Medicine already generates the evidence. It is locked inside individual organizations, attached to individual people, and therefore unshareable. The product separates the two: identity stays inside the node, knowledge joins the commons.
Identified data left of the dashed line, anonymous knowledge right of it
Every case document passes through all six inside its own node. 18 in this build.
Read locally
Document read from the node's own storage. It has not left the node and it will not.
Parsed by format
Format-specific parser produced structured text and section boundaries.
De-identified
All eighteen HIPAA Safe Harbor identifiers located and removed. Dates reduced to year, ages banded, geography generalized. Treating practitioners are retained: a provider is not a patient identifier.
Abstracted to insight
The clinical content is abstracted into a candidate CareInsight: cohort, presentation, intervention, outcome. The original document is not part of the output.
Re-identification risk checked
The cohort is checked against the network. A cohort matching fewer than k=5 published cases is generalized further before it can be published.
Published to network
Only the anonymous insight crosses the node boundary. It enters the review queue, where credentialed peers endorse, challenge or refine it.
HIPAA Safe Harbor: remove the eighteen identifier classes, reduce dates to year, band ages over 89
Detected and destroyed
Deliberately retained
The engine in src/lib/deidentify.ts genuinely runs. Open any document on the ingestion screen and the highlighted identifiers are the ones the scanner actually found, at the offsets it found them.
Removing names is the easy half. A sufficiently specific cohort - a 34-year-old man in a small region with three uncommon diagnoses - identifies someone even with every obvious identifier stripped out.
So before an insight publishes, its cohort is compared against the cohorts already on the network. If fewer than five published cases share it, the insight is held and the cohort is generalized: a wider age band, one fewer comorbidity. If it cannot be generalized enough to hide in, it does not publish.
This is why the knowledgebase is smaller than the case volume behind it. Across the 8 nodes in this build, roughly one percent of processed cases yielded a publishable insight. A system that published everything would be a patient database wearing a different name.
What each parser does, and the failure mode that matters for each
C-CDA R2.1 XML. templateId roots identify the document type and each section, and entries are already coded.
Failure mode: Sections are often present but empty. An empty allergy section is not an assertion that the patient has no allergies. INS-004 in this knowledgebase exists because of exactly that.
Native text layer where one exists, OCR where it does not. Mean per-page confidence is recorded alongside every extracted value.
Failure mode: Numerals degrade worse than prose. A misread value is more dangerous than a missing one, because it is acted upon. See INS-015.
HL7 v2.x ORU messages in an XML envelope, plus vendor-proprietary exports mapped through a per-vendor crosswalk.
Failure mode: Local codes are not interoperable. An unmapped local code must be quarantined rather than silently dropped, or the record becomes quietly wrong.
Unstructured dictation. Section headers detected by pattern, then a rules and lexicon pass over the clinical content.
Failure mode: The highest-value and lowest-fidelity source, and the hardest to de-identify: identifiers appear mid-sentence rather than in labelled fields.
And where each lives in this codebase
Knowledge base
The published insights. Each one states its cohort, its intervention, what was observed, how many cases it rests on, and what it cannot tell you.
Inference engine
Cohort similarity scoring weighted by evidence tier and peer consensus, plus a rule layer for interactions, duplication and dosing. It runs over the published set only.
Communication mechanism
The consult screen for clinicians and the plain-language resource for patients. Same knowledge, two registers.
How each is interpreted here
The right information
Only what the cohort actually supports, with its limitations attached rather than buried.
To the right person
Clinicians see evidence tiers, consensus scores and the argument between reviewers. Patients see plain language and the questions it raises.
In the right format
A signal that cannot cite an insight is not shown. Every warning carries what it stands on.
Through the right channel
In this MVP, a consult screen. In production, a CDS Hooks service firing inside the EHR at order entry.
At the right time
When the clinician is deciding, not in a retrospective report nobody opens.
Alert fatigue is the central failure mode of clinical decision support
A signal with no citation is not shown.
A clinician who sees forty warnings dismisses all forty, including the one that mattered. So the engine will not emit a safety signal it cannot trace to published insights, and when the knowledgebase holds nothing about a combination it says so explicitly rather than inventing a caution.
The same restraint applies to care gaps. INS-022 exists precisely because flagging a gap that is not real is the fastest way to teach clinicians to ignore the gaps that are.
Contributed
A credentialed clinician abstracts an insight from de-identified cases at their node.
Published as draft
It enters the network with its cohort, its evidence and its stated limitations.
Reviewed
Other verified clinicians endorse, refine or challenge. Reviews are weighted by credential tier and standing.
Scored
Consensus is computed and shown. Nothing is hidden behind a single number.
Promoted or contested
It reaches peer-reviewed standing, or stays visible and marked contested. INS-010 is contested right now, by two reviewers who disagree with a third.
24 insights and 45 peer reviews in this build. Contested insights stay published and stay marked, because a knowledgebase that quietly deletes disagreement is one nobody should trust.