The platform

A clinical record is the one dataset that cannot be re-issued

A card can be reissued and a password can be rotated. A person’s medical history cannot be recalled once it is somewhere it should not be, and it stays sensitive for the rest of their life. That asymmetry is what drives the architecture here rather than a hardening checklist added at the end of it.

Talk to us The standard

Four properties

Tenancy, privacy, audit, residency

Each of these is a property of how the software is built rather than a setting an administrator is trusted to find.

Tenancy and scope

A facility is the tenant, and it carries its jurisdiction. Isolation is a property of the data layer rather than a rule that route handlers are trusted to follow, so a new endpoint cannot accidentally be the one that leaks.

Facility and jurisdiction on every clinical row, applied by a shared mixin
Scope enforced as a dependency every clinical request passes through
Cross-facility read, list and search denied where the query is built
Role permissions per clinical role, on top of the facility scope
Multi-tenant means multi-jurisdiction — adapters are selected from the tenant

Privacy and access

The rules that govern clinical data are not a compliance overlay here; they are the access model. Consent, minimum-necessary scoping and break-glass are records in the system rather than policies about it.

Consent lifecycle as a first-class record, withdrawal included
Minimum-necessary scoping on reads, rather than a role that can see everything
Break-glass access that works in an emergency and records who and why
Data-subject rights served from the record rather than assembled by hand
No model credential ever compiled into the browser bundle

Audit and record integrity

Two questions have to have answers at all times: who read this chart, and how did this get into it. Both are recorded when they happen rather than reconstructed afterwards.

An immutable audit log covering reads, writes and exports with actor and time
Sign-off recorded against a named clinician, with what they were shown
Agent drafts held outside the record, so provenance is structural rather than annotated
Every agent invocation ledgered with tokens, latency and cost
Retention that deletes the stored object as well as the database row

Residency

Where inference happens is a deployment decision here, not a routing decision made by whichever provider is cheapest this quarter.

Model inference deployed per jurisdiction
If the data cannot leave a region, the model comes to the region
Telehealth provider selected by jurisdiction, so a consultation stays in-country
A residency commitment that does not depend on a vendor’s routing table

Untrusted input

Everything arriving from outside is treated as hostile

A hospital platform ingests scanned documents, imaging headers, referral payloads and payer responses. All of it was produced by systems you do not control, and some of it by people who are not your patients.

Document ingestion is bounded and validated before anything is parsed — a malformed or oversized upload is rejected at the edge rather than after it is read into memory.
Parsers are configured against external-entity resolution and the configuration is tested rather than assumed.
Inbound referral and payer payloads are validated against the profile before they touch a clinical resource, so a bad upstream record is a loud failure rather than a quiet corruption.
Identifiers, contact details and clinical content are kept out of log storage — redaction happens on the way in, not as a cleanup after somebody finds one.

Assurance

The checks that run against this platform

The authorisation matrix, exercised programmatically
Every role against every resource against every action, run as a test rather than reviewed from memory. A gap in that matrix is a build failure.
Red-teaming the sign-off boundary
The most valuable adversarial test in this product is not on the network. It is a suite that tries to get an agent artifact into the clinical record without a signature, and to make a Tier-B action irreversible — and it is a governance agent’s standing job to keep trying.
A cross-agent evaluation harness
The roster is evaluated together rather than each agent alone, because the failure worth catching is a handoff between two of them where the tier changed and nobody noticed.
A security risk assessment, and dependency scanning that blocks
The risk assessment is a document with findings and owners rather than a certificate, and the dependency scan is a gate on the build rather than a report somebody reads later.

Proof is an artifact, not a checkmark

Nothing here counts as working because a test went green. It counts when it produces something a person can open: a rejected draft that is provably absent from an assembled record, a cross-facility request that came back empty, an audit row naming who opened a chart at 03:00 and why, an interaction the engine blocked with the rule it blocked on, a bulk export a receiving system actually read. Anything short of that is a claim about the software rather than a demonstration of it.

Run your security review at it

Hospitals ask harder questions than almost anybody, and they ask them before a pilot rather than after. If something here would not survive your own review, say which part.

Talk to us Dual jurisdiction

Get in touch

Talk to the people building it

No chatbot and no ticket queue. Tell us what your hospital or practice actually looks like — how many beds, which departments, what the doctors are doing twice, what your billing team keeps chasing — and someone who works on the software will reply.

info@legosphere.com