Control panel

The System Administrator's seat. Everything on the platform can be controlled from here — the live model, the outbound feeds, the import hold, the integrity checks — and none of it quietly: full control is not exemption, and every switch thrown on this page lands on the audit trail under your name.

170.5 MB

Data Store size — encrypted holdings

audit events on the hash chain

intact

audit chain, verified live on this page load (2 events)

Models

Every model on the platform, each with its own management panel. Enablement, grounding, guardrails and usage are managed here; every switch is an audited event.

PHI RAG retrieval-tuned LLM ENABLED

Purpose: The PHI AI assistant — answers questions from the Data Store with citations, under the reader's role and purpose.
Grounding: Live retrieval over the Data Store (33,311 patients) through 8 role-scoped tools; never a raw database connection.
Guardrails: Minimum-necessary confirmation before sweeps · sensitive withholding with counts · the counts-never-lists rule · cites every source · never asserts absence from unread documents.
Runs on: The foundation model you bring (this demo: Claude Sonnet 5, panel at right)
Usage: 0 questions · 0 audited record reads · 0 psychotherapy events

Disabled = the assistant refuses to read the Data Store at all and says so; it never answers about records from memory.

Claude Sonnet 5 foundation model — demo default ON

Purpose: The language model PHI RAG runs on: reads retrieved excerpts, writes the drafted answer.
Provider: Anthropic API — the demo's model, not a requirement: a deployment brings its own LLM, registered below, under its own BAA with its AI provider.
Active model: claude-sonnet-5 (default)
Credential: API key configured (held server-side, never in the page)
Parameters: temperature 0 · bounded output · 6-turn context tail
Data terms: Receives only gate-approved excerpts per question; not used for model training under the organization's agreement.

Off = no request ever leaves for the model; the scripted fallback answers and says why. Questions audited either way.

Scripted fallback deterministic responder ALWAYS ON

Purpose: Answers from fixed logic when live model calls are off or unavailable, so the assistant degrades to something honest rather than to silence.
Grounding: Same role-scoped queries, no generative text.
Guardrails: Inherits every gate; states plainly that it is the fallback.

No switch — the fallback cannot be disabled. A platform whose failure mode is silence has a worse failure mode.

Model registry — every model, any kind

Every model the platform runs, in one inventory: the language models behind the assistant and the predictive, classification, optimization and mapping models behind the other capabilities. Bring your own: register any model against the capability slot it serves — an LLM by provider and model ID, or any other model by its TLS inference endpoint. Registration is inventory (mirroring Registry & preflight), enablement is a decision, and activation binds the model to its slot. Every step is audited.

