Concept explainer
The site boundary
Explains how Pensieve keeps each site's records within its own boundary, and the conditions under which access crosses between sites.
Pensieve holds each site's records within that site's own boundary. Access crosses to another site only when the patient's consent and an active admission establish a reason at that site.
One deployment, many sites
An organisation is the legal entity that runs the hospital. A site is a physical location the organisation operates. One deployment serves an organisation and all of its sites.
The site is the enforcement boundary. Almost all data and permissions are scoped to a site, so a site is the unit within which access is decided and held.
What stays within a site
Roles, postings, care teams, sensitivity markings and field visibility are held within a single site.
The platform holds these within the site in code, so a permission at one site reaches that site's records and stays there. A cross-site path through the site-permission plane resolves to a refusal, held as a structural property of the model rather than a runtime check.
Sensitivity markings are site-local and stay off the central record. A marking policy set at one site governs reading at that site, so one site's markings stay within that site and reach only its own readers.
Markings stay site-local
A sensitivity marking is applied under a site's own admission and held within that site. Keeping markings off the central record holds one site's marking policy within its own boundary, so a reader at another site sees that site's policy rather than a policy set elsewhere.
The shared record
The patient record is the one deliberately cross-site thing.
It belongs to the patient, who holds the decision rights over who may read it. It has no owning hospital and no owning organisation, it exists once outside the tenancy structure, and one record per patient means care at any site draws on the same history. The organisation is the custodian and Data Fiduciary for the care it delivers, not the owner of the record. The patient's consent and their admissions travel with the record, since they belong to the patient rather than to a site. Cross-site access is the ordinary case for a patient treated at several of the organisation's sites.
Crossing the boundary
Access crosses between sites under defined conditions.
| Condition | What it requires |
|---|---|
| Consent for the other site | The patient allows the other site to hold their record |
| An active admission | An admission at that site connects a staff member to the patient |
| A site permission | The staff member's role and posting at that site permit the action |
Where these conditions hold together, a clinician at the other site reaches the record within the patient lens. Where a condition is outstanding, the other site sees basic information only, which is enough to admit the patient. Emergency access is a defined path a treating clinician invokes with a stated reason, logged in full.
Why is the record cross-site when permissions are site-local?
The record belongs to the patient and one history serves them wherever they are treated. Permissions belong to a site's own governance, so they stay within the site that sets them.
Can a marking at one site hide data at another?
A marking governs reading at the site that sets it. It stays off the central record, so it reaches readers at that site and leaves other sites to their own markings.
What does a second site see before admission?
Basic information: the public reference, a display name, a photograph, and coarse demographics. Clinical detail follows once an admission opens a care relationship at that site.
Read how multi-site and tenancy holds several sites in one deployment.