Skip to content

security-model.md

Latest commit

 

History

History
81 lines (62 loc) · 3.45 KB

security-model.md

File metadata and controls

81 lines (62 loc) · 3.45 KB
Raw

Security And Privacy Model

Demo Boundary

  • Use synthetic patients only.
  • Do not record production PHI in the hackathon video.
  • Keep ENABLE_TRANSCRIPT_SAVE=false unless the backend is a local synthetic demo store.

Data Flow Controls

  • Audio is scoped to a LiveKit room.
  • STT output is treated as sensitive.
  • deidentification.py redacts common PHI-like values before cloud AI prompts or transcript persistence.
  • Findings store salted hashes, token type, and offsets, not raw PHI.
  • Translation prompts instruct the model to preserve placeholders unchanged.

Redaction Maturity

Current implementation:

  • Deterministic pattern matching in deidentification.py.
  • Covers common local Spanish clinical identifiers, including labeled names, D.N.I., H.C., document IDs, phone numbers, emails, dates, UUIDs, and address labels.
  • Stores redaction findings as salted hashes and offsets instead of raw values.

Not yet implemented:

  • Local clinical NER.
  • Site-specific patient, clinician, facility, and geography dictionaries.
  • Evaluation against a labeled PHI corpus for Spanish clinical transcripts.

To claim local NER, add an offline recognizer behind the same redaction boundary, keep raw PHI out of logs, and require tests proving that NER findings are merged with deterministic findings without leaking raw values.

Model Boundary

The agent is provider-configurable. The default development LLM is OpenAI gpt-4.1-mini through LLM_PROVIDER=openai and OPENAI_MODEL=gpt-4.1-mini. The local-first demo path uses LLM_PROVIDER=ollama with OLLAMA_MODEL=qwen3:8b unless the site selects another local model.

Provider-backed models must receive only synthetic data, redacted text, or data covered by the deployment's privacy and contracting controls. For PHI-bearing workflows, prefer local models and keep transcript persistence disabled unless a site policy explicitly allows retention.

The base prompt keeps Spanish clinical examples because the demo must handle Latin American Spanish encounters well. Runtime language defaults are English unless the room metadata from OpenMRS selects Spanish. This language behavior is not a safety control. Clinical safety still depends on redaction, human review, auditability, model evaluation, and site-specific validation.

SOC 2-Aligned Controls To Describe

This prototype is not SOC 2 certified. The intended deployment pattern maps to common SOC 2 control themes:

  • Security: service-to-service secret for the backend bridge, no public write path to OpenMRS, least-privilege OpenMRS credentials.
  • Confidentiality: redaction before external AI calls, raw transcript storage disabled by default, synthetic demo data.
  • Processing integrity: human approval required before writes, confidence and evidence on every candidate fact.
  • Availability: provider fallback settings for LLM/STT/TTS and hybrid deployment support.
  • Privacy: no autonomous diagnosis or order entry, explicit consent and local policy required for recording or transcript retention.

Production Hardening Checklist

  • Replace regex-only redaction with local NER plus site-specific dictionaries.
  • Add per-site salt management through a secrets manager.
  • Encrypt transcript and draft stores at rest.
  • Add immutable audit events for approval, rejection, and OpenMRS writes.
  • Use vendor contracts/BAA or local models for any PHI-bearing workflow.
  • Add retention policies and deletion workflows.
  • Add role-based access control for review UI events.