Provable Agent Access for Clinical AI

Executive Summary

Hospitals want an AI scribe for the spoken handoff between clinicians. Compliance refuses on two grounds. The audio and the patient's identity would leave the building for a cloud model. Afterward, nobody can show which system saw the name, the date of birth, or the record number. "Trust us" is not a record an auditor can examine.

Safe Scribe is a one-day prototype, built at The AI Conference Hack Day 2026, that treats both objections as architecture. Placement is chosen: the hospital picks where the room and the models run, and the inference endpoint is one configuration value. Exposure is minimized: audio never moves, and room membership is the boundary. The design goal is that only three agents see identifiers. The deterministic identifier gate checks five categories (name, date of birth, record number, phone, and address) of the eighteen in HIPAA's Safe Harbor list, so other identifiers could remain. In the synthetic demo, the access-lineage graph showed only Desk, Scribe, and Critic touched identifier fields. Access is provable: a graph records which agent touched which identifier field, and a separate model turns that record into the short statement a privacy officer reads.

It is written for CISOs, privacy officers, clinical informatics leads, and compliance leads who have to decide whether a scribe design is worth a pilot.

This paper is not legal advice, and it is not a determination that any deployment satisfies HIPAA or any other regime. Every patient in the prototype is synthetic. That is the only reason the architecture was run on public AI services. No business associate agreement was in place with any vendor.

The Problem: Handoffs, Auditors, and Agents

Clinicians hand patients off by talking. The project's illustration is the sentence that gets said: a patient named in the room, a birth year, a blood thinner, a new antibiotic that interacts with it, and someone who should call a family member about discharge. Follow-ups with no owner do not happen. Details are misremembered. Writing it down takes time nobody has. A scribe answers the time problem and opens two compliance problems.

The first is egress. A handoff recording is identifiers plus clinical content. Sending the audio, or a transcript that still carries the name, puts that material in a vendor's infrastructure under that vendor's terms. Whether the terms are acceptable is a contract question. Whether the audio had to move is a design question.

The second is proof after the fact. An auditor asks which systems saw the name, the date of birth, and the record number. A letter that says the model is careful is not a record of access. "Trust us" fails because the audit asks for an artifact and receives a reputation.

Agents make that failure the default. An agent uses whatever it can reach. If the transcript is in the context of a research step, a graph write, or a narrative, that step conditions on the identifiers, because that is what a model does with text it is given. "Do not look at the name" is a convention. The boundary has to be that the transcript is not in the room. The same defect is already in the handoff itself: an action with nobody's name on it. An agent that fills the owner blank, because a complete brief has one, has manufactured provenance. The design has to refuse that help.

Design Principles

Seven rules follow. Each is a place the model is not trusted to police itself.

Reachable is not authorized. An authenticated agent that is "part of the product" still has no business reading this encounter unless it is on the roster. The runtime creates rooms. Agents do not. An unexpected participant raises.

Room membership is the boundary. The case room holds the transcript and four members: Desk, Scribe, Critic, and the charge nurse. The approved room is created only after a digest-matched approval, and it never holds the transcript. Downstream work happens there or not at all.

Generator and critic are separated by duty and by model family. Scribe extracts the brief. Critic reviews it on a different model family, so it does not share Scribe's blind spots. Both run on Crusoe. Critic vetoes a quote that is not in the transcript, a follow-up with no owner, and a patient identifier the gate finds in the outbound brief. The gate checks five of the eighteen HIPAA Safe Harbor categories, so other identifiers could remain.

Deterministic checks cannot be overridden. The identifier gate is code plus model judgment. A hit is a veto the model cannot talk past. If Crusoe is unavailable, the case pauses and does not route elsewhere. If the live path has no Neo4j configuration, it raises, rather than falling back to a memory store that would look like success and leave no record.

A named human owns every consequential decision, and that message is the provenance. Ownership is never inferred. Critic asks the room. The nurse types an explicit acceptance — in the live case, "I'll own it" — and that message is the provenance. A plausible name is not promoted into an accountable one.

Approval is by digest. Critic approves one revision, matched by digest, and only then is the approved room created. A later edit is a different object and does not inherit the approval.

Minimize who sees identifiers. Audio is transcribed on the laptop and does not leave it. Desk, Scribe, and Critic are the three agents that see the transcript. Grapher receives a pseudonymous brief, clinical content tied to a pseudonym. Keeping identifiers out of that brief is the design goal. The gate checks five of the eighteen HIPAA Safe Harbor categories, so other identifiers could remain. The pseudonymous brief is still PHI until formally de-identified. Research and the compliance narrative receive drug names only, or lineage metadata only. Minimum necessary is which room a component may enter.

