Healthcare Data AI Operating System (HDAIOS) Specification v1.0

1. Abstract & Purpose

Healthcare organizations often struggle to move beyond disconnected generative AI pilots—one-off prompt wrappers, generic search copilot trials, and brittle chatbots.

The Healthcare Data AI Operating System (HDAIOS) is an architectural framework defining the 5 interdependent layers necessary to operate artificial intelligence as an institutional, compliant capability.

2. The 5-Layer Architectural Stack

Layer 1: The Decision Interface (DI)

Every AI workflow must originate with an explicit business decision, an identified executive owner, and rigorous clinical boundaries.

Decision Ownership: Every model output must trace directly to a measurable operational metric and owner.
The Clinical Boundary (Schmitt-Thompson Protocol Standard): Clinical telephone triage and decision support standards (Schmitt-Thompson protocols) are unequivocal. Unless an organization operates a certified, clinical-grade platform, uncertified language models must never perform clinical diagnoses or triage recommendations. AI agents are bounded to administrative, operational, care navigation, and data transformation workflows, preserving licensed clinician judgment.

Layer 2: The Governed Data Foundation (GDF)

Models cannot reason accurately over fragmented or unverified schemas. Layer 2 enforces:

Bitemporal Claims Modeling (SCD Type 2): Claims are not real-time event streams; clearinghouses and payers batch with 48h to multi-week latency. Layer 2 mandates slowly changing dimensions separating Event Time (Date of Service), Transaction Time (Paid/Adjudicated Date), and Knowledge Time (Pipeline Arrival) to prevent retrospective hallucinations.
The 7 Non-Negotiable dbt Tests: Enforcing the open-source refhealth-dbt-healthcare-checks suite: surrogate key grain, bitemporal enrollment consistency, CMS NPI formatting, ICD-10 validity, HCPCS/CPT code validity, midnight (00:00:00) timestamp audits, and claims-to-member referential integrity.
Zero-PHI Pre-Flight Feed Triage: Pre-validating CSV event feeds and FHIR Bundles locally using refhealth-feed-triage before warehouse ingestion.

Layer 3: Enterprise BAA & Model Gateway (EBMG)

Layer 3 optimizes model selection within contractual and enterprise security boundaries:

The Model Parity Principle: Performance across frontier models (Claude 3.5 Sonnet, GPT-4o, Gemini 1.5 Pro) has largely converged. The priority is maximizing the client's existing enterprise cloud commitment, signed Business Associate Agreement (BAA), and token allocation (AWS Bedrock, Azure OpenAI, or Google Cloud Vertex AI) rather than vendor churn.
Task-to-Capability Routing: Selective multi-model routing where lightweight compact models (Flash, Haiku, Mini) handle high-volume extraction, while frontier reasoning models handle complex synthesis.

Layer 4: Agent & Workflow Orchestration (AWO)

Layer 4 operationalizes models into dependable, human-supervised workflows:

Governed Context Retrieval: Agents query verified dbt semantic layers and structured schemas, never unconstrained raw tables.
Human-in-the-Loop (HITL) Tripwires: Hard programmatic tripwires that automatically abort execution and route to human operators upon confidence score dips, bitemporal date conflicts, high dollar values, or clinical symptom boundaries.

Layer 5: Continuous Operational Cadence (COC)

An operating system requires continuous governance and commercial measurement:

Lineage & Metric Drift Audits: Continuous CI/CD test execution and alerting when dropped timestamp precision or unmapped member rates increase.
90-Day Review Cadence: Measuring hard operational hours saved, rework eliminated, and decision velocity improvements before funding follow-on workstreams.

3. Interactive HDAIOS Self-Assessment Tool

Evaluate your organization's readiness across the 5 HDAIOS layers. This assessment runs 100% client-side in your browser—zero data, responses, or company information are transmitted to ref(health) or any remote server.

Tool v1.0.0 Zero-PHI · 100% Client-Side Evaluation

Select the option that best reflects your current data models, pipelines, and AI deployments. Your architecture score, risk tier, and gap analysis update in real time.

Layer 1

Decision Interface & Clinical Boundaries

1. Clinical Triage & Diagnostic Guardrails

Does your system structurally prohibit autonomous clinical diagnosis, triage, or prescription recommendations through hard code-level tripwires (e.g. Schmitt-Thompson protocols)?

Fully Enforced: Hard programmatic boundary in place. Non-clinical models are strictly restricted to administrative/operational tasks; clinical triage strictly requires certified clinical-grade systems. Partial / Prompt-Level: System prompt advises the model not to provide medical advice, but no automated programmatic blocking or protocol verification exists. Unenforced: LLMs or autonomous agents directly generate clinical recommendations, symptom triage, or diagnostic summaries without certified boundaries.

2. Decision Ownership & Pre-AI Baselines

Is every deployed healthcare AI workflow tied to a named business decision owner and a pre-AI baseline error/cost metric?

Fully Enforced: Named decision owner, established historical baseline metric, and target threshold required before deployment. Partial: General department ownership, but no formal baseline measurement or individual accountability. Unenforced: AI tools deployed as exploratory pilots or assistants without business baseline metrics.

