How to read this page
- Every step is one screen, or one moment, in a real run. The label under the title names where it happens, and the step reads in the same order each time: what is happening, the evidence, and then what to look for in it.
- Screenshots are real pictures of the Munitas console, the web app that people open in a browser. Click any picture to enlarge it.
- Every name of a person, patient or card holder in the example data is invented, and every screenshot is unedited apart from being cropped to the part that matters.
Words used on this page
- Organisation
- A company or hospital group that uses Munitas. Each organisation sees only its own data.
- Department
- A team inside an organisation that owns some of its data, such as Cardiology.
- Dataset
- A named collection of records, such as a table of patient admissions.
- Locked column
- A column whose values are scrambled under a key made for each person. Reading them back needs permission. Destroying a person’s key later makes their values unreadable for good, while the sealed table itself never changes.
- Locked recording
- A recording stored scrambled under a key made for the one patient it is about. Reading it back needs the platform to open it, and destroying the patient’s key later makes it unreadable for good.
- Manifest of recordings
- A small table, saved as a CSV file, with two columns: the recording and the patient it is about. It is how the platform knows whose key to lock each recording under.
- Answer key
- A file that holds the correct written text of one recording, used to check how well names were removed from it. It is named after its recording and belongs to the same patient.
- Privacy contract
- A file that says, column by column, how identifying each column of a table is and what is done to it when the table is sealed, and how to find the person each row is about.
- Person code
- A label that stands for one person and means nothing on its own. It replaces the number that identified them.
- Sealed
- Finished and closed for good, so that it can never be edited.
- Version
- One sealed state of a dataset. Changing the contents means making a new version, never editing an old one.
- Sensitivity label
- How identifying a column is. none does not identify anybody, quasi is a detail that could help identify a person when combined with others, and phi is protected health information.
- Manifest
- The list of every file in a package, each with its size and a fingerprint of its contents. The platform signs it, so that changing a file or the list can be noticed.
- Small group
- A combination of readable columns, such as postcode and age band, shared by only a few people, so that one of them could be singled out even though no column names anybody.
Three recordings arrive locked
The research programme now needs data about people: recordings of consultations, and a table of clinic appointments about the same patients. Everything in it that identifies a person must be erasable later, so that one patient can be removed without losing anybody else's data. Devi, a data engineer in the Cardiology department, brings it in. Every name and number in this story is invented, and the recordings were made with a computer voice.
A dataset is a named collection of data that Munitas keeps, and it has an owning department from the first moment, so that somebody is answerable for deciding who may read it. Devi names this one consultation-recordings and chooses the Cardiology department. Nothing has been uploaded yet.
The page asks a question that cannot be asked later. To erase one person from locked data, Munitas destroys the key that the person's data was locked under. What was locked for that person can then never be read again, and the rest of the data stays. The key has to be made as the data arrives, which is why the question comes first. The safe default is no.
Devi answers yes, and chooses to bring in files, each of which is about one person. A manifest says which person each file is about. A manifest is a plain text table with two columns, file and person. The recordings also come with an answer key each, which is the correct written text of a recording, used later to check how well names were removed from it.
Devi first tries a manifest and a set of files that contain mistakes. Munitas checks the whole set and lists every problem at once, so that nothing half correct is uploaded and locked, and so that Devi does not have to find the mistakes one at a time.
Devi corrects the manifest and chooses the three recordings with the answer key for each. The manifest names each patient by patient number, and Devi has told Munitas that this is the kind of identifier it holds. The same kind of number will name the same patients in the table of appointments later, which is how Munitas will know that they are one person.
Devi presses Upload and lock. Each file is locked as it arrives, under a key that Munitas makes for the patient the file is about. Devi is never given the keys and cannot see them.
Devi seals the upload. A sealed version is one state of a dataset that is finished and closed for good: nothing can be added to it, and files that arrive later become a new version. The message counts the files and the people, and names nobody.
The page of the new version lists its files. A locked file is opened only through Munitas, which unlocks it with the key of the person it is about and writes down every opening. Devi is not an approver of the Cardiology department, so Devi has to ask. Asking is shown in the walkthroughs Read five locked rows, with an approver's say, and Open two of the recordings, with an approver's say.
The same patients arrive in a table
Three of the patients in the recordings also appear in a table of clinic appointments, with other patients. Devi brings the table in the same way, with a table instead of files.
Devi registered a second dataset, clinic-appointments, owned by Cardiology, answered yes to the erasure question, and chose a table. A table needs two files. The first is a contract, which says, column by column, how identifying each column is and what is done to it, and which column names the person each row is about. The second holds the rows. Devi first sends rows that contain two mistakes.
With the mistakes fixed, the table is sealed. Munitas also reports on small groups. A column left readable, such as an age band or a postcode, can point at one person when few people share the same combination. The report does not stop the seal. It gives the approver of the department something to decide about later.
The page of the new version lists each column of the table, what it is, and what was done to it. A column that names a person is replaced by a person code, which is a label that stands for one person and means nothing on its own. Columns that describe a person are locked under that person's key. Columns that are not identifying stay readable, so that analysis keeps working.
