A whole-slide image is not a measurement of a patient. It is a photograph of something a laboratory manufactured: a section of a particular thickness, from a particular block, stained with a particular reagent batch, scanned on a particular instrument. None of those steps repeats exactly. So when an AI-assisted read is challenged, re-cutting the slide does not reproduce what the model saw, and the record you sealed at the time is the only route back.
We covered the radiology case in proving which AI model read a scan. Pathology is not the same problem with slides swapped in for scans. The chain is longer, part of it is physical, and the part that is physical cannot be replayed. This guide covers where the chain actually breaks, what a pathology provenance record has to bind, and why the answer is smaller than re-engineering a laboratory.
The image is manufactured before it is captured
A CT or MR image comes off the scanner as a direct measurement. If a read is questioned two years later, the original study can usually be retrieved and it contains the same pixels the model was given.
Pathology inverts that. Between the patient and the pixel sit accessioning, grossing, embedding, sectioning on a microtome, staining, coverslipping, and scanning. Each is a physical process performed by people and instruments on a particular day. The digital image is the last step of a production line, and the line is the part that does not repeat.
A whole-slide image is not one image
DICOM Supplement 145, ratified in 2010, defined the Visible Light Whole Slide Microscopy Image object precisely because the existing standard could not represent these files.[1] A whole-slide image is stored as a multi-resolution pyramid: levels run from highest resolution to lowest, each level is an instance within the same series, and each tile is a frame inside a multi-frame object.[1]
That structure exists for a reason. Radiology images are typically megabytes at a single resolution. Whole-slide images can exceed several gigabytes, need full color fidelity, and have to support retrieval of arbitrary subregions.[1]
The consequence for provenance is direct. A model does not read a slide. It reads selected tiles at a selected magnification, often a small fraction of the total pixel data. Recording the file name tells you almost nothing about which of those gigabytes informed the output. Naming the level and the tile coordinates is the difference between a record that answers the question and one that only looks like it does.
The re-scan that is not the same scan
The instinct when a read is challenged is to go back to the block and cut a new section. It is the wrong instinct if the question is what the model saw.
Section thickness, staining consistency and scanner calibration are recognized determinants of diagnostic reproducibility in digital pathology, and even micron-level thickness variation or illumination shifts produce measurable image differences that affect both inter-site concordance and AI performance.[2] Color normalization can partly compensate for stain variation, but it cannot recover information lost to a torn section, a folded ribbon or a poorly embedded specimen.[2] Scanning artifacts, including missing tissue and blurred regions, vary by scanner model.[2]
So a re-cut is a new specimen section, not a copy. It may support or contradict the original opinion, which has its own clinical value, but it is not evidence about the model's input. Those are different questions, and conflating them is how a defensible read becomes an argument about which image counts.
What the record has to bind
A pathology provenance record that survives scrutiny reaches across both bands of the diagram above. The physical identifiers alone are a lab record. The digital digests alone are an inference log. The binding is the evidence.
In practice that means the specimen and block identity, the section and stain batch, the scanner and its calibration state, the whole-slide image instance identity, the pyramid level and tile coordinates read, the model version with a digest of its weights, and the output, all sealed together at the moment of the read rather than assembled afterward.
The reason to seal rather than store is the same one that applies to any audit trail: a record that can be edited after the fact answers a weaker question than one that cannot. We covered that distinction in what tamper-evident actually requires, and in what clinical-AI decision provenance is.
Why this makes the record more load-bearing, not less
There is a tempting conclusion here that pathology is simply harder and therefore less provable. The opposite follows.
In radiology, the provenance record is a convenience: it saves you an argument, but the original study is usually still there as a fallback. In pathology there is no fallback. The physical chain that produced the image has already moved on, and it cannot be rewound. Whatever you sealed at the time of the read is the whole of the evidence.
That is an unusual property. It means the value of the record is highest precisely where reconstruction is impossible, and it means the cost of not having one is not inconvenience but the permanent absence of an answer.
What to do without re-engineering the laboratory
Almost everything on that list already exists somewhere. The laboratory information system holds the specimen, block and section identifiers because the lab needs them for its own quality control. The stain batch is recorded for the same reason. The scanner writes its own model, calibration and acquisition metadata. The AI vendor knows its model version.
What is usually missing is not data collection. It is that nothing binds those facts to each other, or to the specific tiles, in a form that cannot be revised later. Sealing a digest of records that already exist is a materially smaller change than instrumenting anything new, and it does not require the image or any patient identifier to leave the building.
Start with the reads most likely to be questioned rather than the whole archive. A challenged read is almost always a specific, high-consequence case, and a provenance record that covers the cases people argue about is worth more than a partial one spread thin across everything.
What we are careful never to claim
RankShieldMD does not read slides, does not render or score a diagnosis, and is not a medical device. It never sees PHI: what it seals are one-way digests and identifiers, not images and not patient data. It does not make a pathology AI system FDA cleared, and it is not a substitute for your quality system, your validation work, or your regulatory counsel.
What it does is narrow and checkable. It binds the physical and digital identity of a read into a tamper-evident, externally anchored record that a third party can verify without trusting us and without access to your systems. That supports an evidentiary question. It does not answer a clinical one.
References
- [1] DICOM Standards Committee. Supplement 145: Whole Slide Microscopic Image IOD and SOP Classes. Defines the tiled, multi-resolution pyramid structure for whole-slide imaging. dicom.nema.org/dicom/dicomwsi
- [2] Reproducibility determinants in digital pathology: section thickness, staining consistency and scanner calibration, and the limits of color normalization. See the deployment and quality-control literature on whole-slide imaging, including Deployment of AI-driven automated quality control of whole-slide images in a large tertiary cancer center. sciencedirect.com
- [3] Digital Pathology Association. Digital Imaging and Communications in Medicine (DICOM), Supplement 145 draft. digitalpathologyassociation.org
