T‑CAIREM · University of Toronto
The record leaves. The patient stays.
The Health Data Nexus is the University of Toronto’s platform for sharing hospital data with researchers, without a patient’s identity ever leaving the hospital. Follow one record through it.
The need
Clinical AI has to learn from real patient data.
Models trained on synthetic records often don’t hold up on real patients. Useful research needs records that come from real care.
The obstacle
Hospitals can’t share data that identifies people.
Under Ontario privacy law, identifiable health records can only leave a hospital under strict conditions, so most useful data never reaches researchers at all.
One record, lifted out
Every record carries more than research needs.
Of its six fields, five could lead back to a person: name, health card, date of birth, postal code and admission time. Only the diagnosis is what the research needs.
Illustrative values. Not a real patient.
01Agreement
The hospital and the university sign a data agreement first.
Before any data moves, the hospital and T‑CAIREM at the University of Toronto sign a Data Transfer Agreement, the formal basis for sharing. Until it is signed, the boundary stays closed.
02De‑identify
The hospital de‑identifies its own data, before anything leaves.
Identity never leaves the data holder. The platform only ever receives de‑identified records.
Remove
Some fields are simply deleted.
The health card number is removed and nothing replaces it. The field stays in the record, empty, so the absence is visible.
Pseudonymise
Names are replaced with a label.
J. Doe becomes P-04817. The key that links the label back to a name is sealed inside the hospital and never leaves it.
Generalise
Precise details are made less precise.
A birth date becomes an age range, a postal code becomes a city, an admission time becomes a month, until the combination no longer singles anyone out.
Keep
The diagnosis stays exactly as it was.
It is the reason the dataset exists. Everything around it changes so that it can be shared.
03Transfer
One boundary. One direction. Once.
Only the de‑identified copy crosses, and only once. A T‑CAIREM data steward helps the hospital document and upload the dataset. The original record and its key stay with the hospital.
The standard is set by T‑CAIREM, informed by the Information and Privacy Commissioner of Ontario.
04Access zones
It lands in one place and stays there.
The copy goes into a single region-pinned cloud bucket and is assigned to one of three access zones. Each zone adds controls, so the more sensitive the data, the more a researcher needs before they can reach it.
No downloads
Nothing can be downloaded.
The data can’t be copied out of the bucket. It stays where it landed.
05Research
Results leave. The data never does.
Researchers come to the data, not the other way round. Once credentialed and ethics‑trained, they work next to it in an isolated workspace with tools like Jupyter and RStudio, and what they take away is results, never records.
The architectural choice
The platform holds onlyde‑identified data.By design.
A deliberate decision to avoid the complications of working with personal health information under PHIPA. The single most important choice in the system.
The record, before and after
Illustrative. Not a real patient.
The transferable part
Three access zones.
Increasing controls for increasing sensitivity. Zone 1 has the most transparent and equitable access process.
Zone 1
- Credentialing
- Ethics training
- Data use agreement
Zone 2
- Everything in Zone 1
- Research plan approved by the data holder
Zone 3
- Everything in Zone 2
- Research ethics board approval
Built for T‑CAIREM at the University of Toronto.
Built on Google Cloud Platform, with PhysioNet as the technical foundation. Open source.
- Datasets
- 9
- Patients
- 15,000+
- Datathons supported
- 4
- First version
- <1 yr
As of May 2025.
“…a place, a nexus, where individuals from all kinds of different backgrounds all have a place to meet and collaborate.”
January Adams, MSc
Data Governance & Quality Analyst, T‑CAIREM
Upside Lab designed and built the Health Data Nexus with T‑CAIREM.
The secure environment, the three access zones and the research workspace you just followed, with the first version delivered within a year. See how in the case study.
Illustrative record. Not a real patient.