[Epic] Validation & enhancement pipeline stages — improve and verify results before reporting

[Liohtml]

Vision

MedCheck today runs a linear pipeline:

Ingest → Preprocess → ML Analyze → Vision AI → Report

This epic tracks purely additive pipeline stages that make the results more
trustworthy before they reach the report, plus the features that let MedCheck
serve patients responsibly. Nothing in the existing pipeline is removed or
replaced — every new stage is an optional, separately-registered PipelineStep.

Ingest → [+De-identify] → Preprocess → [+Segmentation grounding] → ML Analyze
        → Vision AI (+RAG grounding) → [+Cross-validation] → [+Reconcile vs official report]
        → [+Local 2nd opinion] → Report (professional | patient mode, +structured export)

Positioning — dual track (decided)

Deep research into the regulatory landscape established a hard boundary (verified
against FDA + EU MDR primary sources):

The moment software analyzes a medical image and presents findings to a
patient as truth, it is a regulated medical device (US: fails FDA CDS
Criteria 1 & 3; EU: MDR Rule 11, ~Class IIb). A "not a medical device /
educational" disclaimer does not change this — intended use governs.

MedCheck therefore runs on two clearly-separated tracks:

1. Research / developer track (existing) — professional radiology-style report,
   full image analysis, current "not a medical device, research use" disclaimer.
   Unchanged.
2. Patient-education track (new) — an understand-your-report &
   prepare-questions-for-your-doctor layer. It explains an existing radiologist
   report, terminology, and anatomy; it never presents autonomous image-derived
   findings to a patient as truth, never says "looks normal/concerning," and always
   routes to a clinician. This is the safe side of the device line.

Why this matters (research-backed pain points)

• Comprehension is the feat: MedCheck v0.1.0 - AI-powered medical imaging analysis toolkit #1 pain point, not access: only ~4% of reports are at
  lay reading level; 85% of patients are confused by jargon; patients prefer to
  ask their doctor over self-researching.
• The market is siloed — text explainers never read the pixels, viewers never
  explain, second-opinion services are paid/slow/closed, clinician AI is walled
  off. Nobody reconciles the official report against the images for patients
  (Add report reconciliation: compare official radiologist report against image analysis #58) — that's the differentiator.
• False reassurance is the top documented harm → never tell a patient something
  looks fine; always pair AI output with uncertainty/error rates (Trust & factuality bundle: RAG grounding, uncertainty + error-rate display, compliance docs #59).

Design principles

• Additive only. New stages register in the existing StepRegistry; defaults
  unchanged unless explicitly enabled.
• Optional heavy deps behind extras (local-models, segmentation, interop,
  ocr).
• License-clean. Apache-2.0 / MIT / BSD / CC0 or network APIs only; no
  research-only weights as defaults.
• Fail-soft for enhancement; fail-safe for anything touching transmission of
  patient data (tie to consent gate [repo-monitor] High: Patient PHI/DICOM data transmitted to external LLM APIs without consent controls #27 + de-identification Add robust DICOM de-identification step (tag scrubbing + burned-in PHI + optional defacing) #57).
• Human-in-the-loop: validation surfaces confidence & contradictions, it does
  not certify correctness.

Child issues

Validation & grounding

• Add findings cross-validation pipeline step (LLM findings vs. ML signals) #52 — Findings cross-validation (LLM findings vs. ML signals) — start here, no deps
• Add anatomy segmentation grounding step (MONAI / TotalSegmentator total_mr) #53 — Anatomy segmentation grounding (MONAI / TotalSegmentator total_mr)
• Add report reconciliation: compare official radiologist report against image analysis #58 — Reconcile official radiologist report vs. image analysis — market differentiator

Patient-education track

• Add patient-friendly plain-language report mode #56 — Patient-friendly plain-language report mode (readability, glossary, doctor-routing)
• Trust & factuality bundle: RAG grounding, uncertainty + error-rate display, compliance docs #59 — Trust & factuality bundle (compliance/positioning docs, RAG grounding, uncertainty + error-rate display)

Privacy / safety foundation

• Add robust DICOM de-identification step (tag scrubbing + burned-in PHI + optional defacing) #57 — Robust DICOM de-identification (tag scrubbing + burned-in PHI + defacing)

Interoperability & local inference

• Add structured standards export: FHIR DiagnosticReport + DICOM SR #54 — Structured standards export (FHIR DiagnosticReport, DICOM SR)
• Add local VLM second-opinion / consensus stage (cross-check cloud LLM against offline model) #55 — Local VLM second-opinion / consensus (depends on Add local LLaVA-Med vision model provider #18)

Suggested order

1. Add findings cross-validation pipeline step (LLM findings vs. ML signals) #52 (no deps, immediate value) → Add patient-friendly plain-language report mode #56 (comprehension, the top pain point)
2. Add robust DICOM de-identification step (tag scrubbing + burned-in PHI + optional defacing) #57 (privacy foundation) → Trust & factuality bundle: RAG grounding, uncertainty + error-rate display, compliance docs #59 D (positioning docs — do early, cheap, de-risks everything)
3. Trust & factuality bundle: RAG grounding, uncertainty + error-rate display, compliance docs #59 E/F (RAG grounding + uncertainty display)
4. Add report reconciliation: compare official radiologist report against image analysis #58 (reconciliation — the differentiator; builds on Add findings cross-validation pipeline step (LLM findings vs. ML signals) #52/Add anatomy segmentation grounding step (MONAI / TotalSegmentator total_mr) #53/Add structured standards export: FHIR DiagnosticReport + DICOM SR #54/Add robust DICOM de-identification step (tag scrubbing + burned-in PHI + optional defacing) #57)
5. Add local LLaVA-Med vision model provider #18 → Lingshu-7B, then Add anatomy segmentation grounding step (MONAI / TotalSegmentator total_mr) #53, Add local VLM second-opinion / consensus stage (cross-check cloud LLM against offline model) #55, Add structured standards export: FHIR DiagnosticReport + DICOM SR #54

On training our own models (researched)

Realistic ladder for a small Apache-2.0 team (verified):

• Tier 0 — RAG / prompting, no training (Trust & factuality bundle: RAG grounding, uncertainty + error-rate display, compliance docs #59 E) — ship first.
• Tier 1 — LoRA fine-tune Lingshu-7B on a few hundred–few thousand paired cases,
  1–2× 24–48 GB GPUs, hours–days — realistic.
• Tier 2 — SSL 3D encoder (MONAI) or reuse public weights (BrainIAC) — only with
  thousands of unlabeled volumes.
• Tier 3 — from scratch — not feasible (needs MIMIC-CXR-scale paired data, which
  does not exist for MRI).
• Data reality: paired MRI+report datasets are genuinely rare (most large MRI
  sets ship labels, not reports; the main paired corpora are chest X-ray / CT). A
  future training effort would likely need a privately collected, de-identified
  corpus (→ why Add robust DICOM de-identification step (tag scrubbing + burned-in PHI + optional defacing) #57 matters) or transfer from CXR/CT.

License note (all children)

Components were checked against primary sources: MONAI/nnU-Net Apache-2.0;
TorchIO/highdicom/dicomweb-client/textstat MIT; FHIR spec CC0; Lingshu MIT. Excluded
from defaults due to research-only / non-commercial / custom terms: LLaVA-Med,
Med-Flamingo, BiomedGPT, MedGemma, and the non-commercial TotalSegmentator tasks.