Skip to content

Egress and disclosure control

Egress is the process of taking outputs out of the TVS TRE. All outputs are subject to review before they are released — this page explains what is permitted, what to prepare, and how the review process works.

For instructions on how to submit an egress request, see Airlock requests.

What can leave the TRE?

The TVS TRE is an analysis environment. Data comes in; results go out. Only aggregate statistical outputs may leave via the airlock — patient-level data may not leave under any circumstances.

Permitted outputs:

  • Summary statistics (counts, means, medians, proportions, rates)
  • Aggregate tables and crosstabulations
  • Charts and visualisations based on aggregated data
  • Model coefficients and performance metrics (subject to review)
  • Code and scripts you have written

Not permitted:

  • Row-level or record-level data in any format
  • Any output that could allow identification of an individual patient
  • Full model weights or binary files (these require specific justification and additional review)

Disclosure control rules

Before submitting an egress request, you must ensure your outputs comply with the following rules. The airlock manager will apply these checks during review — outputs that do not comply will be rejected.

Minimum count threshold

Any count below 10 must be suppressed before submission. Replace suppressed values with <10 or omit the cell entirely.

This applies to all counts of patients, events, or records anywhere in your output, including:

  • Table cells
  • Chart data points
  • Denominators and numerators
  • Subgroup sizes

Complementary suppression

Suppressing a small count is not always sufficient on its own. If a total is shown alongside its component parts, a suppressed cell can be back-calculated from the others.

Example: If a table shows a total of 45 patients split into three groups, and one group is suppressed because it contains fewer than 10 patients, the other two groups may reveal the suppressed value by subtraction.

Where a total is shown alongside mutually exclusive stratifications and one or more stratifications contain a suppressed count, the other stratification arms must also be suppressed or shown as a range to prevent back-calculation.

Density histograms

Density histograms are not automatically safe. Because density is plotted as a function of bin width and total N, the underlying counts can be estimated by back-calculation. Treat density histogram outputs as if they contained raw counts and apply the same threshold.

Percentages and proportions

A percentage or proportion based on a small denominator can be as identifying as the raw count. Do not include percentages where the denominator is below 10, and ensure the underlying count is also suppressed.

Model outputs

Model coefficients and summary statistics from statistical models (regression coefficients, hazard ratios, confidence intervals) are generally permissible provided they are not derived from groups of fewer than 10 patients. If your model includes subgroup analyses, apply the same threshold to any group-level statistics.

Binary files and model weights require additional justification — contact the TVS service desk before submitting.

Preparing your outputs

Before submitting an egress request:

  1. Check every count in every table and chart — including totals, subtotals, and denominators
  2. Suppress all counts below 10 — replace with <10 or remove the cell
  3. Apply complementary suppression where totals are shown alongside components
  4. Check percentages — ensure no percentage is derived from a denominator below 10
  5. Review visualisations — check that no individual data points represent fewer than 10 patients
  6. Minimise the output — only include what is needed for the stated purpose; do not include intermediate outputs or exploratory tables unless specifically required

Output minimisation

Only request egress for outputs that are necessary for your stated research purpose. Submitting large bundles of intermediate outputs increases review time and is likely to result in rejection of some files.

The review process

All egress requests go through a two-step process:

  1. Airlock request — submit via the TRE portal (see Airlock requests)
  2. GitHub issue — raise an issue in your workspace repository with details of what you are exporting and why

Both steps are mandatory. Requests without a corresponding GitHub issue will not be reviewed.

The airlock manager will review your outputs against the disclosure control rules above. You will be notified of the outcome — approved, rejected, or returned for amendment. Allow a minimum of 2–5 working days for review.

If your request is rejected, the reviewer will provide a reason and guidance on how to resubmit.

Questions

If you are unsure whether a specific output is permissible, contact the TVS service desk before submitting — it is better to ask than to have a request rejected after preparation. See Contact and support.