Layer 2

Governed Data Foundation (Bitemporality & dbt)

3. Bitemporal Claims & Enrollment Architecture

Do your data models use Slowly Changing Dimensions (SCD Type 2) to decouple Event Time (date_of_service) from Knowledge Time (adjudicated/paid date) across 48h to multi-week batch lags?

Fully Enforced: Full SCD Type 2 bitemporal snapshots in dbt/warehouse. Models reconstruct exact point-in-time state without retrospective anachronisms. Partial: Single timestamp or overwrite models. Date of service is tracked, but historical states cannot be faithfully reconstructed. Unenforced: Claims treated as real-time event feeds without bitemporal separation, risking retrospective hallucinations.

4. Deterministic Healthcare Data Testing Suite

Does your automated pipeline (e.g. dbt) enforce healthcare tests: CMS NPI registry formatting, ICD-10/CPT validity, midnight (00:00:00) timestamp drop audits, and claim-to-member referential integrity?

Fully Enforced: Automated CI/CD dbt test suite runs all 7 healthcare integrity checks prior to data reaching semantic or production models. Partial: Basic generic tests only (null and uniqueness); no healthcare-specific NPI format, ICD-10 validity, or midnight timestamp auditing. Unenforced: No automated data tests in production pipelines.

Layer 3

Enterprise BAA & Model Gateway

5. Zero-Retention BAA Enforcement

Are all LLM inference calls routed exclusively through cloud endpoints under executed Business Associate Agreements (BAAs) with guaranteed zero-day data retention for training?

Fully Enforced: Strictly routed via AWS Bedrock, Azure OpenAI, or GCP Vertex AI under executed enterprise BAAs with zero model training on customer data. Partial: Mixed: Some workflows use enterprise cloud APIs, but internal teams also use public consumer accounts or API keys without signed BAAs. Unenforced: Non-BAA commercial endpoints or public consumer accounts are used with sensitive or identifiable workflow data.

6. Model Parity & Gateway Abstraction

Can your application route between frontier model families (Claude, GPT, Gemini) via an abstraction layer without rewriting business logic?

Fully Enforced: Unified gateway abstracts model calls, allowing instant routing based on latency, token costs, and signed cloud commitments. Partial: Hardcoded to a single provider SDK; swapping models requires significant application refactoring. Unenforced: Direct vendor lock-in with zero routing abstraction.

Layer 4

Agent & Semantic Orchestration

7. Semantic Layer Context Grounding

Do autonomous agents retrieve data through tested, governed semantic layer metrics rather than generating unconstrained raw SQL over warehouse tables?

Fully Enforced: Agents query governed semantic metrics and curated dimensional marts. Raw SQL generation over base tables is prohibited. Partial: Curated views exist, but agent generates raw SQL directly, causing occasional join errors or metric drift. Unenforced: Agents write unconstrained SQL across raw schemas, frequently hallucinating metrics and grain.

8. Human-in-the-Loop (HITL) Tripwires

Are there automated code-level tripwires that intercept high-risk actions (claims appeals, payment modifications, low confidence scores) and mandate human sign-off?

Fully Enforced: Automated tripwires pause execution and mandate human sign-off on high-risk actions, confidence dips, or bitemporal conflicts. Partial: Humans review some actions after execution, but no programmatic blocking tripwires exist. Unenforced: Autonomous agents execute transactions or external communications without human gates.

Layer 5

Continuous Operational Cadence

9. Claims Lag & Feed Drift Monitoring

Does your engineering team continuously monitor and alert on upstream clearinghouse batch lag, feed latency, and EHR schema variations?

Fully Enforced: Automated monitors alert engineering when receipt lag exceeds thresholds or feed schema anomalies appear. Partial: Feed delays are noticed only when downstream reports break or business users complain. Unenforced: No monitoring of upstream feed latency or claims submission batch delays.

10. Structured 90-Day Executive Governance

Does leadership conduct a formal quarterly review auditing data test pass rates, token spend ROI, workflow error rates, and compliance boundaries?

Fully Enforced: Formal 90-day review evaluating data quality, token cost vs. labor hours saved, and safety boundaries before expanding scope. Partial: Ad-hoc reviews: Monthly costs are reviewed, but no formal architecture, safety, or ROI governance. Unenforced: No regular cadence or accountability for AI system performance and compliance.

HDAIOS Readiness Score

100/100

Production Ready

Architecture Aligned with HDAIOS v1.0

Your architecture enforces clinical guardrails, bitemporal data hygiene, and enterprise BAA boundaries. Proceed with scaling autonomous agents across operational workflows.

Resolve Gaps in a Diagnostic → Copied to clipboard!

4. Implementing HDAIOS

Organizations can implement HDAIOS through our 2-week, $2,500 Healthcare AI Readiness Diagnostic. We evaluate current pipeline blockers, audit bitemporal data fitness, and provide ready-to-run execution scripts and dbt tests that engineering teams can merge immediately.

Healthcare Data AI Operating System (HDAIOS)