How to read this page
- Every step is one screen, or one moment, in a real run. The label under the title names where it happens, and the step reads in the same order each time: what is happening, the evidence, and then what to look for in it.
- Screenshots are real pictures of the Munitas console, the web app that people open in a browser. Click any picture to enlarge it.
- Every name of a person, patient or card holder in the example data is invented, and every screenshot is unedited apart from being cropped to the part that matters.
Words used on this page
- Organisation
- A company or hospital group that uses Munitas. Each organisation sees only its own data.
- Department
- A team inside an organisation that owns some of its data, such as Cardiology.
- Dataset
- A named collection of records, such as a table of patient admissions.
- Custodian
- A person who holds the data custodian role, which allows deciding who may read data. A custodian decides for the departments they are an approver for.
- Department approver
- A custodian who is listed for one department and may approve access to its data and confirm claims about it. A department can have several, and any one of them can act on their own.
- Sealed
- Finished and closed for good, so that it can never be edited.
- Privacy contract
- A file that says, column by column, how identifying each column of a table is and what is done to it when the table is sealed, and how to find the person each row is about.
- Locked column
- A column whose values are scrambled under a key made for each person. Reading them back needs permission. Destroying a person’s key later makes their values unreadable for good, while the sealed table itself never changes.
- Person code
- A label that stands for one person and means nothing on its own. It replaces the number that identified them.
- Locked-column lease
- Permission, decided by an approver of the owning department, to read a few rows of a table’s locked columns for a few days, for a stated purpose. It opens only those rows, never the whole table.
- Small group
- A combination of readable columns, such as postcode and age band, shared by only a few people, so that one of them could be singled out even though no column names anybody.
- Privacy auditor
- A person who checks how locked data was used. The role reads records of use and no personal data.
- Data protection officer
- A person who watches how an organisation handles personal data. The role decides nothing about who may read it.
- Version
- One sealed state of a dataset. Changing the contents means making a new version, never editing an old one.
- Role
- A named set of permissions that a person can hold, such as the permission to decide who may read a department’s data.
- Lease
- Permission, given by the custodian, to read one dataset for one stated purpose and for a limited time.
- De-identification reviewer
- A role that allows a person to review data from which identifying details have been removed, and to decide whether it may be released.
Devi cannot read what is locked, so Devi asks
A department approver is a data custodian who is listed for one department and may decide who reads its data. A locked-column lease is permission, decided by an approver of the owning department, to read a few rows of a table’s locked columns for a few days, for a stated purpose. Holding a role does not open locked rows. Only an approver of the department that owns the data, or a person who holds a lease, may read them.
Devi brought the table in, but is not an approver of the Cardiology department, so the platform refuses and says why in its own words.
The form asks for a purpose, a number of days and a number of rows. The platform states the limits itself, at most 7 days and at most 20 rows, and the purpose is recorded with the request. The rows are chosen by the platform, not by the person asking, and they are the same every time, so asking repeatedly cannot be used to read the whole table.
Asking opens nothing. Devi still cannot read any locked value until an approver of the Cardiology department decides.
Sam holds the researcher role, which is for working with data that has already been de-identified, meaning the names, dates and other identifying detail have been taken out. Sam opens the same table and sees how it is built, but no value, and is not offered a form, because the locked values are not needed to work with the readable columns.
Hartley, who answers for Cardiology, decides
The person who asks never decides. Only an approver of the department that owns the data can, and an approver of another department cannot.
Hartley is a data custodian and an approver of the Cardiology department, so the request about Cardiology data appears on this page. It shows who asked, why, how many rows and days, and offers Approve and Decline. A custodian of another department would see nothing here.
The note is stored with the decision. A refusal needs a note, so that the person who asked is told why. Approving needs none, but a note makes the record easier to read later.
The lease now lasts three days from the approval and opens five rows. Hartley can end it early at any time, and so can Devi.
A small group is a combination of readable columns, such as postcode and age band, shared by only a few people, so that one of them could be singled out even though no column names anybody. The platform counts different people, not rows, because a person with several visits is still one person to find. The report is advice. It never stopped the table being sealed and shows no values. The approvers, the de-identification reviewer, the privacy auditor and the data protection officer can read it. The data protection officer is the person who watches how an organisation handles personal data. Only an approver can decide what to do about it.
Hartley chooses to change the contract before the next table is sealed, and writes why. The decision is made once, and the platform refuses to change it afterwards, even to somebody who writes to the database directly.
Devi reads the five rows the lease opens
A lease opens a fixed few rows for a short time. It does not open the table.
The same section that showed a form now says what Devi holds: five of the 23 rows, until the lease ends, approved by Hartley for the stated reason. Devi can read the rows or end the lease personally.
These are the only five rows Devi can read, and they are the same five every time. The locked values are opened for them: the actual names and reasons for visits. Every key that is opened for this is recorded, naming the person it belongs to by their person code. The other 18 rows stay locked.
