Two people, or it is not released. One function decides who sees what.

At release time the system finds the active order covering that result's panel and stamps both the order and the ordering physician's identifier onto the result itself. The result carries its own authority; it is not inferred later from a lookup that might return something different next year.

Enforcement is a system setting rather than hardcoded, defaulting off. When enabled, release is blocked without a covering order. Renewal lineage is tracked from one protocol version to the next, with the signed document retained per version.

A single denormalized order-type value is derived from those two axes plus the membership products themselves. The code comments are explicit that the derived fields must never be edited independently of the source axes, and a backfill keeps them in sync.

That is a small thing that matters. A derived field someone can edit by hand is a field that will eventually disagree with what derived it, and the disagreement will surface as a product appearing in the wrong bucket for one customer and not another.

Custody is an append-only event log keyed to defined steps: pre-visit, arrival, collection, labelling, completion, shipped, received. Each event can carry the actor, their role, a photograph, a barcode and free-text notes.

The raw event-recording route is restricted to staff roles, and the code says exactly why: the underlying service applies no ownership scoping of its own, so the role gate at the router is the control that prevents one person reading or forging another's custody trail. Stating that in a comment, rather than assuming the next maintainer will infer it, is the difference between a control and an accident.

Verification and release each enforce a four-eyes rule: the person verifying or releasing must not be the person who uploaded. Release additionally requires any critical value to have been acknowledged, the lifecycle not to be in a discrepant hold, and — where the result is flagged for it — a laboratory director to have signed off through a separate endpoint with its own distinct-signer check. That co-sign requirement traces to a specific state statute, and the role that satisfies it exists in the role model.

The decisive design choice is that one module answers the question 'may this be shown outside staff'. The same two functions gate the authenticated patient portal and the unauthenticated public share link. A result therefore cannot leak through one surface while correctly blocked on the other — which is exactly the failure mode you get when each surface writes its own filter.

• Release also opens public-health filing records for reportable positives, idempotent per result and organism so a re-release cannot duplicate a filing.

The distinction the documentation draws is worth repeating: no-PHI means identifiers are redacted, not that results are hidden. The shareable summary shows the same analytes; it simply does not identify the person by name, record number or full date of birth.

The PDF generator consumes that function directly — its two render paths differ in exactly the fields the profile would have populated. A parallel strip runs over every analytics event property before capture, with the server-side version documented as recursive and the client-side one as top-level only. That asymmetry is written down rather than assumed equal.

That default matters more than the integration does. A registry push is irreversible in practice, and a system where reporting is on by default is one bad catalog entry away from disclosing a result to a third party that had no business receiving it.

Per-analyte, a flag decides whether a positive blocks clearance or is instead footnoted on the full report as a supplemental screening. Downstream person-to-person and person-to-agency sharing is a separate model with its own one-time and continuous modes, deliberately distinct from the public, revocable, expiring share token used for the QR link.

Those being separate is what lets a site be quietly soft-launched — bookable by a direct link while not yet advertised — or quietly retired without breaking existing appointments. Collapsing them into one boolean forces an all-or-nothing rollout.

Availability is scoped per panel and location rather than globally, so a panel can be bookable at one site and not another while both are active. Appointments carry a full reschedule sub-flow with proposal, acceptance and decline timestamps, plus telehealth-specific state.