Health Architecture & Specs
A deep dive into the HIPAA Provider Allowlists, the Deterministic ESI Safety Fence, NEWS2 Deterioration Engine, BLE Medical Device Integration, and the Surgical Holography pipeline powering Aeion Health.
Clinical & Compliance Metrics
Audit Immutability
100% (Database-Level Enforcement)
NEWS2 Parameters
6 Vitals Dynamically Scored (Respiratory Rate, SpO2, Systolic BP, Heart Rate, Temperature, AVPU)
Telehealth E2E
Mandatory for the HIPAA compliance profile
BAA Provider Allowlist
AWS Bedrock, Azure OpenAI BAA, Anthropic (BAA-covered)
ESI Safety Gate
Deterministic rules always override AI when more conservative
NEWS2 Range
0-20 composite score with calibrated risk bands
BLE Profiles
GLP, BPM, HTS, WSP, PLX (standard medical profiles)
Holographic Rendering
WebXR via the Neural Bus real-time pipeline — rolling out to all tenants; the system reports plainly when the feature isn't yet enabled rather than returning a partial render
1. The Immutable HIPAA Audit Trail
Aeion Health's audit trail is one of the most strictly enforced data protections on the platform.
Immutable by Design: To satisfy 45 CFR § 164.312(b), audit records cannot be deleted through the API — deletion is blocked outright at the collection's access-control layer for both the platform-wide audit trail and Health's AI-triage audit trail. The triage audit trail's clinician-override path layers a correction on top of a row rather than overwriting the original decision.
Mandatory Triggers: The platform's audit trail records eight action types — created, updated, deleted, published, archived, restored, imported, and exported — automatically capturing the actor, affected record, IP address, user agent, and a before/after diff.
Retention Sweep: A nightly job purges audit rows once they pass each collection's configured retention window (90 days by default platform-wide; Health's AI-triage audit trail defaults to 365 days). Tenants can extend retention per collection — for example to 7 years for SOC2 — via a tenant-level override.
2. Deterministic ESI Triage Safety Fence
Aeion Health's triage engine implements a two-layer system that guarantees patient safety regardless of AI model confidence.
Layer 1 — AI Triage Suggestion: The AI layer analyzes encounter data (chief complaint, vitals, patient summary) and suggests an acuity level. This is configurable — different clinical AI models can be substituted per tenant.
Configuration options. Three modes are available: AWS Comprehend Medical (runs under a signed BAA and extracts ICD-10 clinical entities), a general-purpose LLM (opt-in, off by default), or AI triage disabled entirely. Organizations on a strict BAA path typically choose Comprehend Medical; others can disable AI triage and run the deterministic fence alone.
Disagreement signal. When the AI suggestion and the deterministic rules disagree, the deterministic rules always win (safety) — and the disagreement is flagged in real time so quality dashboards or on-call paging can catch model drift.
Regulatory posture. The triage flow is designed against the 21st Century Cures Act §3060 Clinical-Decision-Support-exemption criteria — text-only output, advisory (it never auto-acts), and independently reviewable by the clinician. (Final regulatory classification is a legal determination.)
Layer 2 — Deterministic Safety Fence: A rules engine runs pure deterministic logic per the ESI Implementation Handbook (AHRQ, 4th edition):
- Level 1 — Resuscitation: Keywords like "cardiac arrest", "respiratory arrest", "unresponsive"
- Level 2 — Emergent: Vital signs in danger zones (SBP <90, HR >130, SpO2 <88%, RR >30), altered mental status, severe pain
- Level 3-5: Resource prediction based on chief complaint + abnormal vital count
The Reconciliation Rule: The system compares the AI suggestion against the deterministic ESI rules, and the more conservative (higher-acuity, lower number) always wins. A Level 4 AI suggestion with a Level 2 ESI determination produces a Level 2 final acuity.
Audit Immutability: Every analysis — successful, no-op, or error — writes a permanent audit record. Clinician overrides are layered on as additional metadata; the original record is never altered.
