Local processing first
Supported files, images, text and associated metadata must be de-identified, checked and previewed in the user's browser or app before transmission. Original patient records, unprocessed OCR text and re-identification mappings must remain on the user's device.
Uncertainty stops submission
Unsupported formats or languages, parsing failures, unreadable images, outdated rules and unresolved identification risks must block submission. Cloud OCR, translation or AI must not be used to process the original material as a fallback.
A second check at the gateway
Only permitted copies may pass the portal's admission checks into an approved research workflow. A checkbox, automated detector or file hash is not proof of HIPAA de-identification. The applicable method and residual identification risk must be assessed.
No bypass
Administrator access, an enterprise plan, consent or a business associate agreement cannot enable an original-PHI upload route on this portal. Necessary grant and payment identities are kept separate from patient research data.
Report a concern
Send a minimal description of a vulnerability or abuse concern to [email protected]. Do not attach patient records, secrets, passwords or original medical images. A report does not authorise testing other people's accounts or production data.