Privacy as apparatus, not policy: invariants you can't configure away

Every hospital has a fire policy. It lives in a binder at the nursing station, and it is sincere, detailed, and reviewed annually. Every hospital also has fire doors — heavy, sprung, self-closing. The binder asks people to do the right thing under pressure. The door does the right thing regardless. When there is actual smoke in the corridor, only one of them is load-bearing.

Health-data privacy has the same two species, and most of what gets called "privacy by design" is, on inspection, a better binder. This post is about the other species — and about the specific invariants Mithras Health refuses to make configurable.

Policy fails open, apparatus fails closed

A policy is an instruction to people; apparatus is a mechanism in the path of the data. The distinction matters because they fail in opposite directions. When a policy is ignored, misremembered, or overridden, the data flows anyway — policy fails open. When apparatus meets a condition it cannot verify, nothing happens — apparatus fails closed.

Most privacy failures in health data are not policy-absence; they are policy-override. The rules existed. Someone senior enough decided this case was special, this deadline was real, this partner was trustworthy. An organization's documents describe its intentions; its architecture describes its limits. Patients live with the limits.

The distinction is easy to test from the outside. Ask a platform what happens, mechanically, when a query would violate its own rules. If the answer involves a person — a review, an approval, an escalation — you are looking at policy wearing an apparatus costume. If the answer is that the query returns nothing and the attempt is written down, you are looking at the door, not the binder.

Four invariants with no settings page

On Mithras, four properties are enforced in the data path itself, and none of them has a setting, a flag, or an administrative override. They are not defaults. They are the shape of the machine.

The first is the floor we explain in k-anonymity, explained with a hospital waiting room: a cohort below k = 5 cannot be released — the gate refuses, and the refusal is logged. The second is the append-only, cryptographically anchored audit trail on which every access, consent, revocation, and refusal is recorded with six-year retention. The third inverts the industry default: absence of consent means no, every study asks, and revocation is honored as fast as consent was. The fourth is the federated design — queries travel to the data, run in-region, and return aggregates only, so there is no record-level export path to misuse.

One more design choice belongs in this list even though it is a pattern rather than a gate: on Mithras, locally hosted AI assists discovery, but deterministic engines decide. A language model can help a researcher find a cohort; it cannot release one. Decisions that carry privacy consequences are made by versioned, testable logic whose behavior does not drift with a model update.

The legal echo: Article 25

The law has been converging on the same intuition. Article 25 of the GDPR — data protection by design and by default — requires controllers to "integrate the necessary safeguards into the processing" itself, not merely to document safeguards beside it. The European Data Protection Board has published guidelines making the point explicit: design means effective implementation, measurably embedded in processing operations, and the ICO reads UK GDPR the same way. On the American side, the HIPAA Security Rule requires technical safeguards — including audit controls — as machinery, not memos.

Read together, the direction is unmistakable: regulators are losing patience with paper controls. A platform that builds its protections as apparatus is not being virtuous beyond the law; it is meeting the law where the law is going.

A setting is a countdown

Any safeguard that exists as a configuration value will eventually be configured. Not by villains — by reasonable people under unreasonable pressure. The study is important. The cohort is at four, not five. The sponsor is waiting, the PI is sympathetic, the exception is just this once. Then the exception is precedent, the precedent is practice, and the floor is a story the company tells about itself.

This is why "who can change the number?" is the sharpest question to ask any platform about any protection. If the answer is a role, the protection is organizational, and organizations have turnover, acquisitions, and incentives — the same forces we examine in why Mithras will never buy or sell your data. If the answer is no one, without rebuilding the product, the protection is structural. And structure has a second advantage policy can never have: a gate that logs its refusals can prove restraint. A binder can only assert it.

What apparatus costs

Honesty requires saying what this design refuses us. A rare-disease cohort of four cannot be released, even when the researcher is careful and the cause is good — the gate does not know about good causes, which is precisely the point. Deterministic engines change slowly and resist clever exceptions. Fail-closed systems produce frustrating refusals that a more flexible competitor would wave through. We accept these costs deliberately, because a constraint that costs nothing protects nothing.

The binder is still worth writing — policies set expectations, train staff, and satisfy auditors. But the test of a privacy program is the day someone with authority, a deadline, and a defensible reason leans on the door. On that day it should not matter what the binder says. The door should already be closed, the lean should be logged, and the building should be exactly as safe as it was the day before.