Model	Kind	Slot	Provider / endpoint	Model ID · version	Status	Actions
PHI RAG The clinical assistant - retrieval over the Data Store through role-scoped tools, cited answers under the reader's role and purpose.	retrieval	assistant	built-in	— · v1	enabled	Edit built-in
Claude Sonnet 5 The language model PHI RAG runs on: reads gate-released excerpts, writes the drafted answer.	foundation	assistant	Anthropic API	claude-sonnet-5 · v1 ACTIVE	enabled	Edit built-in
Scripted fallback Answers from fixed logic when live model calls are off or unavailable.	deterministic	assistant	built-in	— · v1	enabled	Edit built-in
No-show risk model Predicts missed appointments so outreach goes where it helps. Subject to the fairness screen: subgroup calibration is published, and the permitted intervention is support, never denial of scheduling.	predictive	noshow	built-in	noshow-grad-boost · v2.1 ACTIVE	enabled	Edit built-in
Sensitivity classifier Classifies every incoming condition, medication and document into the sensitive categories (Part 2 SUD, mental health, reproductive, HIV, genetic) at the ingestion door.	classifier	segmentation	built-in	sens-classify · v1.4 ACTIVE	enabled	Edit built-in
Scheduling optimizer Template and capacity optimization under hard fairness constraints - overbooking burden may not concentrate on protected groups.	optimization	scheduling	built-in	sched-opt · v1.2 ACTIVE	enabled	Edit built-in
Terminology mapper Maps source-system codes to standard terminologies; low-confidence mappings queue for human review rather than being silently accepted.	mapper	ingest	built-in	term-map · v3.0 ACTIVE	enabled	Edit built-in
Denial risk model Scores every claim for denial risk before submission, from the payer and service-line adjudication history in the Data Store. Advisory only; factors cited.	predictive	claims	built-in	denial-risk · v1.0 ACTIVE	enabled	Edit built-in
Prior auth evidence assembler Retrieves the chart evidence for each payer criterion and drafts appeal letters into the signature queue. Gaps stated as gaps, never inferred.	retrieval	priorauth	built-in	pa-evidence · v1.0 ACTIVE	enabled	Edit built-in
Coding integrity model Reads charts against coded claims both ways: codes without documentation, and documented conditions never coded. Drafts clinician queries; never changes a code or note.	classifier	coding	built-in	coding-integrity · v1.0 ACTIVE	enabled	Edit built-in
ROI requirements validator Validates every release request against the configured jurisdiction requirements before release. Can block, never approve; unconfigured jurisdictions fail closed.	classifier	roi	built-in	roi-validator · v1.0 ACTIVE	enabled	Edit built-in
Ambient listener — faster-whisper Speech-to-text for ambient documentation. Runs inside the deployment: audio never leaves the account, no vendor BAA exists because no vendor touches the audio. Consent-gated per jurisdiction before any capture.	custom	ambient	Self-hosted (MIT)	small.en int8 · v1.2 ACTIVE	enabled	Edit built-in
Inbox triage ranker Ranks the clinical inbox — abnormal results, documents, unsigned drafts — by urgency. Reorders, never removes: triage that hides items is a safety incident.	deterministic	triage	Built-in	urgency-rank v1 · v1.0 ACTIVE	enabled	Edit built-in
ROI requirements validator Validates every release request against the configured jurisdiction requirements before release. Can block, never approve; unconfigured jurisdictions fail closed.	classifier	roi	built-in	roi-validator · v1.0 ACTIVE	enabled	Edit built-in
Ambient listener — faster-whisper Speech-to-text for ambient documentation. Runs inside the deployment: audio never leaves the account, no vendor BAA exists because no vendor touches the audio. Consent-gated per jurisdiction before any capture.	custom	ambient	Self-hosted (MIT)	small.en int8 · v1.2 ACTIVE	enabled	Edit built-in
Inbox triage ranker Ranks the clinical inbox — abnormal results, documents, unsigned drafts — by urgency. Reorders, never removes: triage that hides items is a safety incident.	deterministic	triage	Built-in	urgency-rank v1 · v1.0 ACTIVE	enabled	Edit built-in
Imaging read assistant Reads representative frames of an imaging series in the viewer - a genuine vision inference over the pixels - and drafts a structured report with measurements from the acquisition scale. Drafts land in the signature queue. Demo reads run over synthetic phantom frames and say so.	vision	imaging	Anthropic (your BAA)	claude-sonnet-5 · v1.0 ACTIVE	enabled	Edit
Patient instructions writer Writes plain-language patient instructions from chart facts; paired no-new-assertions checker gates release (SPEC 5.3).	llm.generative	instructions	organization-managed	byom-instructions-writer · v1.0	enabled	Edit
Ingest QA reviewer Reads the deterministic ingest QA sweep and argues mapping-pipeline root causes and fix order (SPEC 5.13).	llm.analytic	ingestqa	organization-managed	byom-ingestqa-reviewer · v1.0	enabled	Edit

Register a new model — bring your own

A new model registers as registered (inventory only) — enable it, then activate it into its slot, each an audited decision. Endpoints must be HTTPS; anything else is rejected. The assistant slot is live-wired to the active foundation model; the other slots bind the platform's capability screens, and the fairness screen applies to any predictive model before it serves patients. A model that cannot actually answer fails loudly with the error stated — the platform never silently falls back to a model you did not choose.

EMR integrations

The two connection sides, controllable from the seat that answers for them. Pausing refuses loudly — runs land in the managers' histories as refused with the pause named, imports refuse with an audited event, and nothing queues silently. Resuming is the same audited act in reverse.

Source EMR — ingestion ACTIVE

Epic · bulk runs · streaming intake · per-patient imports

Audit this integration Configure

Every pause and resume writes system.integration_* under your name.

Target EMR — delivery ACTIVE

Epic · bulk delivery · outbound feeds · write-back

Audit this integration Configure

Every pause and resume writes system.integration_* under your name.

