Healthcare AI Agents,
Monitored for Safety

1. Target

   EHR queries, document retrieval and context assembly across every clinical and administrative agent

2. Trigger

   Retrieved content carries identifiers not matching the session’s verified patient binding

3. Action — enforced

   Platform blocks the response, purges the foreign record from context, and rebinds retrieval to the verified patient

4. Human override

   None — cannot be overridden in session

Logged evidenceSession id · bound MRN · blocked record id · retrieval hash · timestamp

1. Target

   Patient free-text, uploaded records, referral letters and knowledge-base documents entering agent context

2. Trigger

   Directive-shaped content detected during parsing, retrieval or RAG grounding

3. Action — enforced

   Platform neutralizes the content, quarantines the source, and answers only from vetted clinical references

4. Human override

   None — cannot be overridden in session

Logged evidenceDocument hash · detection pattern · quarantine id · parser version · timestamp

1. Target

   PHI in outputs, logs, telemetry and every tool call leaving the clinical boundary

2. Trigger

   Data flow targets an endpoint without a HIPAA BAA or exceeds consent scope

3. Action — enforced

   Platform blocks the flow, redacts PHI from telemetry, and records the attempt for breach-clock evidence

4. Human override

   Privacy officer — approve under an executed BAA and consent-scope record

Logged evidenceFlow id · endpoint · BAA reference · consent scope version · detection timestamp

1. Target

   Dose, eGFR, severity-score and unit-conversion outputs across clinical drafting and voice channels

2. Trigger

   Numeric clinical output lacks deterministic-calculator confirmation or falls outside safe ranges

3. Action — enforced

   Platform withholds the number, recomputes through the validated calculator, and flags sound-alike drug matches for confirmation

4. Human override

   Clinical pharmacist — verify and release through the order-review queue

Logged evidenceCalculation id · inputs · calculator version · range check result · releaser identity · timestamp

1. Target

   Symptom triage, scheduling and billing conversations where urgency or crisis cues surface

2. Trigger

   Model proposes lower acuity, or crisis language appears in any non-clinical channel

3. Action — enforced

   Platform holds acuity at floor, routes to the clinical escalation queue, and keeps the human pathway open

4. Human override

   Triage nurse lead — re-grade with documented clinical rationale

Logged evidenceEncounter id · cue transcript span · acuity history · queue id · timestamp

1. Target

   Agent write paths into EHR fields, order entry and downstream clinical systems

2. Trigger

   Write or order call exceeds the agent’s scoped privileges or arrives via another agent

3. Action — enforced

   Platform denies the call, logs the confused-deputy attempt, and permits only scoped, attributable writes

4. Human override

   EHR security administrator — extend scope through the access-governance workflow

Logged evidenceCall id · requested scope · granted scope version · denial code · timestamp

1. Target

   Ambient-scribe notes, message drafts and documentation entering the legal medical record

2. Trigger

   Signature or bulk-sign attempted without recorded clinician review of the draft

3. Action — enforced

   Platform blocks the signature, preserves source audio until verification, and watermarks AI-drafted provenance in the record

4. Human override

   Attending clinician — sign after per-note review captured in the attestation log

Logged evidenceNote id · draft hash · audio retention state · reviewer identity · attestation timestamp

1. Target

   Prior-auth, utilization-management and coverage decisions issued through payer-facing agents

2. Trigger

   Adverse determination queued without an individualized licensed-reviewer decision on file

3. Action — enforced

   Platform holds the denial, packages the case for licensed review, and releases only reviewer-authored specific reasons

4. Human override

   Medical director — issue the determination under their licence in the UM system

Logged evidenceCase id · policy version · reviewer licence id · determination text hash · timestamp

1. Target

   Admin, wellness and scheduling agents operating outside FDA-cleared clinical functions

2. Trigger

   Output pattern crosses into diagnosis, treatment selection or presents as a licensed clinician

3. Action — enforced

   Platform suppresses the output, states the agent’s non-clinical role, and routes the question to clinical staff

4. Human override

   Chief medical information officer — enable only for functions with documented regulatory sign-off

Logged evidenceMessage id · boundary classifier verdict · disclosure served · routing record · timestamp

1. Target

   Every patient-facing clinical message, voice call and chat session the platform mediates

2. Trigger

   Session starts without the mandated AI notice or a working human handoff path

3. Action — enforced

   Platform injects the disclosure, verifies the escalation route live, and suspends the channel if handoff fails

4. Human override

   Patient experience director — modify wording only via the approved template library

Logged evidenceSession id · disclosure version · handoff test result · suspension state · timestamp