How to read this page
- Every step is one screen, or one moment, in a real run. The label under the title names where it happens, and the step reads in the same order each time: what is happening, the evidence, and then what to look for in it.
- Screenshots are real pictures of the Munitas console, the web app that people open in a browser. Click any picture to enlarge it.
- Every name of a person, patient or card holder in the example data is invented, and every screenshot is unedited apart from being cropped to the part that matters.
Words used on this page
- Organisation
- A company or hospital group that uses Munitas. Each organisation sees only its own data.
- Data protection officer
- A person who watches how an organisation handles personal data. The role decides nothing about who may read it.
- De-identification reviewer
- A role that allows a person to review data from which identifying details have been removed, and to decide whether it may be released.
- De-identification standard
- A set of limits an organisation chooses for how much identifying detail a result may still hold, kept under a name for the audience the result is released to. A change adds a new version and the earlier ones stay.
- Version
- One sealed state of a dataset. Changing the contents means making a new version, never editing an old one.
- Release
- A decision to let a dataset version be read more widely than before. A release changes who may read it and moves no data.
- Pipeline
- A series of steps that Munitas runs on a dataset version, each step after the ones it depends on. The last step is a gate decision.
- Answer key
- A file that holds the correct written text of one recording, used to check how well names were removed from it. It is named after its recording and belongs to the same patient.
The data protection officer writes down the standards
A de-identified result is released to a particular audience, and how much identifying detail it may still hold depends on who that audience is. A de-identification standard is a named set of limits an organisation writes for one audience. An identifier is a detail that points to a person, such as a name or a phone number.
Nakamura is the data protection officer of the Health organisation, a person who watches how the organisation handles personal data. Before any standard is listed, the page explains one. A pipeline run, which is one pass of the pipeline over the data, is measured against an answer key, a list prepared beforehand of the identifying details that really are in the data. The measurement gives two figures: how much identifying detail was removed, and how much was left in the clear. The page then works through an example in which one result is judged by two different standards.
Until the organisation writes a standard, every result is judged by the one the platform starts with, called Platform default: at least 98 percent of identifying detail removed over all kinds together, and none of the five kinds that name a person directly left in the clear. The page says plainly that this is a starting point and that an organisation is expected to set standards of its own.
A standard has a name, one figure for all kinds of identifier together, and, for each kind, the least that must be removed and the most that may be left in the clear. The form starts from Platform default, so a new standard never quietly drops a limit the platform starts with. The result Imani will decide is going to the annotation team, the people who label data inside the organisation. Nakamura names the standard for them, lowers the overall figure to 95 percent, and asks for at least 90 percent of addresses and places to be removed. Names, phone numbers and the other kinds that name a person directly keep their limit of none.
A standard is never edited. A change adds a version, and the earlier versions stay, so that a decision made later can say exactly which version of which standard it was judged by. The saved standard shows its limits in a table, with No minimum or No maximum where Nakamura set none.
The Public release standard asks for 99 percent overall and for at least 99 percent of dates of birth and of addresses and places. An organisation keeps as many standards as it has audiences, and the person who releases a result chooses between them.
The reviewer reads the standards and cannot change them
A de-identification reviewer is a person who holds the role that decides whether a result with the names removed may be released.
Everybody signed in can read the organisation's standards, so that a reviewer can choose one and anybody can see what a result was held to. Only the data protection officer sets them, so that the person who decides a release cannot loosen the standard it is judged by.
