XyDromatics™ Research — de-identified by design.

It's deliberately not. "Research Use Only" is a regulatory category defined in 21 CFR 809.10(c)(2)(i): a product labeled for research use, not for clinical diagnosis or treatment decisions. RUO products sit outside the FDA medical-device classification system because their intended use is investigational. Crossing into clinical use would require a different regulatory pathway.

No. The RUO labeling is enforced in two places. First, the web UI, API responses, and exported manifests carry the RUO label. Second -- and more importantly -- the binary itself physically cannot run clinical-decision code paths. There's no HL7 ORU emission, no DiagnosticReport integration, no clinical-tag-edit, no critical-results notification. The license-feature enforcement keeps the RUO boundary at code level, not just at label level.

DICOM PS3.15 Annex E (Basic Confidentiality Profile), applied uniformly at ingest as a single fixed profile — there is no per-protocol or per-cohort variation of the tag set, and no date-shift jittering. Patient identity is replaced with a RESEARCH placeholder and a randomly generated identifier, so de-identification here is one-way by design. Pixel-data redaction handles burned-in PHI in overlays, scanout and secondary captures.

No — not from Research. De-identification at ingest is deliberately one-way: the PS3.15 Annex E Basic Profile mints fresh Study/Series/SOP UIDs and a new random patient identifier on every object, and the anonymizer discards its UID map after each call so the Research host cannot reconstruct the original PHI from any operator-accessible state. There is no broker role, no mapping store and no re-identification endpoint. If a protocol requires re-identification or patient recontact, the mapping must be retained by the source-side clinical system or an external honest broker before studies are forwarded into Research. The same applies to studies ingested already de-identified from external sources. anonymization gate, with no external assistance required. The anonymization gate uses keyed-hash pseudonymization: the system's encryption key is the keying material for the hash that produces each anon-ID. Same patient always maps to the same anon-ID (preserves longitudinal linkage); the key remains under the system's key-management custody. The honest-broker capability is built into the system — a designated broker role (with explicit permission, audit-trailed, IRB-protocol-gated) consults the mapping to support patient recontact, longitudinal-linkage confirmation without exposing PHI to researchers, or — under narrow protocol authorization — returning identified data for specific IRB-approved purposes. No external honest-broker entity needed. Important constraint: studies ingested already-de-identified from external sources (consortium partners, etc.) cannot be re-identified — we never had the mapping or the source PHI in the first place.

IRB protocols are governed in SynthQMS as controlled documents. The protocol lives there as paperwork — Research holds no protocol object, so a protocol does not carry its own anonymization profile, access list or retention rule inside the archive. What Research contributes is the evidence: the audit-export tool produces IRB-renewal-ready documentation of who queried what, when, and what was exported. An IRB-observer read-only role lets a reviewer audit the deployment directly.

Yes -- this is a common pattern. A production clinical archive handles the clinical workflow; Research holds the de-identified research corpus. Studies flow from the clinical archive through the anonymization gate into Research. The two run as separate executables on separate ports, with separate identity domains -- a researcher account on Research has no access to the clinical side, and vice versa.

Three layers. First: every anonymization run produces a verification report (which tags were removed, which were remapped, and which were retained). Second: free-text-field PHI scanning catches residual PHI in study descriptions, comments, and other free-text tags. Third: k-anonymity floor on the query surface — result sets below 11 distinct subjects are suppressed outright. The floor is a fixed archive-wide value, not a per-protocol threshold.

Define the validation cohort under an IRB-approved protocol. Pull qualifying studies through anonymization into Research, freeze the cohort as a snapshot, and export it as de-identified DICOM Part 10. Hand the vendor the EXPORT — do not give them an account on the archive. Cohort permissions are archive-wide, so any account that can read one cohort can read them all; the export boundary is what confines a vendor to the agreed data. The audit trail records every export, and retention follows the protocol's clause.