AI safety, compliance & interoperability
Explore the published writing, then bring a specific workflow question to the evaluation.
The EU's ProtectEU strategy has reignited the encryption backdoor debate. Here is why mandated backdoors are structurally incompatible with HIPAA's Security Rule, and what US clinics should track.
A practical framework for IT admins decommissioning a legacy EHR: how long to keep read-only access, state retention rules, and who stays liable for old-system data requests.
EHR overlay implementation is a phased workflow redesign, not a one-day install. Here is a practical blueprint starting with inbox management, documentation, and fax handling.
RBAC controls who can open a chart. Audit log monitoring catches employees who technically can but shouldn't. Here's what IT admins should require from an EHR vendor.
Ambient AI scribes record patient conversations, which means wiretapping law, not just HIPAA, applies. Here is what consent, notice, and opt-out workflows should look like state by state.
RBAC misconfiguration in shared endocrinology/primary care EHRs causes both HIPAA exposure and clinician friction. Here's how IT admins should structure roles, scopes, and audits.
HTI-1 forces certified EHRs to disclose how predictive AI tools are built, trained, and validated. Here's what it actually requires, and what it doesn't.
AI can draft SOC 2 and ISO 27001 policy language fast, but evidence validation, control testing, and auditor sign-off still require human review. Here's where the line sits.
AI chart audits scan for HCC coding gaps, unsupported diagnoses, and documentation-to-billing mismatches at a scale manual review cannot match. Here is what they actually catch.
TEFCA creates a national framework for nationwide query-based data exchange through QHINs. Here is what it actually requires, what it does not, and how it should factor into EHR vendor selection.
A practical guide for IT admins on what happens to patient audio after ambient AI scribe transcription, including retention windows, model training risk, and the exact contract language to demand.
A practical comparison of open-source data-exchange APIs and commercial FHIR platforms, covering ONC certification support, maintenance burden, and who owns security risk over time.
A decision framework for IT admins weighing a SMART on FHIR overlay against a full EHR replacement, covering time-to-value, data risk, staff disruption, and cost.
A technical breakdown of screen scraping versus FHIR and Direct exchange, why reverse-engineered integrations persist in health IT, and what admins should verify before trusting a vendor's data pipeline.
Data interoperability in an EHR runs on three standards that solve different problems: FHIR for real-time API queries, C-CDA for structured clinical documents, and Direct messaging for secure transport between organizations.
FHIR support is now a baseline claim, not a buying signal. A five-level FHIR maturity model and verified ONC data on what operational EHR interoperability really requires in 2026.
AI safety in healthcare is now a workflow control problem. Here is what healthcare IT leaders should verify in audit logs, approval workflows, and source grounding before deploying an AI EHR.
An EHR contract should be evaluated like an implementation and workflow risk document, not just a software quote. The right checklist focuses on go-live scope, pilot metrics, data rights, exit terms, and what can be proven before a full switch.
AI hallucinations in clinical workflows pose significant patient safety risks. Essential prevention strategies include data grounding, deterministic rules, and audit trails.
FHIR R4 is the API standard that enables modern EHR systems to effectively participate in the health data ecosystem, ensuring interoperability and compliance with ONC requirements.
ONC certification is the gateway to the US healthcare market. Here is what the process actually involves, what it costs, and where new vendors get stuck.
HIPAA compliance is not a checkbox. For cloud-native EHRs, it requires deliberate architecture decisions around encryption, access control, and audit logging.
Keep exploring
