Mithras The journal · 50 field notes
Field notes from the dawn of patient-mediated research.
Plain-language pieces on who owns health data, how privacy machinery actually works, what the standards and laws permit, and how chronic-disease research gets faster when patients hold the keys. Evidence first, no hype.
50 field notes · 7 sections · plain language
The journal holds 50 field notes across 7 sections: Patient rights (8), Privacy & de-identification (8), Standards & interoperability (8), Regulation worldwide (8), Research methods (8), Chronic conditions (6), Principles (4).
Should patients be paid when research uses their data?
Should patients be paid for health data? The case for participation fees, the honest counterarguments, and why IRB-approved fair-market fees are a middle path.
№ 02 Privacy & de-identificationk-anonymity, explained with a hospital waiting room
What k-anonymity means, why k ≥ 5 is a common floor in health data, and how the waiting-room test makes a 2002 idea easy to reason about.
№ 03 Research methodsWhy most clinical trials miss enrollment deadlines — and what fixes it
Why clinical trial recruitment fails so often, what the enrollment funnel wastes, and how consented, phenotyped patient data turns recruiting into matching.
№ 04 Chronic conditionsSix specialists, six portals: the fragmentation problem in chronic disease
Why medical records end up scattered across multiple providers in chronic disease, what fragmentation costs patients and research, and the realistic fix.
№ 05 Standards & interoperabilitySMART on FHIR: the app-store model for health records
SMART on FHIR apps explained: how OAuth2 and FHIR scopes let health apps plug into any EHR, and why scoped access matters for research consent.
№ 06 Research methodsReal-world evidence: when routine care data becomes research
What real-world evidence (RWE) is, how it differs from real-world data, what the FDA framework permits, and where routine care data beats or trails trials.
№ 07 Privacy & de-identificationWhy small numbers are dangerous: small-cell suppression in health statistics
Small cell suppression in health data, explained: why tiny counts identify real people, where thresholds like 5 and 11 come from, and how k floors extend it.
№ 08 Patient rightsWhat revocable consent really means — and why most 'consent' isn't
Revocable consent for health data, explained: stopping future use as fast as a yes, keeping the audit intact, and being honest about published aggregates.
№ 09 Chronic conditionsYour medical paper trail is a research asset. Treat it like one
How to organize medical records for chronic illness: complete copies, machine-readable formats, and a consistent symptom log that doubles as research data.
№ 10 Research methodsDecentralized clinical trials: research that comes to the patient
What decentralized clinical trials are, how eConsent, wearables, and home visits work, and why chronic-disease patients stand to gain the most.
№ 11 Regulation worldwideWashington's My Health My Data Act: America's strictest health-privacy law
Washington's My Health My Data Act explained: consumer health data beyond HIPAA, signed authorizations to sell, geofencing bans, and a private right of action.
№ 12 Standards & interoperabilityWhat is the OMOP Common Data Model — and why researchers love it
What the OMOP Common Data Model is, how OHDSI's standard tables and vocabularies work, and why one analysis can run unchanged across hospitals worldwide.
№ 13 PrinciplesWhy 'Mithras'? The sun, the covenant, and the name
The meaning behind the Mithras Health name: an ancient deity of covenant and light, the rising-sun motif, and what an oath-keeping model owes patients.
№ 14 Privacy & de-identificationDe-identified, anonymized, pseudonymized: what these words actually mean
De-identified vs anonymized vs pseudonymized data: three terms, three legal regimes under HIPAA and GDPR, and a clear table of standard, reversibility, and scope.
№ 15 Chronic conditionsInterstitial cystitis / bladder pain syndrome: why research has been so hard
Why interstitial cystitis / bladder pain syndrome research has lagged — diagnostic ambiguity, mixed phenotypes, small trials — and what changes it.
№ 16 Regulation worldwideWhat an IRB actually does: research ethics review, explained
What an IRB does in research: where ethics review came from, how risk-benefit review works, expedited vs. full board, and why approval should gate release.
№ 17 Standards & interoperabilitySNOMED, LOINC, ICD-10, RxNorm: the vocabularies of medicine, decoded
SNOMED vs LOINC vs ICD-10 vs RxNorm: what each medical vocabulary covers, why one concept has five codes, and how mapping makes research possible.
№ 18 Privacy & de-identificationFederated analytics: research the data without moving the data
How federated analytics lets researchers study health data without moving it: in-region queries, aggregate-only results, fewer transfer problems.
№ 19 Chronic conditionsUnderfunded conditions: what 28 diseases on one platform makes possible
Underfunded disease research stalls when each condition builds its own registry. What a shared consent, privacy, and audit spine across 28 conditions changes.
№ 20 Research methodsPatient registries: the quiet workhorses of chronic-disease research
What a patient registry is, the three jobs registries do, why rare-disease communities depend on them, and why the infrastructure should be shared, not rebuilt.
№ 21 Regulation worldwideThe European Health Data Space, explained: what secondary use will look like
The European Health Data Space (EHDS), explained: health data access bodies, secondary-use permits, the opt-out, and the 2027–2031 timeline.
№ 22 Standards & interoperabilityFHIR R4 and US Core, explained for non-engineers
FHIR R4 and US Core profiles explained for non-engineers: what a base standard leaves open, how an implementation guide pins it down, why versions matter.
№ 23 Patient rightsFrom Henrietta Lacks to data dividends: research without asking
From Henrietta Lacks to the Havasupai and deCODE Iceland: a short history of research without consent, the ethics it forced, and the data-dividend answer today.
№ 24 PrinciplesPrivacy as apparatus, not policy: invariants you can't configure away
Privacy by design on a health platform means apparatus, not policy: a k ≥ 5 gate, append-only audit, and consent checks no one can configure away.