Live controls

Control	State	Action	What it does
Bulk import — 24-hour vendor hold	clear	nothing to release	An administrative override of the rate-limit window so a kickoff is permitted now. Recorded as system.hold_released — an override that leaves no trace is a vulnerability, not a feature.
Outbound feed — ADT notifications (CMS Condition of Participation)	healthy		Pausing stops delivery without losing the feed's place.
Outbound feed — Results to patient portal	healthy		Pausing stops delivery without losing the feed's place.
Outbound feed — Claims 837 submissions	held	held by destination — retries itself	Pausing stops delivery without losing the feed's place.
Outbound feed — Quality-measure submission (eCQM)	healthy		Pausing stops delivery without losing the feed's place.
Outbound feed — Event notifications to researchers	paused		Paused accumulates sequence; resuming delivers from the checkpoint, nothing skipped.

Users & roles

Every profile on the platform and exactly what each one can reach. The System Administrator's * is the only wildcard — everyone else holds an enumerated, minimum-necessary list. This matrix is the enforcement view, not the authority: users and role assignments are governed by your organization's identity source of truth (IdP / directory); the platform enforces what that source asserts.

User	Profile	Roles	Permissions
b.crumpler	Becky Crumpler, MD Clinician — chart in context	Clinician	patient:search · patient:read · imaging:read · assistant:use · ambient:capture
r.okafor	Rose Okafor, RHIA HIM — records & audit	Health Information Management, Auditor	patient:search · patient:read · imaging:read · roi:manage · claims:read · analytics:query · assistant:use · integration:view · integration:export · sensitivity:view · report:read · ingest:write · audit:read
l.isaac	Levi Isaac, MBA Analyst — de-identified plane	Analyst	analytics:query · report:read · sensitivity:view · assistant:use
c.jung	Dr. Carla Jung Psychotherapist — behavioral health	Clinician, Psychotherapy	patient:search · patient:read · imaging:read · assistant:use · ambient:capture · psychotherapy:read
s.reyes	Sofia Reyes, MBA Operations & governance	Administrator, Auditor, Disposition	assistant:use · analytics:query · audit:read · integration:view · integration:export · report:read · admin:config · retention:read
r.gomez	Ryan Gomez System Administrator — full control	System Administrator	*
m.gomez	Mateo Gomez, RHIA Health information management — records custody alone	Health Information Management	patient:search · patient:read · imaging:read · roi:manage · claims:read · analytics:query · assistant:use · integration:view · integration:export · sensitivity:view · report:read · ingest:write
v.gomez	Valentina Gomez Auditor — the trail, and no clinical record at all	Auditor	audit:read · report:read · assistant:use
c.gomez	Camila Gomez, PhD Researcher — record-level work under IRB approval	Researcher	patient:search · patient:read · analytics:query · report:read · sensitivity:view · assistant:use
n.gomez	Nikolai Gomez, LCSW Psychotherapy only — no ordinary chart access	Psychotherapy	psychotherapy:read · assistant:use
d.gomez	Diego Gomez Administrator — configures the platform, reads no chart	Administrator	assistant:use · analytics:query · audit:read · integration:view · integration:export · report:read · admin:config
y.gomez	Yelena Gomez Disposition — retention decisions and nothing else	Disposition	retention:read · audit:read · report:read · assistant:use

Platform configuration — everything configurable, editable here

Every runtime setting the software has, in one place. Saving validates each value (vendors against the supported list, numbers against their bounds) and writes config.changed naming every key that actually changed.

Setting	Value	Constraint
EMR connections (also on Source & target EMRs)
Source vendor source_vendor		supported vendors only
Source FHIR base URL source_base_url		free text
Source client ID source_client_id		free text
Source group FHIR ID source_group_id		free text
Target vendor target_vendor		supported vendors only
Target FHIR base URL target_base_url		free text
Target client ID target_client_id		free text
Assistant
Answer length limit assistant_max_tokens		256–4096 tokens
Active assistant model assistant_model	claude-sonnet-5	set via the model registry above
Retrieval switch / live-calls switch rag_enabled · assistant_live	on · on	set via the model panels above
Suggested-prompt examples
Example patient (short name) example_patient		must name a real patient
Example patient (full name) example_patient_full		must name a real patient
Example patient MRN example_patient_mrn		must name a real patient
Example claims patient example_claims_patient		must name a real patient

Only changed keys are written and audited; unchanged values are left untouched.

The full holdings inventory and integrity checks live on the Data Store page.

Recent administrative actions

When	Actor	Action	Object
No administrative actions yet.