Paulo Villarroel

Technical notes

Five readings of the problem that change how the system is built

Each of these positions exists because the usual reading of the problem is common, costly and wrong, and because deciding otherwise changed something concrete in a system that is running. Each one ends with the system where that decision holds.

A waiting list is a censored cohort, not an inventory

Counting who is still waiting describes the survivors of the process, not the demand.

A waiting list only contains whoever is still on it. Those who left — because they were seen, resolved elsewhere in the network, withdrew or died — disappear from the snapshot. Measuring average waiting time over that picture measures the people who have not left yet, which is precisely the subgroup with the longest waits.

The correct treatment is survival analysis: exit is the event, time on the list is time-to-event, and anyone still waiting at the end of the period is right-censored, not absent. Without that correction, waiting-time series appear to improve when all that changed was cohort composition.

The practical consequence is budgetary: real demand and visible demand do not coincide, and allocation decisions are made on the second one.

Where it holdsWaiting list projection model and simulator

Interoperability is not passing a JSON

Transport is the easy part. The hard part is both sides meaning the same thing.

Exchanging messages between two systems has been a solved problem for decades. Making the message interpretable is another matter: it demands mapped terminologies, declared units, controlled vocabularies and a shared definition of what counts as a diagnosis, an encounter or an episode.

Then there is identity. If the same patient resolves to two different keys at each end, a perfectly formed exchange produces two parallel clinical histories for one person. Identity linkage is a prerequisite for interoperability, not an afterthought.

A well-formed JSON with ambiguous semantics carries data that cannot be aggregated, compared or audited. Interoperability is measured by whether two institutions can add their figures together without negotiating them, not by whether their endpoints return 200.

Where it holdsProbabilistic deduplication and record linkage

Chile’s data protection law is an architecture requirement, not paperwork

Treating health data as sensitive data changes the pipeline design, not just the legal annex.

Chile’s new personal data protection law places health data in the sensitive category, with reinforced requirements on lawful basis, purpose limitation, minimisation and traceability of processing. Institutionally it tends to be read as a matter of consent forms.

Technically it means something else: pseudonymisation inside the pipeline rather than at the end, separation between identifying keys and clinical attributes, role-based access control over intermediate tables, and an auditable record of which query touched which data and on what grounds.

Designing for that from the start is cheap. Retrofitting it onto an analytical store that already mixed identifiers with clinical variables is expensive, and in practice usually ends with access being restricted for exactly the teams that need the data to manage care.

Where it holdsAnonymisation with k-anonymity and l-diversity

A model that prioritises must not be allowed to dismiss

If the algorithm can drop someone from the list without a doctor looking, the error stops being recoverable.

A clinical classifier makes two errors that do not cost the same. A false positive spends medical audit time, which is expensive but bounded. A false negative sends a cancer patient back to the general queue, where nobody will look again, and the cost is paid by a person.

That is why the system labels three states, not two. Suspicious and indeterminate are mandatorily routed to medical review; the algorithm never closes a case on its own. The middle category is not a weakness of the model: it is where what the model does not know gets deposited explicitly.

The design consequence is that the threshold is not optimised for overall accuracy. It is calibrated so the expensive error is the one the system makes least, accepting more audit work up front. That is a clinical decision before a statistical one, and therefore not one the model can make.

Where it holdsCancer classifier for the surgical waiting list

A public policy figure with no pipeline behind it is an opinion

If the number cannot be reproduced, the decision made with it cannot be defended.

Waiting list figures underpin budget allocation, health targets and commitments to the care network. When they come out of a spreadsheet someone assembled by hand, there is no way to explain why March does not reconcile with February, or to tell a real change from a change of criteria.

The answer is not more documentation. It is that behind every figure there is a versioned pipeline, with the cut-off date as an explicit parameter, quality tests over the warehouse layers, and a repository where each change of criteria is dated and attributed to someone.

That turns reproducibility into an accountability mechanism rather than a methodological virtue. When someone asks where the number came from, the answer stops being an explanation and becomes a commit.

Where it holdsAnalytics architecture on open technology