№ 25 Research methodsGarbage in, garbage out: data quality in health research
Why EHR data goes wrong, how the Kahn framework names quality problems, and how health research checks completeness, plausibility, and conformance.
№ 26 Regulation worldwideBeyond HIPAA: the new wave of US state health-privacy laws
The new state health privacy laws beyond HIPAA — Washington's MHMD, Nevada SB 370, Connecticut — and why building to the strictest standard wins.
№ 27 Standards & interoperabilityComputable phenotypes: how researchers find patients in messy data
What a computable phenotype is, how a phenotype algorithm finds patients in messy EHR data, and why versioned, testable definitions beat ad-hoc queries.
№ 28 Patient rightsHow to download your own health data as FHIR — portals, APIs, and apps
How to download your health records as FHIR data using patient portals, Patient Access APIs, and SMART on FHIR apps — and why structured copies beat PDFs.
№ 29 Privacy & de-identificationDifferential privacy in healthcare: when noise protects patients
Differential privacy in healthcare, explained in plain language: what epsilon means, how calibrated noise protects patients, and where it fits.
№ 30 Chronic conditionsThe data gap for invisible illnesses — and how patients close it
Why an invisible chronic illness research data gap exists for fibromyalgia, IBS, ME/CFS, and IC — and how patient-reported data is starting to close it.
№ 31 Standards & interoperabilityWhat is FHIR? The standard quietly rewiring healthcare
What the FHIR standard is, where it came from, and why a 2011 idea built on plain web APIs now sits underneath nearly every patient portal in America.
№ 32 Regulation worldwideHIPAA and research: authorizations, waivers, and the §164.508 path
How HIPAA treats research: the §164.508 authorization path, IRB waivers, and de-identification — three lawful routes and what each asks of patients.
№ 33 Patient rightsHow health data gets bought and sold — and what you can do about it
How data brokers buy and sell medical data through the de-identified loophole outside HIPAA, why opting out rarely works, and what a patient-mediated model changes.
№ 34 PrinciplesTwo documents, one decision: how Mithras consent works
How a plain language consent form for research pairs with a formal authorization at Mithras: two documents, one revocable decision, both versioned.
№ 35 Regulation worldwideWhy health data can't just cross borders — and how research happens anyway
Why cross-border health data transfer is so hard — Schrems II, adequacy, data localization — and how federated research gets answers without moving records.
№ 36 Research methodsAI in clinical research: assist with discovery, never decide alone
Where AI helps clinical research — cohort discovery, coding messy text — why decisions need deterministic engines, and how local models protect privacy.
№ 37 Standards & interoperabilityEHR interoperability: TEFCA, information blocking, and what actually works
Where EHR interoperability really stands: TEFCA and the QHINs, information blocking penalties, USCDI versions, and what still lags for patients and research.
№ 38 Privacy & de-identificationRe-identification attacks: how 'anonymous' health data gets unmasked
Real examples of re-identification attacks on anonymized data — the Weld case, AOL, Netflix, Strava — and the defenses that assume linkage exists.
№ 39 Patient rightsYour right to a copy: getting your full medical record under HIPAA and GDPR
How to request medical records under HIPAA's right of access and GDPR Article 15 — deadlines, fees, formats, and what to do when a provider stonewalls you.
№ 40 Chronic conditionsHow patient communities move research when institutions can't
Real examples of patient community driven research: the PatientsLikeMe lithium study, cystic fibrosis venture philanthropy, the patients who named Long Covid.
№ 41 Research methodsWhat is a research cohort? From question to dataset
What a cohort is in research, how inclusion criteria, index dates, and washout windows turn a plain question into a dataset, and where the gates belong.
№ 42 Regulation worldwideGDPR and health research: what Article 9 really permits
What GDPR Article 9 really permits for health data research: explicit consent vs. the research exemption, and why consent travels best across borders.
№ 43 Privacy & de-identificationAppend-only, tamper-evident: what a real audit trail looks like
What makes an audit log tamper evident in healthcare: append-only writes, hash chains, cryptographic anchoring, and HIPAA's six-year retention rule.
№ 44 Patient rightsBroad consent vs. dynamic consent: what patients actually agree to
Broad consent vs dynamic consent in research: what one biobank signature commits you to, what per-study consent gives back, and why the difference builds trust.
№ 45 PrinciplesWhy Mithras Health will never buy or sell your data
Why Mithras Health will never buy or sell health data: how the broker economy misaligns incentives, and how access mediation pays patients instead.
№ 46 Research methodsSynthetic health data: promise, limits, and honest uses
What synthetic health data is, its honest uses in software testing, demos, and education, and why generating synthetic data is never a consent bypass.
№ 47 Regulation worldwideHealth-data research in the UK: UK GDPR, the DPA 2018, and the NHS
How UK GDPR, the Data Protection Act 2018, the duty of confidentiality, and the national data opt-out shape NHS health data research in the UK.
№ 48 Standards & interoperabilityFHIR vs. OMOP: two data models, two jobs, one pipeline
FHIR vs. OMOP CDM: what each data model is built for, why the difference matters, and how a FHIR-to-OMOP pipeline delivers both exchange and analytics.
№ 49 Privacy & de-identificationHIPAA Safe Harbor vs. Expert Determination: two legal paths to de-identify data
HIPAA Safe Harbor vs Expert Determination: the two paths to de-identify data, the 18 identifiers, a statistical risk standard, and the research trade-offs explained.
№ 50 Patient rightsWho actually owns your medical records? It depends where you live
Who owns medical records? In most US states the provider owns the chart and you own access rights; under GDPR you hold rights, not property. What that means.