Trust, shown rather than claimed
The rules below are enforced by automated tests, not by good intentions. Every number on this site comes from our own runs, and where we have not measured something, we say so.
Enforced by tests, not by good intentions
- 01
The checker cannot see how the data was made
Verification and evaluation code are forbidden from importing construction code.
- 02
No combined quality score, anywhere
One number would hide the trade we make on purpose: we change the population so it covers your cases, which makes it look less like any source.
- 03
Every measurement declares what it cannot detect
It is a required field with no default.
- 04
Unknown is never “none”
If a situation depends on a clinical fact nobody can stand behind, we report it as not verifiable, never as passed.
- 05
Every clinical fact names its source
Clinical rules live in versioned files a clinician can correct, and each Passport says whether a fact comes from an official source or a clinician’s review.
- 06
Nothing leaves your machine
No telemetry, and no network calls at runtime except to a system you name for testing.
- 07
Every run is reproducible
From its manifest. The run ID is derived from the inputs, not from a clock.
- 08
Our wording is tested
An automated check fails the build if our output makes any of the legal or safety claims our policy forbids.
The numbers that matter
- 27 patient situations
- Medication safety (23) and data integrity (4).
- 25 of 27 met
- In a 3,000-patient run, in the quantities asked. The other 2 need an indication list we are building, so we do not count them.
- About 7 seconds
- To build, verify and export 3,000 patients as FHIR, on a laptop.
- About 18 seconds
- To build and verify 100,000 patients, without FHIR export, on the same laptop.
- Up to 30,000 patients
- End to end with FHIR export, on a laptop.
- Exact
- The same inputs always rebuild the same dataset, byte for byte.
- 0
- FHIR R4 validation issues in a population built without deliberate defects, at 3,000, 10,000 and 30,000 patients.
- 100%
- Events in valid time order; unique identifiers; events linked to a visit.
- 508 patients
- Built to fill the gaps in a public 109-patient synthetic test suite, giving a complete 617-patient suite with nothing left short.
- 91 drugs
- In 8 drug classes, from the WHO drug classification and checked against it, with monitoring rules quoted from US drug labels.
FHIR checks cover structure, cardinality, value formats, required codes and references against the FHIR R4 specification. It is not a full HL7 validator.
Testing your system
Beta Proven end to end against an open-source FHIR server and a reference system with a known defect: the failure was found, reduced to a single change, saved as a regression case, and reported fixed after the defect was corrected. Not yet run against a customer’s system.
Clinical content
Drug facts come from the WHO drug classification and US drug labels, are checked against those sources, and are labelled in every Data Passport as not reviewed by a clinician. A clinician is reviewing our clinical judgement calls: thresholds, urgency and definitions. Eight clinical situations await that sign-off before they are used in a release.
Your data
- No real patient data enters the system. Every patient is constructed from a specification and stated distributions. The engine does not take in customer patient records, and we do not offer to.
- Nothing leaves the machine. The engine sends no telemetry and makes no network calls while running. The one exception is when you ask it to send test records to a system you name.
- This website stores what you send through the contact form so we can reply. Please do not include real patient information in it.
- Gap-fill reads the test FHIR files you choose to share. It is not for real patient records.
Privacy, measured honestly
| Measurement | Result |
|---|---|
| Records unique on birth year, sex and condition count | About 3%. A floor: adding attributes can only raise it. |
| Exact-match rate, distance to closest record, membership inference | Not measured. Each needs a real source dataset to compare against, and we deliberately use none. |
These are measurements, not a verdict. We do not call the data private or anonymous.
Comparison with other tools
In development We do not publish a comparison with other tools yet. We found the first version of our comparison favoured us in ways that were not fair, so we are rebuilding it with equal conditions. We will publish the method and the result, whichever way it falls.
Limits
- The Data Passport does not establish that the data is anonymous, that its use is lawful, or that any system tested against it is clinically safe.
- No clinician has signed our clinical content yet. Facts from official sources are labelled as such. Situations that depend on a fact we have not established are counted as not verifiable.
- We publish no comparison with other tools yet.
- Testing against your system is proven against an open-source FHIR server and our reference system, not yet against a customer’s system.
- End-to-end runs with FHIR export are measured up to 30,000 patients on a laptop; larger populations are built and verified, but not yet exported in one run.
- Delivered data uses plain names for drugs and labs today; standard codes are in development.
- We construct declared test situations; we never predict what will happen to a real patient.
Questions about any of this? Ask us directly.
Bring the list of situations your software must handle.
We will turn it into a test specification and show you what a pilot would deliver. Already have FHIR test data? Send a sample and we will show you what it is missing. Or email us at [email protected].