How to read this page
- Every step is one screen, or one moment, in a real run. The label under the title names where it happens, and the step reads in the same order each time: what is happening, the evidence, and then what to look for in it.
- Screenshots are real pictures of the Munitas console, the web app that people open in a browser. Click any picture to enlarge it.
- Every name of a person, patient or card holder in the example data is invented, and every screenshot is unedited apart from being cropped to the part that matters.
Words used on this page
- Organisation
- A company or hospital group that uses Munitas. Each organisation sees only its own data.
- Department
- A team inside an organisation that owns some of its data, such as Cardiology.
- Dataset
- A named collection of records, such as a table of patient admissions.
- Custodian
- A person who holds the data custodian role, which allows deciding who may read data. A custodian decides for the departments they are an approver for.
- Pipeline
- A series of steps that Munitas runs on a dataset version, each step after the ones it depends on. The last step is a gate decision.
- Run
- One execution of an agent or a pipeline, started for a stated purpose.
- Gate decision
- The final step of a pipeline, where a person decides whether a dataset version may be released to a more open access level. The person who started the run may not decide it.
- De-identification reviewer
- A role that allows a person to review data from which identifying details have been removed, and to decide whether it may be released.
- Under review
- The access level of something that no person has reviewed. Nobody may use it until a reviewer decides that it may be released.
- Open for annotation
- An access level above Under review, where people who label data may work with it.
- Answer key
- A file that holds the correct written text of one recording, used to check how well names were removed from it. It is named after its recording and belongs to the same patient.
- Locked column
- A column whose values are scrambled under a key made for each person. Reading them back needs permission. Destroying a person’s key later makes their values unreadable for good, while the sealed table itself never changes.
- Release
- A decision to let a dataset version be read more widely than before. A release changes who may read it and moves no data.
- Version
- One sealed state of a dataset. Changing the contents means making a new version, never editing an old one.
- Access level
- How restricted a dataset is. Raw is the most restricted, and nobody may read it without permission. Published is the most open.
- De-identification standard
- A set of limits an organisation chooses for how much identifying detail a result may still hold, kept under a name for the audience the result is released to. A change adds a new version and the earlier ones stay.
- Data protection officer
- A person who watches how an organisation handles personal data. The role decides nothing about who may read it.
- Locked recording
- A recording stored scrambled under a key made for the one patient it is about. Reading it back needs the platform to open it, and destroying the patient’s key later makes it unreadable for good.
A run that removes names
The three recordings that Devi brought in are locked, and every word spoken in them is personal data. The research programme needs a version with the names, dates and addresses taken out. A pipeline is a series of steps that Munitas runs on a dataset version, each step after the one before it, and the built-in one removes identifying details from recordings.
On the version page, Devi chooses the pipeline that removes identifying details and presses Start. The pipeline opens each locked file through Munitas, which unlocks it with the key of the patient it is about and writes down every opening. Nobody is handed a key or a plain copy of a recording.
The page of the run lists its steps in order, each one waiting for the step before it. The first step turns the speech into text. The next finds the words that identify somebody. The third passes what was found to the last, which replaces those words in the text and covers them in the sound. Scoring happens afterwards, against the answer keys that Devi brought in.
The speech models run on a computer with a graphics card, which is why this takes minutes and not seconds. When the steps are done, the run has also been scored. The result still has to be decided by a person, and the page says who cannot decide it.
The decision page shows what the run measured and what each step did. The person who started the run may read all of it, but the two buttons are greyed out for that person, and the page says why.
Hartley is the custodian of the Cardiology department, which owns the recordings. Owning the data does not give the right to decide that its de-identified form may be released. That belongs to a role of its own, and Hartley does not hold it.
The reviewer chooses the standard, and decides
A de-identification reviewer is a person who holds the role that decides whether a result with the names removed may be released. The role gives no right to read the recordings themselves. A de-identification standard is a named set of limits that the organisation's data protection officer wrote for one audience; the reviewer chooses the one for the audience the result is going to.
Imani is the de-identification reviewer. The page shows how much identifying detail the run removed and how much it left in, measured against the answer keys, and counts each kind of identifier separately, so a good overall figure cannot hide one kind that is being missed. Until Imani chooses a standard, the result is judged by the Platform default. Imani is told plainly what releasing does: it moves the result one step up, and it cannot be undone.
The result is going to the annotation team, so Imani chooses the Annotation team standard that Nakamura wrote. The platform works the recommendation out from the counts the run kept, and works it out again when Imani decides, so nothing Imani types can change what the measurement says. The last column of the table now shows what this standard asks of each kind.
Choosing another standard changes nothing until Imani decides. Under Public release the same result is checked against stricter limits, and the table shows them. This result clears both, because the run removed everything the answer keys mark.
Imani goes back to the Annotation team standard, because that is the audience this result is going to, and writes the reason. A decision needs a reason before the buttons work, because whoever reads the decision later will not have the result in front of them. Imani can release the result or hold it back, and the standard chosen is the one kept with the decision.
Once the result is decided, the page no longer offers a choice. It says which standard the result was judged by, which version of it, and what that standard asked at the time. If the data protection officer changes the standard later, this decision still says what it said.
The decision is recorded with who made it, when, and the reason. It also records what it rested on. The result is now open for annotation, and no data moved: the same files stay where they are and what may read them changed.
Sam, a researcher, looks for the result in the list of datasets. It is listed, and its widest access level is now open for annotation. Sam's role reaches only the Published level, so Sam still cannot read it. A release is one step at a time, and each step has its own decision.
