The technical depth
behind healthcare
data governance.
Guides, whitepapers, and research from a team that comes from the security and clinical informatics side - not the marketing one. Written for practitioners, procurement teams, and privacy officers who need specifics, not summaries.
DICOM PS3.15 defines 113+ attributes that may contain PHI. Most implementations handle a fraction of them. This guide maps the full attribute surface - including burned-in text, structured reports, and sequence tags - and explains why pixel-level processing alone is not sufficient.
The coverage gap in whole-slide imaging privacy
Everyone de-identifies the TIFF tile. Nobody de-identifies the label. This whitepaper documents the PHI surfaces in WSI formats that clinical de-identification tools routinely miss - TIFF metadata, label images, and LIMS barcodes.
Genomic data: the re-identification risk no one talks about
You cannot anonymise a genome. You can only govern the risk. This paper examines four re-identification vectors in VCF and FASTQ data - header PHI, sample identity, variant linkage, and pedigree inference - and the controls that address each.
Australian Privacy Act vs HIPAA: what healthcare AI vendors get wrong
Most 'healthcare data security' content is written for a US audience. The Australian Privacy Act 1988, the My Health Records Act, and OAIC de-identification guidance are different instruments with different obligations. This guide maps the gap.
Building a clinical NLP de-identification pipeline
Clinical notes contain the richest PHI surface in a health record - and the hardest to govern. This technical guide covers entity recognition approaches, false negative rates by entity class, and the architectural decisions that determine whether de-id runs on-prem or in the cloud.
Essential Eight for healthcare data workflows
The ACSC Essential Eight is a baseline, not a ceiling - and it was not designed with healthcare data pipelines in mind. This guide maps Essential Eight controls to the specific risks of clinical imaging, genomics, and HL7 message workflows.
Additional technical documentation
available to enterprise customers.
Security architecture diagrams, penetration test reports, compliance evidence packages, de-identification validation methodology reports, and detailed integration guides are available to enterprise customers and their technical and legal teams.