diff --git a/README.md b/README.md index 4ecc3d1..346683d 100644 --- a/README.md +++ b/README.md @@ -8,14 +8,13 @@ # @cosyte/deid > Healthcare **de-identification** for Node.js and TypeScript: a HIPAA-grounded policy engine that -> **fails closed** and emits a **value-free manifest**. +> emits a **value-free manifest**. `@cosyte/deid` applies a de-identification **policy** (HIPAA Safe Harbor by default) to a structurally-located model of a healthcare document and returns a transformed model plus a value-free audit of everything it acted on. It is a **consumer** of the `@cosyte/*` parsers, not a parser sibling: it borrows the archetype's disciplines (typed diagnostics, immutable output, a policy/profile system) -but **inverts the reflex**: where a parser is liberal on input, a de-identifier is conservative and -**fails closed**. Third-party runtime dependencies: **zero** (every primitive is `node:crypto`). +but **inverts the reflex**: where a parser is liberal on input, a de-identifier is conservative. Third-party runtime dependencies: **zero** (every primitive is `node:crypto`). > **The honesty line.** Results are **"Safe-Harbor-transformed per the configured policy"**, never > "de-identified" and never "HIPAA-compliant". Safe Harbor is implemented mechanically; the @@ -660,8 +659,8 @@ determination**. - **Five transforms**: redact, generalize (date→year, ZIP→3-digit/`000`, age→`90+`), keyed date-shift, keyed-HMAC pseudonymize, keyed hash. - **18 Safe Harbor categories**: §164.514(b)(2)(i)(A) to (R), including the open-ended catch-all (R). -- **Fail-closed rule**: anything uncertain is blocked, never passed through; clinical values are - retained untouched. +- **Fail-closed rule**: an unrecognized structure, an un-locatable identifier or free text is + blocked, never passed through; clinical values are retained untouched. - **Value-free manifest**: category + transform + locus + count + disposition + code + a boolean `reidentificationCode` (`true` only where a keyed surrogate was emitted) + a `partyRole` code (only where a party was left in place because its role sits outside the scope clause), never a value, never diff --git a/docs-content/concepts-archetype.md b/docs-content/concepts-archetype.md index 58dd889..b49d5fe 100644 --- a/docs-content/concepts-archetype.md +++ b/docs-content/concepts-archetype.md @@ -11,7 +11,7 @@ sidebar_position: 1 ## Fail closed (the inverted reflex) -A parser is liberal in what it accepts. A de-identifier is the opposite: on **any** ambiguity (an +A parser is liberal in what it accepts. A de-identifier is the opposite: on each of these ambiguities (an unrecognized structure, an un-locatable identifier, a field it cannot classify, a free-text blob, a date/ZIP it cannot generalize), it **blocks** the value (withholds it), and records the decision. It never passes a value through as "probably safe". Liberality here leaks patients. diff --git a/docs-content/intro.md b/docs-content/intro.md index 4aa698d..8893417 100644 --- a/docs-content/intro.md +++ b/docs-content/intro.md @@ -12,9 +12,8 @@ reading 45 CFR §164.514 or hand-writing a scrubber. `@cosyte/deid` is a consumer-tier library, **not a parser**. It borrows the cosyte parser archetype's disciplines (typed diagnostics, immutable output, a policy/profile system) but **inverts the parser's -reflex**: where a parser is liberal on input (Postel's Law), a de-identifier is conservative; it -**fails closed**. An unrecognized structure or an un-locatable identifier is **blocked**, never passed -through as safe. +reflex**: where a parser is liberal on input (Postel's Law), a de-identifier is conservative: an +unrecognized structure or an un-locatable identifier is **blocked**, never passed through as safe. > **The honesty line that governs the whole library.** Results are **"Safe-Harbor-transformed per the > configured policy"**, never "de-identified" and never "HIPAA-compliant". Safe Harbor is implemented diff --git a/docs-content/limitations.md b/docs-content/limitations.md index ec27684..3b58b6f 100644 --- a/docs-content/limitations.md +++ b/docs-content/limitations.md @@ -5,8 +5,9 @@ Harbor by default) and emits a value-free manifest of what it acted on. It never "de-identified," and it never certifies HIPAA de-identification.** Safe Harbor is implemented mechanically; **Expert Determination is _supported_, never _rendered_.** The structured-field core is the guarantee; **free text is blocked by default**; **DICOM is metadata-only** (burned-in pixels are -flagged, not cleaned). The library **fails closed**: on any ambiguity it blocks or removes, never -passes a value through as "probably safe." +flagged, not cleaned). On an unrecognized structure, an un-locatable identifier, an unknown segment +or extension, or a free-text blob, the library blocks or removes, never passing a value through as +"probably safe." Read this page before you rely on the library for anything that leaves your control. @@ -345,9 +346,9 @@ report.determination; // => null report.disclaimer.includes("NOT a determination"); // => true ``` -The library's promise is narrow and honest: **structured-field, fail-closed, policy-driven -Safe-Harbor transformation with a value-free manifest, never a leaked patient, never a destroyed -clinical value, and never a claim of "de-identified."** +The library's promise is narrow and honest: **structured-field, policy-driven Safe-Harbor +transformation with a value-free manifest, never a leaked patient, and never a claim of +"de-identified."** ## NCPDP Telecom: one transaction per message diff --git a/docs-content/quickstart.md b/docs-content/quickstart.md index fe861b3..a6145d3 100644 --- a/docs-content/quickstart.md +++ b/docs-content/quickstart.md @@ -7,8 +7,8 @@ sidebar_position: 1 # Quickstart De-identify a structurally-located model under a policy and read the value-free manifest. -`@cosyte/deid` **fails closed**: anything it cannot confidently handle is **blocked**, never passed -through as safe. The result is **"Safe-Harbor-transformed per the configured policy"**, never +In `@cosyte/deid`, an unrecognized structure or an un-locatable identifier is **blocked**, never +passed through as safe. The result is **"Safe-Harbor-transformed per the configured policy"**, never "de-identified". ## De-identify a model diff --git a/examples/fail-closed.ts b/examples/fail-closed.ts index 94510d4..044d56d 100644 --- a/examples/fail-closed.ts +++ b/examples/fail-closed.ts @@ -1,8 +1,8 @@ /** * Fail closed: what `@cosyte/deid` does when it cannot be sure, shown case by case. * - * A parser is liberal about what it accepts. A de-identifier is the opposite: anything it cannot - * confidently handle is blocked or refused, never passed through as safe. + * A parser is liberal about what it accepts. A de-identifier is the opposite: each case below is + * blocked or refused, never passed through as safe. * * - Free text is blocked by default. The library ships no NLP model and no regex scrub. * - A redactor you bring is used, and its output is recorded as consumer-asserted: the engine does