is to decide where the data may go before deciding what you want to learn from it.
The first question is jurisdictional and contractual. If your organization is a covered entity or business associate under health privacy law, your case notes may constitute protected health information, and any vendor processing them needs an appropriate agreement in place. If you receive federal funding for substance use treatment, additional and considerably stricter confidentiality rules apply. If you run a domestic violence program, the confidentiality obligations are typically the strictest of all, and many funders prohibit disclosure of client-level data entirely. If you serve immigrant communities, the risk calculus around any data leaving your control changes fundamentally. None of these are edge cases; they describe a large share of the direct service sector.
The second question is architectural. There are three broadly viable patterns, and choosing among them is the most consequential decision in the project. You can de-identify first and send de-identified text to a commercial model. You can send identified text to a vendor under an appropriate agreement with contractual guarantees about retention and training. Or you can run a smaller open-weight model on infrastructure you control so that nothing leaves your environment at all. Each has real trade-offs in cost, quality, and operational burden, and the right answer depends on your legal obligations and your risk tolerance rather than on which is technically most elegant.
The third question concerns de-identification itself, and it deserves more skepticism than it usually gets. Automated removal of names, dates, and locations from clinical text has improved substantially, and current models perform this task well, but no automated approach is perfect, and case notes contain quasi-identifiers that resist simple redaction. A note describing a client's rare medical condition, unusual employment, and neighborhood may identify them precisely even with every name removed. This is why removing the obvious identifiers should be treated as risk reduction rather than as a guarantee, and why the output of extraction should be aggregated before it travels anywhere.
Three Architectures, Honestly Compared
Pick based on legal obligation and risk tolerance, not convenience
De-identify, then send
Strip direct identifiers locally, then send the redacted text to a capable commercial model. Gives you strong extraction quality at low cost, and keeps the highest-risk fields inside your walls. The weakness is that quasi-identifiers survive redaction, and complex notes sometimes lose the context the model needs to interpret them correctly.
Send identified text under contract
Use an enterprise agreement with explicit terms on retention, training exclusion, subprocessors, and breach notification. Preserves full context and therefore accuracy. Appropriate for many organizations, but it depends entirely on the contract being real and reviewed by someone who understands your funder obligations, not just accepted at signup.
Run the model yourself
Deploy an open-weight model on infrastructure you control so no client text ever leaves your environment. The strongest privacy posture and the only viable option for some programs. Costs more in staff capability than in hardware, and extraction quality on nuanced clinical language will typically trail the best commercial models.
Whichever architecture you choose, document the decision and the reasoning behind it before you begin. When a funder, auditor, or board member asks why client narratives were processed by an AI system, the answer needs to be a considered policy rather than a recollection. Our guide to building a data governance policy for AI covers how to structure that documentation so it holds up under scrutiny.
Designing the Extraction Schema Before You Extract Anything
The most common way this work fails is that someone asks a model to "find the outcomes" in a set of case notes. What comes back is a plausible, readable, and entirely unusable summary, because the question had no definition behind it. Extraction only produces trustworthy numbers when you have decided in advance exactly what you are counting and what evidence would count as sufficient.
A workable schema is a short list of fields, each with a precise definition, a closed set of allowed values, and a rule about what constitutes evidence. Instead of "housing outcome," you define a field called housing status at case closure, with permitted values of permanent housing, transitional housing, temporary arrangement with family or friends, unsheltered, institution, or not documented. That last value is essential and frequently omitted. A field that cannot return "not documented" forces the model to guess, and a model that guesses will produce clean-looking data that is quietly wrong.
Each field should also specify what the model must point to. Requiring the model to return a short supporting quote alongside every extracted value transforms the reliability of the whole system. It lets a human spot-check a result in seconds rather than rereading a full case file, it makes disagreements resolvable, and it produces the audit trail you will need if a number ever ends up in a public report. Extraction that returns only a value with no provenance is unverifiable, which means it is not evidence.
Build the schema with the people who write the notes. Caseworkers know that "housed" means something different in your program than the funder's definition, that a particular phrase is shorthand for a specific situation, and that a certain kind of entry usually means a client stopped responding rather than declined services. Encoding that knowledge into the field definitions is the difference between a schema that fits your records and one that fits a generic template. It also builds the buy-in you will need when staff are asked to trust and review the results.
Anatomy of a Well-Specified Field
Every field in your schema should answer all five of these
- A plain-language definition a new caseworker would read the same way
- A closed list of allowed values, always including "not documented"
- An evidence rule stating what the note must actually say to support each value
- A required supporting quote, so every value can be checked in seconds
- A worked example of an ambiguous case and how it should be resolved
The Pipeline: Four Stages, Each Doing One Job
Reliable extraction comes from breaking the work into discrete stages rather than asking a model to do everything at once. Each stage does a single, checkable job, which means errors surface where they occur instead of compounding invisibly through a single opaque step. This is the same principle behind the multi-stage pipelines that researchers have used to make LLM-assisted qualitative analysis auditable.
