Health Architecture & Specs
A deep dive into the HIPAA Provider Allowlists, the Deterministic ESI Safety Fence, NEWS2 Deterioration Engine, BLE Medical Device Integration, and the Surgical Holography pipeline powering Aeion Health.
Clinical & Compliance Metrics
Audit Immutability
100% (Database-Level Enforcement)
NEWS2 Parameters
6 Vitals Dynamically Scored (Respiratory Rate, SpO2, Systolic BP, Heart Rate, Temperature, AVPU)
Telehealth E2E
Mandatory for the HIPAA compliance profile
BAA Provider Allowlist
AWS Bedrock, Azure OpenAI BAA, Anthropic (BAA-covered)
ESI Safety Gate
Deterministic rules always override AI when more conservative
NEWS2 Range
0-20 composite score with calibrated risk bands
BLE Profiles
GLP, BPM, HTS, WSP, PLX (standard medical profiles)
Holographic Rendering
WebXR via the Neural Bus real-time pipeline — rolling out to all tenants; the system reports plainly when the feature isn't yet enabled rather than returning a partial render
1. The Immutable HIPAA Audit Trail
Aeion Health's audit trail is one of the most strictly enforced data protections on the platform.
Immutable by Design: To satisfy 45 CFR § 164.312(b), audit records cannot be deleted through the API — deletion is blocked outright at the collection's access-control layer for both the platform-wide audit trail and Health's AI-triage audit trail. The triage audit trail's clinician-override path layers a correction on top of a row rather than overwriting the original decision.
Mandatory Triggers: The platform's audit trail records eight action types — created, updated, deleted, published, archived, restored, imported, and exported — automatically capturing the actor, affected record, IP address, user agent, and a before/after diff.
Retention Sweep: A nightly job purges audit rows once they pass each collection's configured retention window (90 days by default platform-wide; Health's AI-triage audit trail defaults to 365 days). Tenants can extend retention per collection — for example to 7 years for SOC2 — via a tenant-level override.
2. Deterministic ESI Triage Safety Fence
Aeion Health's triage engine implements a two-layer system that guarantees patient safety regardless of AI model confidence.
Layer 1 — AI Triage Suggestion: The AI layer analyzes encounter data (chief complaint, vitals, patient summary) and suggests an acuity level. This is configurable — different clinical AI models can be substituted per tenant.
Configuration options. Three modes are available: AWS Comprehend Medical (runs under a signed BAA and extracts ICD-10 clinical entities), a general-purpose LLM (opt-in, off by default), or AI triage disabled entirely. Organizations on a strict BAA path typically choose Comprehend Medical; others can disable AI triage and run the deterministic fence alone.
Disagreement signal. When the AI suggestion and the deterministic rules disagree, the deterministic rules always win (safety) — and the disagreement is flagged in real time so quality dashboards or on-call paging can catch model drift.
Regulatory posture. The triage flow is designed against the 21st Century Cures Act §3060 Clinical-Decision-Support-exemption criteria — text-only output, advisory (it never auto-acts), and independently reviewable by the clinician. (Final regulatory classification is a legal determination.)
Layer 2 — Deterministic Safety Fence: A rules engine runs pure deterministic logic per the ESI Implementation Handbook (AHRQ, 4th edition):
- Level 1 — Resuscitation: Keywords like "cardiac arrest", "respiratory arrest", "unresponsive"
- Level 2 — Emergent: Vital signs in danger zones (SBP <90, HR >130, SpO2 <88%, RR >30), altered mental status, severe pain
- Level 3-5: Resource prediction based on chief complaint + abnormal vital count
The Reconciliation Rule: The system compares the AI suggestion against the deterministic ESI rules, and the more conservative (higher-acuity, lower number) always wins. A Level 4 AI suggestion with a Level 2 ESI determination produces a Level 2 final acuity.
Audit Immutability: Every analysis — successful, no-op, or error — writes a permanent audit record. Clinician overrides are layered on as additional metadata; the original record is never altered.
3. NEWS2 Deterioration Early Warning
| Parameter | 3 | 2 | 1 | 0 | 1 | 2 | 3 |
|---|---|---|---|---|---|---|---|
| Heart Rate | ≤40 | 41-50 | 51-90 | 91-110 | 111-130 | ≥131 | — |
| Systolic BP | ≤90 | 91-100 | 101-110 | 111-219 | — | 220+ | — |
| SpO2 | ≤91 | 92-93 | 94-95 | ≥96 | — | — | — |
| Temperature | ≤35.0 | 35.1-36.0 | 36.1-38.0 | — | 38.1-39.0 | 39.1+ | — |
| AVPU | — | — | — | A | V/P/U | — | — |
4. BLE Medical Device Integration
| Device Type | GATT Service UUID |
|---|---|
| Pulse Oximeter | 00001822-... |
| Blood Pressure | 00001810-... |
| Glucose Meter | 00001808-... |
| Thermometer | 00001809-... |
| Weight Scale | 0000181D-... |
| Heart Rate | 0000180D-... |
5. Surgical Holography Pipeline
Aeion Health generates WebXR holographic renders of DICOM imaging for surgical planning. Status: rolling out. The headset-casting and rendering orchestration is in place; the underlying DICOM volume-rendering pipeline is being finalized. Until it's fully enabled, the system clearly reports that holographic rendering isn't yet available rather than delivering a partial or inaccurate render. The pipeline below is the target design:
Rendering Pipeline (target):
- DICOM files loaded from Bridge local storage (PHI never leaves premises)
- The Neural Bus pipeline processes the DICOM data into a renderable volume (renderer finalization in progress — see status note above)
- Render target determined by GPU availability:
- Stereoscopic modes: Side-by-Side, Top-Bottom, MV-HEVC, or DICOM Volume Cast
- Streaming starts to target headsets via Bridge hardware bridge