Blog
Field notes on clinical documents, health data standards, and building AI that a compliance officer can audit. Written for the engineers and compliance teams who have to make both work at once.
The first eval run scored 23 of 40. Twelve misses were the same question, and eleven of them traced to the de-identifier replacing 'daily' with a date token. The fix, three more Presidio gaps, and the tokens-by-entity count that gave it away.
The metric checked whether each injected identifier survived whole. An address is four things and only the city was ever tokenized. A strict per-component metric, an address recognizer, and why overlapping spans must merge into their union.
Five correct answers rejected, all the same question. '9.0% [7].' scored 0.0 and '9.0%. [7]' scored 1.0. Escalation re-ran the same model at 8x the cost, and the judge's calls were half the traffic and never metered.
Five tables carried a tenant-isolation policy and none of it applied, because both services connected as the database owner. The app role, the audit_log grant that defeated append-only, and the cross-tenant probes.
ICD, MRN, CPT, SOAP, EHR, HL7, HIPAA, PHI, Safe Harbor, BAA, NPI, HITECH, FHIR, ICD-10-CM. A field guide to the fourteen acronyms that shape every healthcare integration, in the order they were invented.
More is on the way. Subscribe by RSS, or tell me what you want written about.