How to read this page
- Every step is one screen, or one moment, in a real run. The label under the title names where it happens, and the step reads in the same order each time: what is happening, the evidence, and then what to look for in it.
- Screenshots are real pictures of the Munitas console, the web app that people open in a browser. Click any picture to enlarge it.
- Every name of a person, patient or card holder in the example data is invented, and every screenshot is unedited apart from being cropped to the part that matters.
Words used on this page
- Organisation
- A company or hospital group that uses Munitas. Each organisation sees only its own data.
- Department
- A team inside an organisation that owns some of its data, such as Cardiology.
- Dataset
- A named collection of records, such as a table of patient admissions.
- Custodian
- A person who holds the data custodian role, which allows deciding who may read data. A custodian decides for the departments they are an approver for.
- Department approver
- A custodian who is listed for one department and may approve access to its data and confirm claims about it. A department can have several, and any one of them can act on their own.
- Locked column
- A column whose values are scrambled under a key made for each person. Reading them back needs permission. Destroying a person’s key later makes their values unreadable for good, while the sealed table itself never changes.
- Locked recording
- A recording stored scrambled under a key made for the one patient it is about. Reading it back needs the platform to open it, and destroying the patient’s key later makes it unreadable for good.
- Version
- One sealed state of a dataset. Changing the contents means making a new version, never editing an old one.
- Lease
- Permission, given by the custodian, to read one dataset for one stated purpose and for a limited time.
Devi asks to open some of the recordings
The recordings that Devi, a data engineer, brought in are locked, each under the key of the patient it is about, so the version cannot be handed over whole. A person who answers for none of the data can ask to open a few of the files, for a stated purpose and a short time. Munitas chooses which files, and an approver of the department that owns them decides.
The version page has a form for asking to open files. Devi chooses where to open them, here in the page, where a file plays and cannot be downloaded. Devi says what the files are for, how many are needed and for how long. Munitas states its own limits, at most 10 files and at most 1 hour here. The person asking cannot pick which files, and the same files stay the same until the approval ends.
Hartley decides, and allows fewer
The approver may allow fewer files or fewer hours than were asked for, never more, and says why when declining.
Hartley is the custodian of Cardiology, which owns the recordings. The page of locked data requests has a section for files, with the requests that wait for Hartley's decision. Each shows who asked, what for, where they will open the files, how many files and for how long.
Hartley lowers the number of files from three to two and writes a note, which is stored with the decision. Munitas, not Hartley, chooses which two files: the approver is never asked which, so nobody can steer a person to a particular patient.
The request has moved from waiting to allowed. The row shows what Hartley allowed, until when, and the note Hartley wrote. Hartley can end the permission early at any time.
Devi listens, and the access ends
A permission to open files is for a stated purpose and a short time. It opens a few files, not the version.
Back on the version page, the list of files now offers a Play button on two of the three recordings, the two Munitas chose. A recording plays in the page through Munitas, which unlocks it with the key of the patient it is about, and it cannot be downloaded. Every opening is written down.
Hartley ends the permission, and Devi's page goes back to how it was: the files are listed and locked, and none can be played. To listen again, Devi would have to ask again.
