Security and privacy
Patient data stays where it is
Section titled “Patient data stays where it is”dQMGrid runs inside the data owner’s own boundary. It reads a FHIR export or a warehouse extract where that data already lives, evaluates it there, and writes its results there. It does not send patient data to MDinteractive or anyone else.
An organization running dQMGrid operates it under the Health Insurance Portability and Accountability Act (HIPAA), on the same terms as any other system that processes its patient data.
What is shared, and what is not
Section titled “What is shared, and what is not”| Shared in the open | Never shared |
|---|---|
| Rules — CodeSystem fragments, ConceptMaps, derivations, profile declarations | Patient data of any kind |
| Test decks and fault-injected test decks — synthetic by design | Results tied to identifiable patients |
| Manifests of changes made to published packages | Credentials, tokens or internal URLs |
| Defect findings filed with engine maintainers | Customer or health-system identities tied to how their environment behaves |
dQMGrid’s conformance evidence is synthetic by design, so it can be shared and reproduced without any patient record. Every technical claim on this site is reproducible from public test data.
Where this site reports a result on a live export — such as the eClinicalWorks run — it shows aggregate counts only.
The live demonstration
Section titled “The live demonstration”The run report on this site is a real run’s structure with synthetic identifiers. It contains no protected health information.
Hosted instances
Section titled “Hosted instances”A hosted, government-facing instance would require Federal Risk and Authorization Management Program (FedRAMP) authorization. That is not part of the first release.
Reporting a problem
Section titled “Reporting a problem”If you find patient data or a credential anywhere on this site or in the repository, do not open a public issue. Contact the maintainers privately so it can be removed from the site and from git history.