Health data and medical software

SaMD category — choose the state of the healthcare situation (critical, serious, non-serious) and the significance of the information (treat or diagnose, drive, inform) to see the IMDRF category I–IV. The result is a teaching placement, not a status determination. The tab also has the book’s worked example (Question 3: the heart-failure app that says “go to the emergency department now”, category II–III), the five-app exercise with an intended-use sentence, a placement and the deciding question for each (the tool gives prompts, not answers), and short notes on EU MDR Rule 11 and the IEC 62304 software safety classes A/B/C.

k-anonymity — first without data: the number of cells is the product of each quasi-identifier’s number of values. The book’s example, 1,000 people by sex (2) × year of birth (80) × postcode district (50), has 8,000 cells, eight per person, so k ≈ 1. Generalised to 10-year bands (8) and regions (5), it has 80 cells — about 12 per cell, with some still small. Presets load these and Question 14 (2,000 people, sex × age 0–99 × 40 districts = 8,000 cells; ten-year bands give 800). Then with data: paste a CSV (or load 1,000 seeded synthetic patients), tick the quasi-identifiers, generalise them (year only, numeric bands, first N characters), and see k (the smallest group), the unique records, the smallest groups, a table of group sizes, and l-diversity for a sensitive column.

Safe Harbor — the 18 HIPAA identifier types as a checklist, plus the “no actual knowledge” condition, and pattern hints that find some emails, phone numbers, dates, ZIP codes, IP addresses, URLs and record numbers in pasted text.

FHIR Observation — build an Observation from a LOINC code (heart rate 8867-4, systolic 8480-6 and diastolic 8462-4 blood pressure, respiratory rate 9279-1, body temperature 8310-5, body weight 29463-7, SpO₂ by pulse oximetry 59408-5, blood glucose mass/volume 2339-0), a value, a UCUM unit, status, time and subject, or paste one. The validator rejects — it never corrects — a missing unit, a unit that is wrong for the code (bpm, or mmol/L on 2339-0), a unit without the UCUM system, a value in quotes, a missing status, time or subject, a time without a time zone, and a coding without http://loinc.org. It warns about non-final statuses and display text that differs from the code, and reads the accepted value back with its unit.

HL7 v2 — paste a message (or load the synthetic ORU^R01) to see the header summary and every segment; click a field for its name, components and path. Fields that carry identifiers are underlined. Type a path such as PID-5.1 or OBX[2]-6.1 to read one value. Escapes are decoded.

Audit log — append entries to a hash-chained log (SHA-256 with WebCrypto, over the same JSON as the book’s Python append_entry, so the hashes match). Edit any value, delete an entry, and verify: the first broken entry is named. Deleting the last entry is not detected, and Rewrite every hash shows that an attacker who can rewrite the whole log passes — the limits the book describes. Export and import as JSON.

STRIDE — a threat table pre-filled with the book’s teaching-room example (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege), with a column for the control or accepted risk, its test, and whether the threat is really a safety hazard to trace into the hazard table. No numeric risk scores. Copy as Markdown.

Nothing here determines whether software is a medical device, what class it is, or whether a dataset is de-identified. Those decisions belong to the manufacturer’s regulatory function, the regulator, and qualified privacy staff.

The k-anonymity arithmetic recognises an obvious failure; it is not a re-identification risk assessment. k is a floor, not a guarantee: linkage with outside data can still identify people.

The Safe Harbor pattern hints miss names, free text, rare conditions and images.

The FHIR validator checks the points the book makes, for a short list of LOINC codes; it is not a FHIR profile validator.

HL7 field names are given for common v2.5 segments only.