The blinding problem nobody writes in the protocol

Clinical systems exist to make every record traceable. Blinded review requires the opposite. Most teams solve that by moving the data. There is a better answer.

Every clinical system is built on one assumption: every record is traceable to a subject, a site, a visit and a source. That is not a feature you can switch off. It is the thing that makes data inspectable, and it is the reason the system is allowed to exist at all.

Then a protocol arrives that needs a reader to see none of it.

Blinded review is routine science. Two devices, two readers, one endpoint, no knowledge of which is which. The statistics are well understood and the reporting guidelines are mature. What is not routine is the system problem underneath, and it is usually discovered late, by a data manager, at the point where someone asks how the images will actually reach the radiologist.

The usual answer, and what it costs

The standard solution is to move the data. Export from the capture system, de-identify it, push it to a separate reading platform, collect the scores, bring them back and reconcile.

It works. It is also where most of the risk in these studies lives.

You now have two systems that must agree about what exists. You have an export step, which means a point at which the dataset can diverge. You have a transfer agreement, a named recipient and a deletion attestation, all of which are promises rather than controls. You have a second vendor, a second validation burden and a second audit trail that has to be stitched to the first.

And at the end of all that, a copy of the images exists on a machine you do not own.

One object, two views

The alternative is to stop treating blinding as a transfer problem and start treating it as an identity problem.

The same image needs to carry full provenance for one audience and none at all for another, simultaneously, in one system. The data manager sees subject, device, visit and timepoint. The reader sees a token, a picture and a form. There is one record, one audit trail, one source of truth, and the mapping between the two views resolves only after the read is locked.

Nothing is exported because nothing moves. Nothing is reconciled because nothing diverged. The reader never downloads anything, so the question changes from how you control what happens to the copy, to the observation that there is no copy.

That last sentence is much easier to defend in a data protection assessment than any transfer agreement, and sponsors notice.

The thing the protocol definitely does not mention

A protocol tells you what to capture. It does not tell you what you will actually receive.

Sites running busy outpatient clinics upload what is in front of them, quickly. Some of what arrives is unusable: signal dropout, saturation, motion, or simply the wrong thing. Not carelessness. Volume and time pressure.

This matters more than it looks. A reader who opens a queue and finds unusable images does not just lose time, they lose confidence in the queue. And the unusable image still has to be resolved as a query later, by which point the visit is long over and the capture cannot be repeated.

The instinct is to automate quality detection. Resist it, at least at first. The failure modes are more varied than you can specify early, and a false reject on a clinically usable image is worse than a false accept that a human catches.

The better move is cheaper. Monitors already review site data during source data verification. Attach the image decision to that moment. Accept or reject, with a reason, inside a workflow that already exists. No new role, no new login, no extra burden on the site, and the rejection returns as a query while the visit is still recent enough to act on.

The best process changes are usually not new steps. They are new judgements attached to steps that were already happening.

Build for the modality you have, design for the one you do not

We built this to answer one sponsor's question about one pair of devices. The decision that made it worth more than that was keeping the module modality agnostic.

Nothing in it knows what anatomy it is looking at. It handles an object that gets captured at a site, quality checked by a monitor, stripped of attribution and scored by an independent expert. That pattern is identical for an MRI series, an ECG trace, an EEG recording, a plain radiograph or a pathology slide, and it holds whether the blinding exists for device comparison, independent central review or endpoint adjudication.

The cost of that generality at design time was close to zero. It required one question during the build: which parts of this are about the modality, and which parts are about blinding?

The next study that needs blinded reads does not need a build. It needs configuration. That is the difference between shipping a feature and shipping a product, and it is decided weeks before anyone writes code.