AI you can switch on without losing the thread.

• What it suggested, and what you kept

  For a coding suggestion, both are hashed into the transparency log and the result is recorded as kept verbatim or edited. For a note draft, the hash of what the model wrote is recorded when it is drafted and the signed text is hashed when it is signed; the two are not yet compared for you. The difference between them is the entire question when somebody asks whether a clinician exercised judgement or accepted a machine’s output — and most systems record only the final text, which cannot answer it.

• Every code must quote the note

  The coding assistant cites the text supporting each code it proposes. A citation that cannot be found in the note is dropped before you see it, rather than shown and left for you to check.

• Measured for the failures that matter

  A scored evaluation set that fails a release on over-coding or fabrication specifically, not on an average that hides them. A run that was never measured reports “not measured” and never passes.

• Minimised before the model sees it

  What reaches a model is reduced to what the task needs. The gateway applies PHI and BAA gating on every call, and no product code reaches a model without passing through it — verified by a sweep of the repository, not by convention.

• One record can be off-limits

  Autonomy is per patient: a record marked no-AI, or a patient who withheld consent to AI processing, is refused by every AI path that reads a chart before a model sees it. Staff set it from Practice settings with a reason that is kept in the audit log. Only “no AI” changes what the platform does for one patient today; the other three values are recorded on the chart and narrow nothing beyond the practice’s own AI policy. The effectiveness report, what models have actually been doing in your practice, is on the same screen.

• The recording notice is shown, and that it was shown is recorded

  Consent to be recorded is announced rather than buried in an agreement signed years ago. The notice going up is itself an event on the practice’s chain, so “were they told” has an answer that is not somebody’s memory.

• Withdrawing consent ends the meeting, not a preference file

  A patient who changes their mind mid-visit stops the capture and the visit stops with it. A withdrawal that merely files a flag somebody reads afterwards is not a withdrawal — the recording carried on.

• The scribe drafts; a clinician signs

  An ambient draft carries its machine origin and joins the record only when a person signs it with their passkey. Nothing promotes a draft on its own, and a signed note cannot then be edited — only amended by a further signed note.

• Raw audio can be forked to your own pipeline

  The recording is not only ours. A practice can take the audio into its own storage as it is captured, which is what makes “we hold your recordings” a choice you made rather than a condition of using the product. Not a frame is forwarded until the deployment asserts a business associate agreement covering that pipeline, and the recording notice patients see then says the practice may keep the audio instead of promising it is not kept.

• The patient assistant never calls a model on a crisis message

  Self-harm and emergency language are classified before any model is reached, and answered with the 988 and 911 resources directly. A guardrail written as a system prompt is a request the model usually honours; this one is code that does not make the call.

• Nor on a request for individual medical advice

  “Should I stop taking this” is routed to the care team with an offer to message them. The detectors deliberately over-match, because a false positive shows somebody a phone number they did not need and a false negative sends somebody in trouble to a language model.

What none of this claims

• One model provider can be bound, and nothing is bound by default

  The gateway, the model registry, the router, the PHI and BAA gate and the failover path are all real. A deployment can now bind AWS Bedrock — the only vendor here whose protocol is public enough to implement honestly. It has not yet been run against live Bedrock: its protocol details are implemented from AWS’s documentation and tested against a stand-in, so the first real call is still the test. Binding it needs the deployment’s own AWS account, its own BAA covering Bedrock and its own model-access grant, and PHI reaches a model only once a human states that BAA in configuration; the default is that it has not, and the router refuses. No other vendor has an adapter. Binding Bedrock buys chat, and classification served through that same chat model — a label set the caller supplies, an answer outside it rejected, and a confidence reported as the model’s own estimate rather than a measured probability; a governance label it proposes is recorded with what a person confirmed, and nothing applies it to stored content. There is no transcription, so the ambient scribe still reaches nothing, and no embeddings, no dedicated classifier and no token-by-token streaming.

• No FDA clearance, and no FDA determination

  No AI feature is FDA-cleared, and none has been reviewed by FDA. They are designed to be used as non-device decision support — drafts, summaries and proposals a clinician reviews, and an assistant limited to administrative help and general information — which is our engineering reading, not a regulatory conclusion. Every AI draft shows what it is for, what it is not for, and that it has not been externally validated.