Why Qualisure Diagnostics Chose Skyflow for Its PHI Protection

Customer Overview

Qualisure Diagnostics is a Calgary-based precision oncology company that develops molecular tests to help oncologists personalize cancer treatment. Its first test, Thyroid GuidePx(R), is available to clinicians today, and a second test is set to launch shortly with more in the pipeline.

Qualisure runs two product lines: diagnostics and Molecular deCodeR(TM), the platform that powers them. Built first for its own tests, Molecular deCodeR(TM) is now open to research groups and startups, giving scientists a faster path from discovery to the clinic.

‍

Challenge

Qualisure's platform strategy starts with a shift in the science. Next-generation sequencing has become a commodity, and cloud computing and AI now handle the analysis that finds biological signals in RNA sequences. Universities, PhD researchers, and research companies are making diagnostic and prognostic discoveries on that foundation.

Dave Ehman, Qualisure's CTO, sees the same roadblock in front of all of them. Once a research team has a test with clinical value, there is no organized way to bring it to market short of recreating the pieces Qualisure already built at extensive cost. Qualisure knows that barrier firsthand. "The biggest barrier that we had to actually getting to adoption was actually getting the platform out there so that people could adopt it," Ehman said. "Not because of the science."

Delivering cancer diagnostics means handling PHI, and a platform other teams will use has to address that data from the start. Qualisure's PHI layer had to meet three requirements:

1. Protect patient data to the standard clinical diagnostics and regulators demand
2. Give platform customers and partners a clear answer on how PHI is handled
3. Keep engineering focused on Molecular Decoder rather than on security infrastructure

Building that layer in-house would have put infrastructure work in direct competition with the platform itself.

‍

Solution

Qualisure weighed building its own PHI protection against buying it from a team that specializes in it, and chose to buy from Skyflow. Ehman's reasoning was practical: the protection layer was more than the team wanted to take on, and a service built by specialists already existed. He describes the result as a clean boundary in Qualisure's architecture. "It was so much easier for me to put a box around the managing of the PHI and put that on [Skyflow's] platform," he said.

Skyflow's part in that boundary comes down to where PHI is stored and who can reach it.

Quick Overview

Skyflow, a Runtime AI Data Control Platform, holds Qualisure's PHI in a Healthcare Data Privacy Vault that sits outside Qualisure's own systems and can be located where necessary to meet data sovereignty requirements. Molecular Decoder works with tokens in place of raw patient identifiers, and access to the underlying PHI follows policies Qualisure defines.

Deep Dive

Qualisure's integration follows the path patient data takes through Molecular Decoder, from sample intake to the clinical report:

• Capture into the vault: Patient identifiers and other PHI are written to Skyflow's vault through its APIs when a sample enters the platform, so raw PHI doesn't land in Molecular Decoder's own databases.
• Analysis on tokens: Sequencing data and analysis results stay linked to the patient through tokenization, which lets Molecular Decoder run its pipeline and store results without holding the identifiers themselves.
• Policy-based access: Policy-Based Access Control (PBAC) decides which users and services can see which PHI fields, so access is granted by role and purpose rather than by default.
• Detokenization for reports: When a clinical report goes to a physician, only the fields that the report needs are detokenized, under the same policies.

Qualisure moved from kickoff to production in 35 business days, and the vault now protects all of the records covering patient, referring physician, and report details.

Skyflow's onboarding also shaped how Qualisure plans to run its own. Ehman pointed to the clear gate criteria in Skyflow's onboarding process: defined points at which onboarding is complete and what happens next. Qualisure is following the same model for its own clients.

‍

Results

Qualisure keeps oversight of its PHI while Skyflow runs the protection layer underneath. The outcomes show up in the architecture, in the questions Qualisure can answer, and in how the company sells its own platform:

1. A defined boundary around PHI. Patient data lives in Skyflow's vault, so PHI handling has one clear place in Qualisure's architecture, and Molecular Decoder's own systems work with tokens rather than raw identifiers.
2. A direct answer on data protection. Investors are rightfully concerned about breaches and PHI handling, and Qualisure answers by pointing to a dedicated service, with its own oversight on top. "The answer we give them is, we bought an external service that specializes in that," Ehman said.
3. Engineering focus on Molecular deCodeR(TM). Ehman owns infrastructure at Qualisure, and relying on Skyflow for PHI protection keeps that work centered on the platform research teams will use to reach the market.
4. A story that matches its own pitch. Qualisure tells research teams they don't need to rebuild a diagnostics platform that already exists. Its PHI decision makes the same case, which Ehman says ties the two stories together: Qualisure gives its customers the same advice Skyflow gave Qualisure.

With its PHI architecture defined, Qualisure can focus on the next stage: bringing other teams' diagnostics to patients through Molecular Decoder.

‍

Customer Quote

Qualisure connects the advice it gives its customers to a broader point about patient outcomes.

"The way we get better patient outcomes in healthcare is by letting experts focus on the area they're expert in. So the scientists do science, the operations people operate, and the security people manage the security."

Dave Ehman, CTO, Qualisure Diagnostics

Qualisure's has now started opening Molecular deCodeR(TM) to research teams with its PHI architecture already in place. Healthcare and life sciences teams facing the same build-versus-buy decision can schedule a demo to see how Skyflow could keep PHI out of their own systems while their teams stay focused on the science.