3. NEWS2 Deterioration Early Warning
| Parameter | 3 | 2 | 1 | 0 | 1 | 2 | 3 |
|---|---|---|---|---|---|---|---|
| Heart Rate | ≤40 | 41-50 | 51-90 | 91-110 | 111-130 | ≥131 | — |
| Systolic BP | ≤90 | 91-100 | 101-110 | 111-219 | — | 220+ | — |
| SpO2 | ≤91 | 92-93 | 94-95 | ≥96 | — | — | — |
| Temperature | ≤35.0 | 35.1-36.0 | 36.1-38.0 | — | 38.1-39.0 | 39.1+ | — |
| AVPU | — | — | — | A | V/P/U | — | — |
4. BLE Medical Device Integration
| Device Type | GATT Service UUID |
|---|---|
| Pulse Oximeter | 00001822-... |
| Blood Pressure | 00001810-... |
| Glucose Meter | 00001808-... |
| Thermometer | 00001809-... |
| Weight Scale | 0000181D-... |
| Heart Rate | 0000180D-... |
5. Surgical Holography Pipeline
Aeion Health generates WebXR holographic renders of DICOM imaging for surgical planning. Status: rolling out. The headset-casting and rendering orchestration is in place; the underlying DICOM volume-rendering pipeline is being finalized. Until it's fully enabled, the system clearly reports that holographic rendering isn't yet available rather than delivering a partial or inaccurate render. The pipeline below is the target design:
Rendering Pipeline (target):
- DICOM files loaded from Bridge local storage (PHI never leaves premises)
- The Neural Bus pipeline processes the DICOM data into a renderable volume (renderer finalization in progress — see status note above)
- Render target determined by GPU availability:
- Stereoscopic modes: Side-by-Side, Top-Bottom, MV-HEVC, or DICOM Volume Cast
- Streaming starts to target headsets via Bridge hardware bridge
typescript
// Example: Run a triage analysis with the ESI safety fence// Handles: fetching encounter + vitals, running the AI suggestion,// running deterministic ESI rules, reconciling (more conservative wins),// writing an immutable audit record, and emitting workflow events.const { data: analysis } = await aeion.api.post( `/v1/health/triage/${encounterId}/analyze`, { chiefComplaintOverride: "severe chest pain and shortness of breath" },);
// analysis.finalAcuity === the conservative pick (AI vs ESI)// analysis.id === immutable audit row ID// analysis.disagreement === set when the AI suggestion and ESI fence disagreed
// Example: recording vitals automatically triggers NEWS2 evaluationconst { meta } = await aeion.api.post(`/v1/health/encounters/${encounterId}/vitals`,{vitals: [{ type: "hr", value: 135, unit: "bpm" },{ type: "bp", value: 88, unit: "mmHg" },{ type: "spo2", value: 90, unit: "%" },{ type: "rr", value: 28, unit: "breaths/min" },],},);// meta.news2.score === 15 (High risk)// meta.news2.level === "high" (rapid-response triggered)You cannot run a HIPAA-compliant SaaS if your underlying AI providers are not compliant. Aeion OS tenants operating under the HIPAA compliance profile are structurally restricted: the platform enforces provider allowlists for both speech-to-text and language-model processing, physically preventing patient data from ever reaching an unauthorized endpoint. Data can only be sent to providers where Aeion holds an executed BAA (e.g., Azure OpenAI Service BAA, AWS Bedrock, AWS Transcribe Medical).
Patient MRNs, Lab requisition IDs, and Rx numbers are enforced unique per tenant at the database level. A duplicate value is rejected outright, so two concurrent registrations can never collide on the same identifier.
Bed allocation uses atomic updates to prevent double-booking under concurrent admissions. Transfers automatically cascade bed status changes (current bed → cleaning, new bed → occupied) with conflict resolution. Ward signage integration pushes admission notifications to Bridge-connected bedside displays.
Admission and discharge emit structured events that Blueprint automations can subscribe to, triggering downstream workflows like billing, reporting, and family notifications.