Reference Architecture

The path the project records as live is synthetic case 19ecdb31.

Transcription is faster-whisper on the laptop. Text, not audio, enters the Band case room. Scribe's brief quotes the transcript verbatim. The patient id is generated locally, with a local salt, and later encounters merge on that id only. They do not merge because two handoffs look alike. Critic approves one revision by digest. The approved room — staffed, in the project summary, with Critic, Grapher, and the nurse — does not receive the transcript. Grapher writes the brief to Neo4j together with edges of the form (Agent)-[:ACCESSED]->(Field): which agent touched which identifier field, with the source message id. The edge is the processing fact, not a copy of the value.

Asked live, which agents touched identifier fields? In the synthetic demo, the access-lineage graph showed only Desk, Scribe, and Critic. Nothing downstream of them is on those edges. A Crusoe model turns those agent names, field names, and counts into the three-sentence statement a privacy officer reads. The query and the narrative are both MCP tools in the DuploCloud studio, called under human approval. The narrative tool is not on the auto-approve list, so the studio prompts. The manifest records that a runtime was given a field. It does not measure attention, and it is not a read receipt.

Drug facts and referral checks stay out of the case room. Brave supplies one public URL per named drug — warfarin, ciprofloxacin, and enoxaparin in the live scenario — for Critic to verify. The research agent does not see the patient. Similarweb receives one spoken domain, because a referral to a moribund or fake provider is a safety problem and a fraud vector, and returns rank and visit count for a human. Crusoe is the only inference provider in the code. If it is down, the case pauses.

The live pins, and the data each component receives:

Component	What it receives	Class of data
faster-whisper, on the laptop	The handoff audio. Nothing leaves the machine.	Audio, local. Not sent to a vendor.
Band case room — Desk, Scribe, Critic, and the charge nurse	The transcript.	Transcript / PHI
Desk, on Crusoe (Qwen/Qwen3.8-27B, thinking off)	Opens the case. Same model family as Critic, by rule.	Transcript / PHI
Scribe, on Crusoe (zai-org/GLM-5.3, low reasoning)	Extracts the quoted brief.	Transcript / PHI
Critic, on Crusoe (Qwen/Qwen3.8-27B, thinking off)	Reviews and vetoes. A different model family from Scribe.	Transcript / PHI
Band approved room	The approved brief, after a digest match. Not the transcript.	Pseudonymous brief — still PHI until formally de-identified
Grapher, on Crusoe (Qwen)	Writes the graph through tool calls.	Pseudonymous brief — still PHI until formally de-identified
Neo4j Aura	Pseudonymous patient and encounter nodes, clinical items, lineage edges. Not the transcript. Field names, not identifier values.	Pseudonymous brief — still PHI until formally de-identified — plus lineage metadata
Researcher, on Crusoe (zai-org/GLM-5.3)	Sourced facts from drug names. Not in the case room.	Drug names only
Brave Search	One public source per named drug, from a bounded vocabulary.	Drug names only
Similarweb	A legitimacy fact for one spoken domain.	A domain name. Not the chart.
Compliance narrative, on Crusoe (Qwen)	The privacy-officer statement, on the dashboard and as a tool.	Lineage metadata only: agent names, field names, counts
DuploCloud MCP tools	The identifier query and the narrative, under human approval.	Lineage metadata only

Transcript and pseudonymous-brief rows are one contract away from a dedicated endpoint or hospital GPUs. Drug-name and lineage rows were never given the patient; those are the calls a scaled system can leave on a public serverless tier.

What the Prototype Proved and Did Not Prove

The prototype proved a control path on synthetic patients. It did not prove that a hospital may put real patients on it.

What ran: local transcription of handoff_2.wav kept the planted name, date of birth, and unowned line. Band cases ran transcript, brief, a veto on an unowned follow-up, a human "I'll own it," a revised brief owned by that message, and a digest approval, then an approved-room boundary. Grapher wrote pseudonymous encounters to Neo4j Aura, merged a second encounter onto the same pseudonymous patient, and who_saw_identifiers returned Critic, Desk, and Scribe. The narrative was generated live from lineage metadata only. In the DuploCloud studio a person approved the tool call, and the tool returned that agent list from the live graph. Drug facts were posted in a research room on case 19ecdb31. Similarweb, on the visit fixture's referral domain, returned unranked and roughly 890 visits a month, flagged for a human. The freeze suite was 140 unittest results (135 in product tests, 2 of them live and skipped, plus 5 in scripts) and 44 pytest, all green. The project records that path as case 19ecdb31.