The first stage is preparation. Case notes are pulled from the source system, grouped by client and ordered chronologically, and passed through de-identification if your architecture requires it. Notes are also segmented, because a year of contact notes for one client is often too long and too repetitive to process well in a single pass, and because the unit you care about is usually the case rather than the note. Getting the unit of analysis right at this stage prevents an enormous amount of confusion later.
The second stage is extraction proper. The model receives one case at a time along with the schema, and returns a structured record with a value and a supporting quote for each field. Keeping this stage narrow matters. A model asked to extract eight well-defined fields will outperform the same model asked to extract forty, and it will be far easier to diagnose when a particular field starts producing odd results.
The third stage is validation, which is the stage organizations skip and the one that determines whether anyone should believe the output. Every supporting quote is checked to confirm it actually appears in the source note, which catches fabrication cheaply and automatically. A sample of records goes to human reviewers who code the same cases independently and compare. Records with internal contradictions or low confidence are flagged for review rather than silently accepted.
The fourth stage is aggregation and suppression. Individual extracted records are rolled up into counts, rates, and distributions, and small cells are suppressed before anything leaves the secure environment. If only two clients in the dataset fall into a particular combination of categories, publishing that cell can identify them regardless of how thoroughly the underlying text was redacted. Aggregation is not just a reporting step; it is a privacy control, and it should be enforced by the system rather than remembered by a person.
Controls Worth Building In
Enforced by the pipeline, not by discipline
- Automatic verification that every quote exists in the source text
- Minimum cell size enforced before any export
- An immutable log of which notes were processed, when, and by which model
- Role-based access, so extraction output is not broadly visible by default
Where Humans Stay in the Loop
Review effort concentrated where it changes decisions
- Defining and refining the schema alongside frontline staff
- Independently coding a validation sample for comparison
- Reviewing every flagged, contradictory, or low-confidence record
- Signing off before any extracted figure appears in a public report
Validation: Proving the Numbers Deserve to Be Believed
If an extracted figure is going into a grant report, it needs the same standard of evidence as any other reported number. That means you must be able to answer a simple question from a program officer: how do you know this is right? "The AI read the notes" is not an answer. A documented agreement rate against independent human coding is.
The practical method is straightforward. Before running the full dataset, take a random sample of cases, have two experienced staff members code them independently using the same schema, and reconcile their disagreements. That reconciled set becomes your reference standard. Then run the model on the same cases and compare field by field. You will learn two things at once: how well the model performs, and how well your schema is written. When two experienced humans disagree substantially on a field, the field definition is ambiguous and the model's confusion is a symptom rather than the disease.
Look at the errors rather than only the headline agreement rate. An overall agreement figure hides the pattern that matters. A model might handle housing status almost perfectly while systematically misreading employment outcomes because your notes use an internal shorthand it does not understand. It might perform well on notes written by long-tenured staff and poorly on notes from a program with different documentation habits. Those patterns are actionable, and they also tell you which fields need a human review step permanently rather than only during the pilot.
Watch particularly for differential accuracy across client groups. If extraction is less accurate for notes involving clients who needed interpretation, or clients in a particular program, or notes written by a specific team, then any aggregate figure will misrepresent those groups. This is the same equity concern that arises throughout applied AI, and it is especially serious here because the resulting numbers will be used to make funding and program decisions about the people the errors affect. Our guide on mapping and mitigating program inequalities explains how to structure that analysis.
Finally, document the validation and publish the caveats alongside the findings. A report that says a figure was derived from AI-assisted extraction of case notes, validated against independent human coding on a sample, with the agreement rate stated and the known limitations named, is more credible than one that presents the number bare. Funders have become considerably more sophisticated about AI-derived evidence, and transparency about method is now a mark of rigor rather than a confession of weakness.
The Failure Modes Worth Planning For
Several predictable problems show up in this work, and knowing them in advance is cheaper than discovering them in a board meeting. The most consequential is confident fabrication. A model asked whether a client obtained housing will, if the note is ambiguous, sometimes produce a definite answer with an invented justification. Requiring a verbatim supporting quote and automatically checking that the quote exists in the source is the single most effective defence, which is why it belongs in the pipeline rather than in a reviewer's checklist.
The second is silently treating absence as evidence. If a case note does not mention that a client secured employment, that does not mean they did not. It means the note is silent. Systems that collapse "not documented" into "did not occur" will systematically understate outcomes, and the error will be largest for the busiest caseworkers with the thinnest notes. Keeping documented negatives, documented positives, and silence as three distinct values prevents this, and it produces a useful side effect: the volume of "not documented" results tells you exactly where your documentation practice needs attention.
The third is drift. A schema tuned on last year's notes may degrade as programs change, staff turn over, and documentation conventions evolve. A model version change can shift behavior without any warning. Building in a small recurring validation sample, perhaps quarterly, catches this early, and it costs a few hours rather than the credibility of a year of reporting.
The fourth is surveillance creep, and it is the one that damages organizations most durably. A system built to measure program outcomes can very easily be turned toward evaluating individual caseworkers, because the same extraction that counts client outcomes can also count whose notes are thin and whose clients do worse. If staff suspect this is coming, documentation quality will change in ways that destroy the value of the entire dataset. The protection is an explicit, written, and enforced boundary stating that extraction outputs will not be used in performance evaluation, communicated before the pilot begins rather than after someone asks.
