Regulatory and Compliance Framework
Built for US provider support with clear promotional/scientific separation and HIPAA-aligned controls.
Core Controls
Operational governance and technical safeguards.
Identity & Access
NPI registration, HCP verification, RBAC, mandatory MFA
Privacy
HIPAA-aligned handling, PHI minimization, BAA workflow support
Security
Encryption at rest/in transit, SOC 2 Type II hosting, threat monitoring
MLR
Version control, expirations, label-change alerts, approval logging
AI Governance
Model versioning, prompt logging, red-team testing, hallucination monitoring
Scope Boundary Controls
Scope governance is maintained as a dedicated model.
Risk Register
Key risks and mitigations carried into ongoing governance review.
Off-label AI responses
RAG + refusal logic + Medical Info escalation
PHI breach
Encryption, access controls, and immutable audit logs
Regulatory classification drift
Ongoing SaMD boundary review
Low provider adoption
Workflow integration and admin automation
Provider mistrust of AI
Citations, confidence, and human handoff