Safe Scribe: Proving Who Saw What

Safe Scribe took overall second place at The AI Conference Hack Day 2026. The build took one day. The team was two people, Erik Jones and Jaiven Spence, TrustEdge AI / Jacobian Engineering. Crusoe sponsored the prize of $3,000.

The agents argue before they commit, and the system can prove who saw what. The design goal is that nothing identifiable leaves the room. The deterministic identifier gate checks five categories (name, date of birth, record number, phone, and address) of the eighteen in HIPAA's Safe Harbor list, so other identifiers could remain. On the synthetic demo, the access-lineage graph showed only Desk, Scribe, and Critic touched identifier fields.

The event was September 29, 2026, at Pier 48 Shed B in San Francisco. Safe Scribe is a scribe for spoken clinical handoffs. Every patient in it is synthetic. It is not a system a hospital can turn on.

The problem

Nurses and doctors hand patients off by talking. The project's example: "Mr. Callahan, born in fifty-two, is on a blood thinner and just started an antibiotic that interacts with it; someone should call his daughter about discharge." A follow-up with no owner does not happen. A detail that was only spoken gets misremembered. Writing the handoff down takes time the unit does not have.

Hospitals want an AI scribe for that conversation. Compliance says no twice. The audio and the patient's identity would go to a cloud AI company. Afterward, nobody can prove which systems saw the name, the date of birth, or the record number. "Trust us" is not an answer an auditor accepts.

How it works

The recording is transcribed on the laptop with faster-whisper. Zero bytes of audio leave the machine. Only text enters a Band case room. The room has four members: Desk, Scribe, Critic, and the human charge nurse. Membership is enforced by the room, not by convention.

Scribe, on Crusoe Managed Inference, extracts a structured brief. Every item carries a verbatim quote from the transcript. The patient is referred to by a pseudonymous id generated locally. Critic runs on a different model family, also on Crusoe, so it does not share Scribe's blind spots. In the build that ran, Scribe used zai-org/GLM-5.3. Desk and Critic used Qwen/Qwen3.8-27B.

Critic vetoes a quote that is not in the transcript, a follow-up with no owner, and a patient identifier the gate finds in the outbound brief. Deterministic code checks do that identifier work. The model cannot override them. The gate in this build checks five of the eighteen categories in HIPAA's Safe Harbor list: name, date of birth, record number, phone, and address. Other identifiers could remain.

The unowned follow-up is not guessed. Critic asks the room. The nurse types "I'll own it", and that message is the provenance. Critic then approves an exact revision of the brief, by digest.

Only then is a second, approved room created. It holds Critic, Grapher, and the nurse, and it never holds the transcript. Grapher writes the pseudonymous brief to Neo4j with an access manifest: an (Agent)-[:ACCESSED]->(Field) edge for each identifier field an agent touched.

Which agents touched identifier fields? On synthetic case 19ecdb31, the access-lineage graph showed only Desk, Scribe, and Critic. Nothing downstream of them is on those edges. A Crusoe model writes the three-sentence statement a privacy officer reads, from agent names, field names, and counts only. Both that statement and the lineage answer are MCP tools in the DuploCloud studio, called under human approval.

Why it matters to TrustEdge

Safe Scribe is our thesis in miniature.

Reachable is not authorized. A tool another agent can reach is not a tool it is allowed to call, and the DuploCloud tools are called under human approval. Least privilege applies to the agents themselves: three see the transcript. The design goal is that nothing downstream sees identifiers. The gate checks five of the eighteen HIPAA Safe Harbor categories, so other identifiers could remain. On the synthetic demo, the access-lineage graph showed only Desk, Scribe, and Critic touched identifier fields. Room membership is an enforced boundary. The lineage graph replaces "trust us" with an answer that can be read back: which agent touched which field. A named human owns every decision the model is not allowed to guess. The nurse who types "I'll own it" is the owner of record.

That separation is what we design for AI agents and AI governance in healthcare. A draft is not a commitment.

What a real deployment still needs

Every patient in the repository is synthetic. That is the only reason this was acceptable to run. No business associate agreement is in place with any vendor. Crusoe's self-serve terms exclude HIPAA-regulated data, and Band's terms are silent on it.

The brief that leaves the case room uses a pseudonym in place of a name. It still ties clinical content to that pseudonym, and that is still protected health information. The identifier gate covers 5 of the 18 categories on HIPAA's Safe Harbor list, so other identifiers could remain. Extending the detector and the lineage field vocabulary, and adding a human review for anything the model removes, has not been done.

A real deployment needs a business associate agreement, or a hospital-controlled substitute, for every component that receives the transcript or the pseudonymous brief. That set is Scribe, Critic, Desk, Grapher, the Band rooms, and the Neo4j store. Only components that receive drug names, or lineage metadata alone, can stay on a public serverless service unchanged. The hospital chooses where the room and the models run. The inference endpoint is one configuration value.

The team keeps a list of words it does not use: "HIPAA compliant", "de-identified", and "enclave". Those words are not a description of Safe Scribe.

How it was built

Two humans and three agent sessions, in about six hours. Every task was an issue. Every change was a pull request, reviewed locally by an independent AI reviewer, Astra via the Codex CLI, before merge. Forty-nine pull requests merged that day. The test suite was green at code freeze: 140 unittest cases and 44 pytest cases, with two live tests skipped.

Crusoe Managed Inference ran every agent's model calls and wrote the compliance narrative; if it is unavailable, the case pauses instead of going to another provider. Band provided the rooms and the door policy, so a veto and the nurse's reply are messages in the room. Neo4j Aura stored pseudonymous memory across encounters and the access-lineage graph. DuploCloud registered the lineage answer and the privacy-officer statement as MCP tools in the studio, called under human approval. Brave Search attached one sourced fact per drug named in the handoff (warfarin, ciprofloxacin, and enoxaparin) for Critic to verify by URL, and the research agent never saw the patient. Similarweb supplied a legitimacy fact for a referral organization spoken in a visit; sunrisehomehealth.com came back unranked, at about 890 visits a month, and flagged for a human. Nebius and Vultr were attempted and not integrated: the Nebius credentials issued were for object storage, not inference, and Vultr had a compose file and no host.

What comes next

The production shape is written down and not running. DuploCloud would provision and manage the deployment, its HIPAA control set applied to that infrastructure, in the hospital's cloud account or on Crusoe Cloud compute. Agents that see the transcript or the pseudonymous brief would call a dedicated Crusoe endpoint under a signed agreement, or open models on hospital-controlled GPUs. Band would move to an enterprise agreement or a hospital-run room service. Neo4j Aura would move to a signed business associate agreement, or be self-managed. Closer, still a stub, should draft the discharge follow-up from the pseudonymous brief in the approved room, under the same roster checks as Grapher.

Still ahead: human-acted recordings instead of the synthetic fixtures; research recruitment on by default, including the Similarweb check, once its retry path has a live run; a second Band account for the approved room, to show a cross-tenant boundary; and running one synthetic encounter before the next so the second merges onto the same pseudonymous patient.

Erik Jones and Jaiven Spence accepting second place overall and the $3,000 Crusoe prize, with the Crusoe team, at The AI Conference Hack Day in San Francisco.

Thank you to the organizers of The AI Conference Hack Day, and to Crusoe for sponsoring the prize. Jaiven Spence built Safe Scribe with Erik Jones. The code is in the public repository. The recorded demo is on the HackerSquad project page.

If you want to talk about agents in healthcare, talk to TrustEdge.