Synthetic patients only. Public services were usable because no protected health information was present. Pointed at a real handoff, the same topology is a different legal object on the first request.

No business associate agreements. No vendor that received the transcript or the pseudonymous brief was under one. The terms below were read on September 29, 2026. Terms change; re-read them before relying on them. Crusoe's self-serve terms exclude health information subject to United States HIPAA regulations, offer no business associate agreement, say inputs and outputs are not stored to disk and are kept only as long as necessary, are not used for training without opt-in, and that metadata is logged. Band's terms and privacy policy, effective July 6, 2026, are silent on HIPAA, protected health information, business associate agreements, encryption, subprocessors, and hosting location; retention is "as long as reasonably necessary." Neo4j's AuraDB FAQ says a customer storing protected health information can sign a business associate agreement, and the cloud agreement requires it before that use. The FAQ lists no eligible tiers. The free instance used that day had no agreement. DuploCloud's pages describe automation of SOC 2, HIPAA, PCI, and HITRUST controls on a customer's infrastructure, and they do not state an attestation held by DuploCloud. The devkit has none, and it is licensed for local development only. Crusoe's announcement says Crusoe Cloud holds ISO 27001 and ISO 42001. That is about Crusoe Cloud, not this prototype, and not TrustEdge or Jacobian.

Five of Safe Harbor's eighteen identifier categories. The gate looks for name, date of birth, record number, phone, and address. The posture note names, among the rest, dates other than year, ages over 89, geographic subdivisions smaller than a state, device identifiers, URLs, biometric identifiers, and photographs. The transcript in the case room is protected health information anyway. The identifier veto never fired live, because Scribe did not leak. The gate is shown from tests, not from a live catch.

What the demo does not supply. The manifest is not a read receipt and does not measure attention. There is no risk analysis, policy set, workforce training, or incident procedure, and no claim about encryption at rest or vendor key management. Inference ran in the provider's GPU memory. There is no confidential-computing claim. Nebius credentials were object storage, not inference, and no embeddings path was built. Vultr had a compose file and no host. OpenRouter was not used; transcript-bearing agents fail closed on Crusoe. Merge.dev was cut for lack of a healthcare fit. Plaud was dropped for lack of a device. xAI text-to-speech built the synthetic fixtures and is not a path for real audio or real text. Closer, the discharge drafter, is an unregistered stub. Drug research ran once and was gated off for the recording. Similarweb's recruitment-trigger wiring was still unfinished. The ledger records approved room 0dc2f499 on case 84cfeb33 as Grapher only; the project summary staffs that room with Critic, Grapher, and the nurse. Both sentences are in the source. Re-verify membership on the build you are shown.

Clinical quality, outcomes, and ward use were not measured.

A Production Checklist for a Hospital

The production shape is a checklist, not a claim that any item is done. For a real handoff, none of these is optional.

• A business associate agreement, or a hospital-controlled substitute, for every component that receives the transcript or the pseudonymous brief: Scribe, Critic, Desk, Grapher, the room service, and the graph store. Drug-name and lineage-metadata components may stay on public serverless terms. A "redacted" label does not change a row's class.
• Inference on a dedicated Crusoe endpoint under a signed agreement, or open models on GPUs the hospital controls. The client is OpenAI-compatible; the endpoint is one configuration value. If it is down, the case pauses. It does not fail over.
• The room service under an enterprise agreement covering protected health information, or a hospital-controlled service with the same roster checks and the same rule: a human message is the provenance of ownership.
• The graph on Neo4j Aura under a signed business associate agreement, or on Neo4j inside the hospital network. The free instance used at the hack day is not that deployment.
• DuploCloud provisioning the deployment, its HIPAA control set applied to that infrastructure and audited, in the hospital's cloud account or on Crusoe Cloud compute. The devkit is local-only by license. The studio reaches the MCP endpoint over a private network, not a laptop hostname.
• Extend identifier detection from five categories to all eighteen, extend the lineage field vocabulary to match, and add a human review of every redaction, stored as lineage.
• Keep the processing manifest, and add gateway-level logging of every inference request, so "who saw what" is measured at the boundary and not only inferred from application events.
• Encryption in transit on every hop — the posture note records this as already TLS — and encryption at rest under hospital-managed keys for the graph and any message store. The prototype does not claim the second.
• The program work the software does not contain: a documented risk analysis, policies, workforce training, breach procedures, and a retention schedule.
• Re-read every vendor term before signature. The summary above is a reading dated September 29, 2026.

