ANIMA/KERNEL · MEDICAL

Every clinical decision,
signed, sealed, and replayable

A tamper-evident audit layer for CDS alerts, prior-auth decisions, PHI access, e-signatures, and SaMD inference — court-survivable proof that a specific decision was made, by whom, with exactly these inputs, at this time. It does not assert clinical truth; it proves the decision happened.

7 signing capsules · BUILT EHR / FHIR integration · ROADMAP Business overview · June 2026
01 · the problem

Healthcare makes millions of decisions a day.
The only evidence is a mutable text log.

Which alert fired. What the clinician did. Who accessed the chart, and why. Whether a prior-auth denial followed its own guideline. Each becomes a row in an institution-controlled EHR audit log — never a signed artifact. When a decision is challenged in court or by a regulator, the reason is irrecoverable as verified evidence.

$7.42M

Average cost of a healthcare data breach — the most expensive sector for 14 straight years (IBM, 2025). 289M records were exposed in 2024 alone.

PHI access logs are mutable, internal, and not cryptographically bound to the data state.

$1.3B

Annual prior-auth administrative waste (AMA). 29% of physicians report a PA delay caused a serious adverse event — 8% a death or permanent harm.

No signed proof binds the guideline version to the denial at the moment it was rendered.

+14%

Rise in AI-related malpractice claims 2022–24. Over 35 US states have enacted AI-accountability laws; the EU AI Act adds high-risk logging duties from Aug 2026.

No CDS vendor emits a signed record of which alert fired, on what input, and what the clinician did.

The common failure: the decision was never signed. There's nothing to replay.
02 · the root cause

The audit log is a flag in the same system
it claims to authenticate.

A CDS override is a free-text note. A PHI access is a database row. A Part-11 e-signature is a boolean stored beside the record it signs. All mutable, all institution-controlled. Anima signs the decision event at the moment it happens — independently verifiable without trusting the hospital's own systems.

// CDS decision · EIP-712 typed · secp256k1
{
  "type": "cds_decision",
  "alert": "DRUG_INTERACTION", "severity": 2,
  "model_weights_hash": "0x9f3c…b71a",
  "input_hash": "0x2d80…44ef",
  "clinician_action": "OVERRIDE",
  "ledger_proof": "0xa1b2…2345"
}

→ A Part-11 e-signature capsule can carry this decision's id as a foreign key. The signature can never outrun the exact record it signs.

03 · are the laws helping us

Six mandates now require
attributable, tamper-evident decision records.

HIPAA Security Rule · US

§ 164.312(b) audit controls. The Jan 2025 NPRM makes technical safeguards mandatory; OCR's 2024–25 audits target audit-control sufficiency. Up to $1.9M/category/yr.

every PHI access logged + provable

21 CFR Part 11 · US + EU Annex 11

Signed e-records in FDA-regulated work need meaning-of-signature, record linkage, and two-component auth. Today the signature is a flag beside the record.

signature bound to exact record

FDA PCCP · Dec 2024 final

AI-device makers must prove each inference ran inside the authorized model-version envelope. 53 PCCPs authorized — zero signed per-inference standard exists.

per-inference provenance

CMS-0057-F · 2026/27

Prior-auth denials must carry specific clinical rationale, with a PA Decision FHIR API by Jan 2027. Covers MA, Medicaid, CHIP, QHPs — the whole payer market.

appeal-replayable denial

EU AI Act · Aug 2026

Medical AI as an MDR/IVDR safety component is high-risk: automatic event logging with timestamps + input references, plus recorded human-oversight overrides (Art. 12).

model + input + override attested

ONC Info-Blocking / TEFCA · 2026

500M records now exchanged via TEFCA; nonconformity letters issued Feb 2026, up to $1M/violation. Cross-network data needs portable, signed access provenance.

portable access attestation
04 · what's out there

Everyone logs, monitors, or automates.
No one signs the decision.

LOG — the EHR's own record

Epic · Oracle Health · MEDITECH

Native audit logs stored in the EHR's own database. Mutable, institution-controlled, exportable only with platform trust. KLAS-surveyed Epic customers say the trails "aren't robust enough" for privacy monitoring.

mutable, internal logs
MONITOR — analytics on the same log

Imprivata/FairWarning · Protenus

Behavioral analytics flag anomalous access — celebrity snooping, mass export. But they read the same mutable EHR log; detection is probabilistic and retrospective. They can flag what looks wrong, never prove what happened.

flags, not proofs
AUTOMATE — the PA / CDS workflow

Cohere Health · Availity · CDS Hooks

AI prior-auth and embedded alerting. Cohere itself states "no claim is denied exclusively by AI" — because the accountability chain isn't signed. No guideline-version-bound proof, no appeal-replay.

decisions, unsigned
The empty slot: a signed, off-platform-replayable proof of the clinical decision and its exact inputs.
05 · what we provide · code-verified

Seven built capsules. One signed chain.

Each is an EIP-712 typed struct, secp256k1-signed, schema-published. Four carry Go↔Rust/WASM cross-language parity vectors enforced in CI; three are Go-signed with sign/verify tests, WASM parity pending. Source: internal/medical/signing/.

