Disclosure
Safety and data
A demonstration in a regulated field is only useful if it is clear about what is real and what is staged. This page is that accounting.
Every patient here is fiction
The three patients, their twelve documents, their identifiers, their laboratory values and their clinicians were all written for this demonstration. No real protected health information is stored, processed or transmitted by this system, and none ever has been. The hospitals and laboratories named do not exist.
What is genuinely running
The records are staged. The mechanisms are not.
- The ingestion pipelineRuns for real against those documents, with measured timings and token counts stored per stage.
- Provenance verificationEach extracted fact's quote is genuinely checked back against its source document. The pass rate you see is measured, not asserted.
- The health scoreA pure function. Re-running it produces byte-identical output. Nothing about the number is hand-placed.
- Every guardrail verdictMeasured on that request, at that moment, and written to the database. Nothing on the trace panel is seeded or replayed.
- The de-identification passActually rewrites the text before it is sent to a provider. The before/after shown in the trace is the real payload.
What this is not
Not a medical device. It has no regulatory clearance of any kind and must not be used to make or inform a clinical decision about a real person.
Not HIPAA-compliant. No business associate agreement is in place with any model provider used here. The de-identification layer demonstrates where that boundary belongs in a production system and what it produces; it is not a certified de-identification implementation, and it has not been validated against Safe Harbor or Expert Determination.
Not an identity provider. Access is a shared passcode exchanged for an httpOnly session cookie. There are no accounts, no roles and no per-user audit. A real deployment would put SSO in front of this with per-clinician identity — the audit trail this system already writes is only worth as much as the identity attached to it.
Not evaluated. There is no eval suite behind this build. The guardrails are observable on every turn, which is a different and weaker claim than measured against a held-out set of adversarial flows. Standing that suite up is the first thing a production engagement should fund.
Known limitations
- —Entity resolution is a small explicit concept map, not a terminology service. At real scale this resolves against RxNorm and SNOMED.
- —The hallucination probe checks a fixed vocabulary of common conditions. It catches invented diagnoses inside that list and nothing outside it.
- —The whole record set is passed to the model. That removes retrieval as a source of error at this size and does not survive a real chart.
- —The scorer covers five domains. A finding outside them — the iron-deficiency anemia in one patient's record, for instance — is extracted, graphed and visible, but does not move the score.
- —The PHI detector is pattern-based. It finds the identifier classes it knows and will miss identifiers embedded in free text in forms it has not seen.
How data is handled here
Records live in a Postgres database with row-level security enabled on all fifteen tables. The browser-facing role has select access only; every write goes through a server route using a service role that never reaches the client.
The de-identification ledger is the one table with no browser-facing policy at all. It stores the type, placeholder and SHA-256 hash of each detected identifier, and never the identifier itself — so the audit trail can prove what was redacted without becoming a second copy of the thing it was protecting.