Concept explainer
Analytics and data out
Explains how analysis runs inside Pensieve on governed data, how de-identified results and full exports leave it, and where a hospital's data warehouse fits.
Falcon analyses a hospital's data inside Pensieve, under the same checks as every other read of the record. This page explains how that analysis runs on governed data, what leaves the platform as an export, and how the hospital's own data warehouse receives its data.
What flows
Analysis reads data inside the platform, and data leaves it as Falcon's exports of results or as the full export of the hospital's records.
| Exchange | Direction | Standard | Owning tool |
|---|---|---|---|
| Governed reads | From each tool into Falcon, inside the platform | The governed read path, with access, consent and field checks on every read | Falcon |
| Analytical exports | Out to the person who runs the export | CSV or JSON for a table, an image for a chart and a multi-page document for a dashboard, de-identified by default | Falcon |
| The full export | Out to the hospital, run by its own users | The standard formats listed in export and exit | The platform, across every tool |
Analysis on governed data
Every read Falcon makes goes through the platform's governed read path. Cirith Manager decides each read, consent filters it, the fields returned are those the reader's grants allow, and the read is audited where it is made.
The computation runs on the platform, never in the browser over raw data. A count drawn from too small a group of patients is suppressed before it is shown, and the guard stays on for every result.
Opening the patients behind a figure hands the reader to Atlas, which applies the patient lens to each record as it does for any read. How Falcon draws on each tool is set out in analytics and insights.
Governed metrics, lineage and freshness
A governed metric is a named measure with one definition, an owner who approves each change to it, and a version that every change advances. Earlier versions stay readable, so a past figure can be read against the definition it was computed with. The NABH quality indicators Falcon computes take their numerator, denominator and target from Vigil, which owns each definition.
Lineage traces any figure to the data set and row count it read, the parameters applied, the records consent excluded and the metric version behind it. How a reader follows a figure down to the events it counts is described in where a number comes from.
Each source data set carries a freshness record, and a figure read from data past its freshness window shows its age. A pack whose figures guide clinical decisions can be set to wait for fresh data. The ready-made sets of metrics and dashboards are listed in analysis packs.
Exports from Falcon
An analyst exports a table, a chart or a whole dashboard, and the file is built on the platform before it reaches the analyst. De-identification is on by default and stays on for any output that shows a column identifying a patient.
Keeping identifiers on a table of aggregates takes a further confirmation and writes an audit event of its own. Every export is audited with its format, its size in rows or tiles, whether it was de-identified and its trace identifier. It also meets the same small-cohort guard and consent filter as the screen.
The full export and the warehouse
The hospital's complete records, with the audit trail, leave through the self-service export in export and exit, in the formats that page lists. A data warehouse or BI tool the hospital runs is loaded from that export on the hospital's side. Pensieve gives it no live connector, replication feed or SQL access into the platform.
Figures that need current data are drawn in Falcon. How a warehouse fits beside each way of running Pensieve is set out in integration models.
Who does what
| Task | Who | Where |
|---|---|---|
| Analyse data and build views | Staff with Falcon access and an analytics grant | Falcon, with the grant held in Cirith Manager |
| Export results | The analyst, under the same grant | Falcon, with every export audited |
| Define a quality indicator | The indicator's owner | Vigil |
| Run the full export | The hospital's own users | The platform's self-service export |
Common confusions
Do Falcon's exports and the full export overlap?
Falcon's exports carry results, de-identified by default, to the analyst who runs them. The full export carries the records themselves, with the audit trail, for the hospital's warehouse or for leaving.
Does a past figure change when its metric is redefined?
A redefinition creates a new version of the metric. The earlier version stays readable, and lineage shows which version a figure was computed under.
Does a count hidden on screen reappear in an export?
No. The guard that suppresses a small count runs on the platform before a result reaches the screen or a file.
Read what the full export carries and how an exit runs in export and exit, and the other integrations outside the catalogue in integration boundaries.