Capsule
Capsule ID
What it attests
Status
CDSDecision
0x8000…0001
CDS alert fired + clinician accepted / overrode / deferred — with model-weights hash, input hash, override reason, co-signer.
✓ BUILT · parity
PriorAuthDecision
0x8000…0010
Payor approval / denial / partial / pend bound to guideline version + hash + reviewer + rationale — enabling appeal-replay.
✓ BUILT · parity
PHIAccessEvent
0x8000…0020
Read / write / export / print / share of PHI with tokenized patient, actor, resource hash, and HL7 purpose-of-use code.
✓ BUILT · parity
Consent
0x8000…0050
Research / treatment consent grant or revocation (45 CFR 46, GDPR Art. 9) with scope hash + document hash + revocation link.
✓ BUILT · parity
BreakGlass
0x8000…0021
Emergency override access (ED / CODE_BLUE / DISASTER) with distinct supervisor + 24h HITECH window enforced in code.
✓ BUILT · WASM pending
ElectronicSignature
0x8000…0030
21 CFR Part 11 e-signature bound to target digest + meaning code + two-factor auth ceremony hash (enforced in StructHash).
✓ BUILT · WASM pending
DeviceInference
0x8000…0040
FDA PCCP-authorized SaMD inference binding DeviceUDI + model-weights hash + PCCP version + input/output digest + confidence.
✓ BUILT · WASM pending
06 · market → moat

Not another EHR or PA bot.
The proof layer they all lack.

Each liability pool already has incumbents. None of them emit a signed, replayable proof of the decision and its exact inputs — that empty slot is the moat.

What's out there today
How Anima captures it
$7.42M
Avg breach cost
#1 sector, 14 yrs (IBM)
Imprivata · Protenus add analytics over the EHR log. The underlying record is mutable; they detect what looks wrong, never prove what happened.
PHIAccessEvent + BreakGlass sign each access — actor, resource hash, purpose-of-use, emergency window — independently replayable off-platform.
proof, not detection
$1.3B
PA admin waste
29% → adverse events
Cohere · Availity automate the decision. "No claim denied exclusively by AI" — the guideline version isn't signed, so appeals can't be replayed.
PriorAuthDecision binds guideline version + hash + reviewer + rationale to the verdict. Re-run the same inputs to prove consistency on appeal.
appeal-replayable
$63.8B
SaMD market '34
$11B '25 · 53 PCCPs
CDS Hooks · SaMD vendors fire inferences. No per-inference record binds device UDI, model weights and input to a signed timestamp.
DeviceInference + CDSDecision sign each inference against DeviceUDI + model-weights hash + PCCP version — FDA-auditable without internal access.
the inference, attested
07 · market

The provenance layer
under every clinical decision

Annual liability surface · global
$7.42M

Average cost of a single healthcare breach — the costliest sector worldwide for 14 straight years (IBM, global). On top sits $1.3B US prior-auth waste and a rising AI-malpractice surface. Every market mirrors the demand: EU GMP Annex 11, GDPR Art. 9 and the EU AI Act impose the same signed-record duty.

Adjacent device market · global
$63.8B

AI-enabled medical-device (SaMD) market by 2034, from $11B in 2025 (21.5% CAGR). Every FDA PCCP and EU AI Act high-risk device needs per-inference provenance that does not exist today.

One signing kernel · many buyers
Hospitals / IDNs
PHI + CDS
Payers
CMS-0057-F
SaMD makers
FDA PCCP
Pharma / CROs
21 CFR Part 11
Privacy offices
HIPAA audit
EU MDR vendors
AI Act
08 · honest state

What is built — and what is not.

Anima is not a clinical system and not a truth oracle. It does not assert that a CDS recommendation or a PA denial was medically correct — it attests that the decision was made, with these inputs, under this model or guideline, at this time, and lets anyone replay it. That distinction is the legal moat.

Built & tested today

  • 7 signing capsules — EIP-712, secp256k1, schemas published
  • 4 with Go↔Rust/WASM parity vectors in CI (CDS, PriorAuth, PHIAccess, Consent)
  • BreakGlass 24h HITECH window enforced in code
  • Part-11 two-factor signature ceremony enforced in StructHash
  • DeviceInference binds UDI + model-weights hash + PCCP version

Roadmap — not yet built

  • WASM parity tests for BreakGlass, ElectronicSignature, DeviceInference
  • FHIR / HL7v2 / DICOM codec implementations (doc.go stubs only)
  • gRPC / REST ingestion API (fintech is the reference architecture)
  • Ledger anchoring wired for the medical domain
  • Schema freeze to v1.0 — gated on first pilot partner sign-off

One signed chain:
which alert, what input, whose hand, when.

Irreversible on creation. Replayable without trusting the hospital's, payer's, or vendor's own systems.
For the first time, a clinical decision can prove itself.

Pilot the kernel → Read the brief →
anima.kernel · software secp256k1 · EIP-712 · Merkle ledger · medical vertical · © 2026