XyDromatics VNA Research — de-identified by design.

It's deliberately not. "Research Use Only" is a regulatory category defined in 21 CFR 809.10(c)(2)(i): a product labeled for research use, not for clinical diagnosis or treatment decisions. RUO products sit outside the FDA medical-device classification system because their intended use is investigational. Crossing into clinical use would require a different regulatory pathway -- which is exactly what VNA Clinical is for.

No. The RUO labeling is enforced in two places. First, the web UI, API responses, and exported manifests carry the RUO label. Second -- and more importantly -- the binary itself physically cannot run clinical-decision code paths. There's no HL7 ORU emission, no DiagnosticReport integration, no clinical-tag-edit, no critical-results notification. The license-feature enforcement keeps the RUO boundary at code level, not just at label level.

DICOM PS3.15 Annex E (Basic Confidentiality Profile) as the mandatory baseline, with per-IRB-protocol overrides for tag retention. Pixel-data redaction handles burned-in PHI in overlays, scanout, and secondary captures. Date-shift jittering preserves longitudinal relationships within a patient while breaking calendar identification. The specific profile applied to a cohort is captured in the cohort metadata for IRB and audit purposes.

Yes — for studies that entered VNA Research through its own anonymization gate, with no external assistance required. The anonymization gate uses keyed-hash pseudonymization: the system's encryption key is the keying material for the hash that produces each anon-ID. Same patient always maps to the same anon-ID (preserves longitudinal linkage); the key remains under the system's key-management custody. The honest-broker capability is built into the system — a designated broker role (with explicit permission, audit-trailed, IRB-protocol-gated) consults the mapping to support patient recontact, longitudinal-linkage confirmation without exposing PHI to researchers, or — under narrow protocol authorization — returning identified data for specific IRB-approved purposes. No external honest-broker entity needed. Important constraint: studies ingested already-de-identified from external sources (consortium partners, etc.) cannot be re-identified — we never had the mapping or the source PHI in the first place.

IRB protocols become controlled documents in SynthQMS. Each protocol carries its own anonymization profile, access list, data-use agreement reference, and retention policy. The audit-export tool produces IRB-renewal-ready documentation: who accessed what cohort, when, what was exported, and to whom. Optional IRB-observer read-only role lets an IRB reviewer audit the deployment in real time.

Yes -- this is a common pattern. VNA Clinical handles the production clinical archive; VNA Research holds the de-identified research corpus. Studies flow from Clinical through the anonymization gate into Research. The two run as separate executables on separate ports, with separate identity domains -- a researcher account on Research has no access to Clinical, and vice versa. For combined-posture institutions that want one host running both, see VNA Clinical Research.

Three layers. First: every anonymization run produces a verification report (which tags were removed, which were remapped, which were retained per protocol). Second: free-text-field PHI scanning catches residual PHI in study descriptions, comments, and other free-text tags. Third: k-anonymity / l-diversity reporting per cohort gives a quantified re-identification-risk metric that an IRB can evaluate against protocol-specific thresholds.

Define the validation cohort under an IRB-approved protocol. Pull qualifying studies through anonymization into VNA Research. Grant the AI vendor a researcher account scoped to that cohort only. Vendor receives only de-identified data and cannot reach beyond their assigned cohort. Validation results flow back per data-use agreement; the audit trail records every export. Cohort retention follows the protocol's retention clause.