Chapter 16
Priya received the de-identified dataset on a Wednesday morning.
No names. No jersey numbers. No positions narrow enough to identify a player. Each record carried a random study code assigned by the privacy officer, with the re-identification key held outside Priya's department.
She could not find Theo even if she tried.
That was the point.
Lena Ortiz joined her in the analytics lab behind two layers of access control. Naomi participated by secure video, and an external systems auditor sat at a separate terminal. The room smelled faintly of hot circuitry and the bitter coffee Lena forgot to drink.
"Workload fields are separated," Lena said. "You get snap exposure, practice intensity band, and recovery interval. No routes, game grades, salary, or role."
"Good."
"I know it's good. I designed it."
"You want praise?"
"Marriage has softened Roman. I need hostility from somewhere."
Priya almost smiled. "Your coffee is a governance failure."
"Better."
They began with a narrow question: did pain-field structure change in ways that correlated with an old review template rather than recorded clinical events?
The auditor showed them syntactic fingerprints, not content.
Punctuation order. Field length. Legacy service tags.
Time stamps normalized to unusual increments.
A cluster emerged across several seasons.
The records formed no clean chronology. Some altered values belonged to training camp, others late-season recovery.
The workload bands did not show every player being pushed toward return.
That inconsistency argued against an automatic algorithm with one simple threshold and against Priya's temptation to declare a single plan.
"Could clinicians have made legitimate corrections?" she asked.
"Some," the auditor said. "But legitimate correction should preserve original value, author, reason, and time. These overwrite or normalize."
Naomi highlighted a batch event at 4:12 on July twenty-second. "This one touched multiple records through a service account. No individual credential login appears."
Priya recognized the time from Theo's hidden metadata, then stopped herself. She could not know whether his de-identified record sat in the batch.
"Do not tell me which current case triggered preservation," she said.
"The key is outside this room," Arun replied. "I couldn't if you asked."
The answer relieved her. A good wall did not depend on personal virtue every minute. It made the wrong action unavailable.
Some symptom entries had been rewritten through the same service layer. Original user values were unavailable in the active view but survived in partial transaction logs. In multiple records, later stored numbers were lower. Instability descriptors disappeared more often than they appeared.
"Could migration do this?" Priya asked.
The auditor nodded. "A badly written transform could. So could a correction template. So could intentional alteration routed through the template. We need service-account history and source code."
Naomi spoke from the screen. "And credential markers may belong to the template author, the last authorized user, the service account, or a copied token. Do not attach a person to initials."
"We won't," Priya said.
She highlighted the structure. It resembled the overwritten scan from Caleb Holt's case: the same ordering of review fields, the same checksum family preserved beneath a later medical image.
Caleb had authorized a narrow comparison of his historical finding for system safety.
His actual diagnosis remained outside the dataset.
"This is the same family," Priya said.
The auditor enlarged the screen. "Related, yes. Same author, no conclusion."
The distinction mattered. Facts could survive pressure only if she resisted making them emotionally satisfying.
Victor joined the afternoon review by committee invitation. He wore no suit coat, an intentional signal that the meeting was technical rather than adversarial.
"The simplest explanation remains software inheritance," he said after the auditor presented the cluster. "Scope should stay limited to remediation."
"The mechanism is not established," Priya replied. "And remediation without provenance could destroy evidence."
"No one proposed destruction."
Naomi's expression did not shift on the screen. "Unlogged cleanup can function as destruction even when called maintenance. Preservation hold remains."
Victor looked toward Priya. "Your department has already generated league attention from one ambiguous marker."
"The APFF review existed before this marker."
"And now a clinical concern associated with a player from whom you recused personally threatens to broaden it."
Priya felt every person in the room register the sentence.
"I cannot identify any player in this dataset," she said. "The recusal is documented. If you believe the firewall failed, specify how."
"Appearances matter."
"Then the appearance will be audited too."
Lena leaned back. "For clarity, analytics cannot identify the subject records either. The query was approved by the privacy officer, and every extraction is logged."
Victor's gaze moved between them. "A narrow software conclusion protects players from unnecessary panic."
Priya kept her voice even. "A true conclusion protects players. Narrowness is not a substitute for truth."
Rhea, joining from the end of the table, approved the next step: preserve source code, obtain service-account history, expand the de-identified comparison within a fixed time range, and maintain the separation from every current individual case.
Victor recorded opposition.
After the meeting, Priya remained in the lab. She had done nothing wrong. Her hands still felt cold.
Lena closed her laptop. "You are allowed to be angry that he used the recusal as a credibility attack."
"Anger does not change the next step."
"It doesn't need to. It can simply be yours."
Priya looked at her friend. Lena had learned, through her own battle with Roman and the club, that professional independence was not a feeling. It was a structure people honored when inconvenient.
"I keep wanting to check whether Theo is following the plan," Priya admitted.
"Can you?"
"No."
"Good firewall."
"I know."
"Do you want me to tell you if I see him?"
"No."
Lena nodded. No admiration. No teasing. "Then I won't."
That evening, Priya drafted a message she would not send.
I hope the independent team feels like care instead of exile. I hope you understand I did not leave you without a doctor. I hope one day you can ask the question again.
She deleted it.
Rohan called while eating cereal for dinner at Meera's house.
"Masi, why do doctors have rules?"
Priya suspected her sister had engineered the question. "Why do bridges have rails?"
"So cars don't fall."
"Rules can do that. They keep people safe when wanting something makes it hard to judge the edge."
"Do you want something?"
Children were ruthless because curiosity had not yet learned manners.
"Yes," Priya said.
"Can you have it?"
"Maybe later. But later has to be free."
"That makes no sense."
"Your mother says that often."
Meera shouted from the background that she could hear both of them.
Priya laughed. When the call ended, she returned to the integrity report and assigned sections instead of keeping all of them.
The auditor owned technical provenance. Naomi owned credential interpretation.
Lena owned de-identified workload context.
The privacy officer owned re-identification and release.
Priya owned medical-system implications within the limits of the data.
She wrote every name beside every responsibility.
Shared authority did not erase accountability.
It made the work less dependent on one frightened person never making a mistake.
Before leaving, Priya asked Lena to remove her own administrator privilege from the analysis workspace.
"You need to edit the medical interpretation," Lena said.
"I need section access, not workspace control. If I can change technical logs, the separation is decorative."
The external auditor approved a role limited to annotation and signed conclusions. Raw files remained read-only. Export required two custodians.
Lena made the change and turned the monitor so Priya could see the permissions update.
"You realize most people ask for more access after a promotion," she said.
"Most people are wrong."
"There she is."
Priya tested one prohibited export. The system denied it and generated an alert to Arun. He messaged within a minute asking whether the attempt was an authorized control test.
She confirmed through the separate channel.
The alert was inconvenient, visible, and exactly correct. A system that quietly trusted her would have been weaker than one willing to question her.
On the drive home, she thought about how love might require the same architecture: not suspicion at every door, but permission clear enough that neither person had to guess whether access existed.