A discharge draft written from the redacted brief, inside the approved room, with the same roster checks as Grapher, is the right shape for the next feature. It is not a substitute for the agreements.

Governance Mapping

The mapping below is a correspondence, not a score and not an attestation. The prototype did not implement a management system. HIPAA. Access control is the roster: the runtime creates the room, an unexpected participant raises, and the approved room waits on a digest. Audit controls are the manifest and who_saw_identifiers. They record that an agent runtime processed a field. They are not yet the gateway log on the checklist, and they are not read receipts. Minimum necessary is the data-class table. Five detected categories are not Safe Harbor's eighteen, and the pseudonym does not close that gap. The posture note also names integrity and transmission security. This paper claims the veto on quotes that are not in the transcript, and it repeats the note's statement that transit is already TLS. It claims no more.

NIST AI Risk Management Framework. Govern is a named human owning the consequential act, a person approving each lineage tool call, and a case that fails closed instead of changing provider. Map is the data-class table. Measure, here, is the digest, the roster, the identifier gate, and the live query. It is not a measure of clinical accuracy, and a green test run is not the Measure function. Manage is the checklist. A hospital adopting the design would be starting it, not inheriting it.

ISO/IEC 42001. Three themes apply as obligations the prototype illustrates, not as clauses it satisfies. Impact assessment: the impacts treated as primary are an identifier reaching a party that does not need it, and a follow-up with a fabricated owner. No formal assessment was performed; the checklist's risk analysis is that work, still undone. Life cycle: pinned models, a fail-closed provider, and a written list of stubs are an early stage, not a released system. Changing a model pin, the room service, or the graph host is a change-control event. Third-party relationships follow the table. The vendor that receives counts is not the vendor that receives the transcript. A contract that calls both "the AI supplier" waives minimum necessary.

Organizations writing the program around a design like this — policies, impact assessment, vendor review, life-cycle gates — can start from the governance templates. The templates close nothing on the checklist. They are where the program gets written down so the checklist is not a slide.

How It Was Built

Erik Jones and Jaiven Spence, of TrustEdge AI and Jacobian Engineering, built Safe Scribe at The AI Conference Hack Day 2026 in San Francisco on September 29, 2026. The project took second place overall, for a prize sponsored by Crusoe. The placement is context. It is not evidence the controls are fit for a ward.

The day was two humans and three agent sessions across six hours. The rule written that morning: one Linear issue and one pull request per change, a human merge, and an independent local AI review before the pull request is opened, run in the session rather than through a hosted bot. The day's account names Astra, via the Codex CLI, as that reviewer, and a separate Claude session as overseer — clock, merges of reviewed pull requests, and a challenge to any claim not backed by a live run. One setup used Claude Code to orchestrate, Grok to write, and Astra to review. That shape was the rule. Those vendors were not. Forty-nine pull requests merged. The forge required neither a check nor a reviewer; the human merging was expected to read the summary. Doppler was the only secrets store.

The integration ledger is the artifact worth copying even if the product is not. One row per tool, a state of verified, mocked, attempted, or not used, and an evidence line: a case id, a query result, a time. The public tool table was taken from that ledger. Attempted tools stayed attempted. A compose file did not promote them.

The repository is github.com/erikdj/ai-hackday-2026. The recorded demo is on the HackerSquad project page.

Conclusion

Refuse or accept a clinical scribe on three questions. Where does the audio go. Which named parties can reach the transcript. What artifact, produced by the system and not by the vendor's marketing, answers "which agents saw identifiers" for a specific encounter. Safe Scribe is a reference design for those three: chosen placement, minimized reach, and a lineage graph a privacy officer can read. It is a prototype on synthetic patients, under no business associate agreement, with an identifier gate at five categories out of eighteen and a provenance record that measures processing rather than attention.

A hospital that wants this in production starts at the checklist, not at the demo. A second-place finish and a green test run imply none of the agreements, the eighteen-category gate, or the human review of redactions.

This paper is not legal advice.

If you are deciding whether an agent scribe can run in a clinical workflow without handing every downstream step the chart, talk to us. The work sits in our AI agents practice and our healthcare work.