The originating custodian
- Identifiable records and contact details
- Raw notes, images and metadata
- Linkage keys and reversible identifiers
These stay local. Participation consent does not make them shareable between clinics.
TRUST & GOVERNANCE / REQUIRED SAFEGUARDS
Protect the person.
At every boundary.
Privacy must be demonstrated in the data, the permissions and the result. Our medical research model requires anonymized-only sharing, local custody of identifiable records and explicit review before release.
See the anonymization requirementsIS SHARED RESEARCH DATA ANONYMIZED?Yes.
Anonymized data only is the required model for research sharing in Hybrid Discovery. Identifiable patient records stay with the originating custodian; they are excluded from cross-clinic sharing and third-party AI requests. Medical sharing and anonymization services are planned and must pass validation before launch. No patient data is collected or shared by this website.
FOLLOW THE INFORMATION
Keep identity at source.
Review every crossing.
The required medical data flow has a local protected zone, a release gate and an anonymized collaboration zone. This diagram describes the planned architecture.
Prepare. Validate. Approve.
- Minimize and prepare the exact research view
- Assess identification and disclosure risk
- Bind reviewer approval to purpose and recipient
A failed, stale or missing assessment blocks the release.
Only approved research material
- The assessed anonymized derivative
- Only the permitted research task
- Reviewed outputs with stated limitations
No patient identity or linkage key goes to another clinic or third-party AI.
REVIEW THE RESULT, TOO
Outputs can reveal information through small groups, repeated queries or model behavior. Their privacy and scientific review is a separate gate; anonymized inputs alone are insufficient.
Understand the intended AI controlsANONYMIZATION IS A RELEASE REQUIREMENT
Prepare at source.
Validate before sharing.
Removing names, encrypting data or replacing identifiers with codes does not, by itself, establish anonymity. The assessment must cover the actual artifact and its intended context.
Identify the full disclosure surface
Structured fields, free text, images, metadata, dates, locations and rare combinations all need review. Identifiers can appear inside the clinical content, not just in the patient-name field.
Apply the appropriate de-identification method
For information governed by HIPAA, the applicable de-identification route is Safe Harbor or Expert Determination. The responsible organisation must establish and document the method and its conditions; this website makes no compliance determination.
Separate identity from research material
Keep linkage keys, contact details and identifiable originals with the originating custodian. Pseudonymized material remains within the protected local boundary and is excluded from the shared research layer.
Block release when evidence is missing
Bind the approval to the exact reviewed artifact, recipients, purpose, location and expiry. Missing, stale or failed assessment evidence must stop a release rather than downgrade it to a warning.
Method reference: HHS guidance on HIPAA de-identification . De-identification reduces identification risk; it is not a promise of zero risk in every future context.
PROVE LESS. REVEAL LESS.
A precise claim.
A smaller disclosure.
Zero-knowledge proofs and selective disclosure belong in the architecture where they answer a specific question with less exposure.
Illustrative proof pattern · Planned
“Meets the approved eligibility condition.”
- Possible disclosed result
- A verified predicate and the policy it relates to.
- Underlying attributes
- Remain with their holder under the proof design.
- Required assurance
- Validated issuer, circuit or protocol, statement binding, freshness and revocation handling.
A proof does not anonymize a dataset, confer consent, establish professional competence or certify HIPAA compliance. Its guarantees are limited to its defined statement and assumptions.
CHOICE AND AUTHORITY
Consent stays specific.
Responsibility stays visible.
Participation, disclosure and research uses need clear explanations. No account connection grants blanket access.
Separate the decisions
Record the study purpose and versioned choices. Distinguish study participation, dataset access, case discussion, model inference and model training. Identifiable records remain excluded from cross-clinic sharing even when participation is agreed.
Explain expiry and withdrawal
Stop future authorised use when required. Explain retained records, released results and model effects honestly; universal retroactive erasure is not promised.
Name the accountable organisation
Establish the custodian, research owner, reviewers and any processors. Review agreements, permitted locations, retention and incident responsibilities before real-data use.
PRIVACY AFTER COMPUTATION
Review the result.
Evaluate the model.
Anonymized inputs do not remove the need to evaluate outputs. Small groups, repeated queries and model behaviour can create additional disclosure risks.
Individual risk
Assess patient-level privacy exposure where applicable, including underrepresented groups. Aggregate scores can hide the people most at risk.
Appropriate mitigations
Use threat-model-specific controls such as output suppression, restricted access and differential privacy with justified patient-level accounting where applicable.
Explicit release
Require a named scientific and privacy review. Federation, encryption or a proof receipt cannot replace that decision.
THIS WEBSITE TODAY
A public explanation.
No medical-data collection.
No patient-data workflow
Hybrid-ID sign-in opens an empty workspace. There is no upload, patient record, case submission, enrollment, consent capture or AI execution endpoint here. The interactive diagrams use fixed illustrative content.
Local presentation preferences
The theme preference is stored in your browser. Sign-in uses secure account and short-lived transaction cookies; private session state is encrypted on Core. The site code includes no analytics or external AI request. Hosting and gateway access logs are separate from medical research records.
Enquiries stay non-sensitive
Contact links open the existing Hybrid contact page. Share a project outline only; do not include patient records, identifiers, credentials or confidential datasets.
CLEAR ANSWERS
Understand the
boundaries.
Is shared research data anonymized?
Yes. Anonymized data only is the required model for research sharing in Hybrid Discovery. Identifiable patient records stay with the originating custodian; they are excluded from cross-clinic sharing and third-party AI requests. Medical sharing and anonymization services are planned and must pass validation before launch. No patient data is collected or shared by this website.
Is Hybrid Discovery HIPAA compliant today?
No compliance claim is made for the planned medical platform. Readiness requires the actual deployment, responsible organisations, applicable agreements, risk assessment, operating controls and validated data-handling procedures. Anonymization or a proof alone does not establish compliance.
Do medical records or patient fingerprints go on-chain?
Identifiable records, medical content and patient linkage keys are excluded from the public blockchain. Even a hash, timestamp or provenance receipt can disclose information and requires assessment; no patient-derived on-chain receipt is assumed safe.
ADVANCE DISCOVERY TOGETHER
Trust needs evidence.
Build it into the pilot.
Use the first pilot to test decisions, denials and the privacy boundary.