Warning Signs During a Pilot
Stop and reassess if you see any of these
- Extracted outcomes look dramatically better than staff expected
- The "not documented" rate is near zero across every field
- Supporting quotes are paraphrases rather than exact text
- Accuracy varies noticeably by program, team, or client group
- Someone asks whether the output could inform supervision decisions
Consent, Governance, and Being Straight with Clients
There is a question underneath all of this that technical controls do not answer. Clients disclosed difficult things to a caseworker in a relationship of trust. Did they agree to a machine reading it? In most cases the consent they signed at intake describes service delivery, quality improvement, and program evaluation in general terms, and a reasonable reading may cover internal analysis. But "legally defensible" and "consistent with what the client understood" are different standards, and organizations that only meet the first one tend to regret it.
The practical response has three parts. Review your intake consent language and update it so it describes, in plain terms, that records may be analyzed, including with automated tools, for the purpose of understanding and improving services. Say plainly what will never happen, such as sharing identified records with vendors for training purposes. And make the notice genuinely readable, because consent obtained through dense text that nobody reads is a formality rather than an agreement. Our article on informed consent in an AI context works through how to write language that clients can actually act on.
Governance should sit above the individual project. A standing decision about who may authorize processing of client narratives, what categories of program are excluded outright, what the retention period is for extraction outputs, and who reviews the practice annually keeps this from becoming a series of one-off judgment calls. It also means the next staff member who wants to try something similar inherits a framework rather than reinventing one under deadline pressure.
Some categories of record should simply be excluded, and deciding that in advance is easier than deciding it in the middle of a project. Notes from domestic violence services, records covered by heightened federal confidentiality protections, immigration case files, and notes involving minors in sensitive circumstances all warrant an explicit exclusion or a much higher bar. The value of better outcomes data does not outweigh a risk to a client's physical safety, and an organization that has written that principle down in advance will find the decision easy when it arises.
A Ninety-Day Pilot That Will Not Get You in Trouble
The right scope for a first attempt is deliberately small. Pick one program, one time period, and a handful of fields that answer a question someone is already asking. Trying to build a comprehensive outcomes system on the first pass produces a project that never ships and a schema nobody trusts.
In the first month, do no extraction at all. Confirm your legal obligations and funder requirements, choose your architecture and get any necessary agreement in place, write the exclusion rules, draft the schema with two or three caseworkers, and select the specific question the pilot will answer. Ending month one with a signed-off schema and a documented architecture decision is a genuine milestone even though nothing has been processed.
In the second month, build the reference standard and run the pipeline on a limited sample. Have staff code fifty cases independently, reconcile, then run extraction on the same cases and compare. Expect the first comparison to be disappointing and expect most of the problem to be in the schema rather than the model. Revise the definitions, rerun, and repeat until agreement is good enough for the decisions you intend to make with the data.
In the third month, run the full period, produce the aggregate findings with suppression applied, and write up the method alongside the results. Share the findings with the staff who wrote the notes before sharing them with anyone else, both because they will catch errors that reviewers miss and because a workforce that first encounters this system in a board presentation will reasonably conclude it was done to them rather than with them. That reception determines whether the second project is easier or harder than the first, which matters more than the findings themselves. The broader change management principles in our guide to overcoming staff resistance to AI apply directly here.
Choosing a First Question
Good pilot questions are narrow, answerable, and already being asked
- What housing situation were clients in at case closure last year?
- What are the five most common barriers documented across our caseload?
- How often does a benefits application appear in notes, and how often is it approved?
- Which external services do we refer to most, and do referrals appear to connect?
- Which of our funder-required outcome fields are simply never documented?
Conclusion
The narrative record that direct service organizations create every day is the most detailed account of their impact that exists, and for decades it has been effectively unreadable at scale. That constraint has quietly shaped the entire sector's relationship with evidence, pushing organizations to report the outputs their databases happened to capture rather than the outcomes their staff actually observed. AI extraction lifts that constraint for the first time, and the change is genuinely significant.
But the constraint that replaces it is trust. These records exist because clients disclosed difficult things to people they believed would handle the information carefully. An organization that extracts outcomes data at the cost of that relationship has traded something irreplaceable for a better grant report. This is why the sequence matters so much: architecture and consent first, schema second, extraction third, validation before anyone believes a number.
Done well, the payoff extends past reporting. Organizations that run this work carefully consistently find that the most valuable output is not the outcome counts at all. It is the discovery of which outcomes are never documented, which barriers recur far more than anyone realized, and which service pathways clients actually follow. That knowledge changes program design, and it was available the whole time inside notes nobody had the capacity to read.
Start narrow. One program, one question, one quarter of notes, a schema built with the people who wrote them, and a validation step you would be comfortable describing to a funder. If you can do that once and have your caseworkers agree the results reflect what they saw, you have built something worth expanding. If you cannot, you have learned that cheaply, which is its own good outcome.
Make Your Case Notes Count
We help direct service organizations design extraction workflows that respect client confidentiality, hold up to funder scrutiny, and tell staff something they can actually use.
