The data was locked in a vault. Subsalt found a way to share it without opening the door.

At UT Southwestern Medical Center, some of the most promising research ideas didn't die for lack of talent or funding. They stalled in a queue. A PhD candidate or a Health Informatics student with a hypothesis about patient outcomes could wait weeks — often months — for the clinical data to test it. By the time the dataset cleared HIPAA review, IRB negotiation, and the gauntlet of restricted computing environments, the momentum was gone.

That waiting room was the problem a small US healthcare startup named Subsalt set out to empty. Its answer wasn't to loosen the rules that protect patients. It was to make those rules almost irrelevant — by generating data that behaves exactly like the real thing while containing no real patient at all.

A vault with a very slow door

Clinical data is among the most valuable and most tightly guarded information on earth. Every record carries the weight of a real person's privacy, and rightly so. But the machinery built to protect that privacy — de-identification pipelines that were slow, manual, and restrictive — had become its own kind of bottleneck.

UTSW wanted to hand its students real clinical data to learn on. The institution knew that the next generation of clinical researchers can't be trained on toy datasets. Yet every path to real data ran through the same congestion: compliance reviews, board approvals, and locked-down environments that could take a semester to clear.

Real enough to learn from, safe enough to share

Subsalt built a HIPAA-compliant synthetic data sandbox on Microsoft Azure. The platform generates statistically faithful, privacy-preserving datasets — data that preserves the patterns, distributions, and relationships researchers rely on, without exposing an actual medical record. Because the data is synthetic, it can be shared broadly and quickly, sidestepping the delays that made real data so hard to reach.

Under the hood, the sandbox runs on Azure Kubernetes Service and integrates with Microsoft Fabric, with Azure Storage, Azure Data Factory, and Microsoft Entra ID handling data pipelines and identity. The engineering goal was deceptively simple: keep the sensitive source data still, and let secure access travel instead.

Months to days, and a 50X leap

The impact showed up first in the calendar. Data access that once took months collapsed to a matter of days. Freed from the waiting room, researchers reported accelerating clinical research outcomes by up to 50X — not a marginal efficiency gain, but a change in what's possible within a single project's lifespan.

Just as important as speed was what didn't happen. There was no sprawl of duplicated datasets copied from environment to environment, each copy a fresh privacy liability. By minimizing data movement and duplication risk, Subsalt widened the circle of who could work with high-value health data while keeping HIPAA and internal compliance guaranteed rather than negotiated.

A startup with a giant behind it

Solving a hard technical problem is one thing; getting it into the hands of major medical institutions is another. Subsalt scaled its go-to-market through the Microsoft for Startups Pegasus Program, which layered co-sell resources, Azure Marketplace support, and strategic account introductions on top of the cloud infrastructure. The program put Subsalt in front of the industry at events like HIMSS and JPMorgan's healthcare conference, backed by dedicated partner success management.

For a company of fewer than fifty people, that combination — technical infrastructure, go-to-market muscle, and a program designed for excellence — is the difference between a clever prototype and a platform that a medical center will trust with its most sensitive workflows.

The quiet revolution: privacy that says yes

The lesson of the Subsalt story isn't that healthcare needs more data. It already sits on mountains of it. The lesson is that the future belongs to faster, safer access to the data we already have. For decades, protecting the patient and unlocking the data have been treated as opposites, a trade-off to be endlessly renegotiated. Subsalt's synthetic sandbox reframes that trade-off as a settled question.

At UT Southwestern, that reframing means a student with an idea on Monday can be testing it on Friday — with data real enough to teach on, and safe enough to share. The vault is still locked. Subsalt just built a window.