Skip to content

feat(healthcare): coherent patient, drug-interaction check, contraindication gate #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
imran-siddique merged 2 commits into from
Jul 21, 2026
Merged

feat(healthcare): coherent patient, drug-interaction check, contraindication gate #55

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
09bcd1b
feat(healthcare): coherent patient, drug-interaction check, contraind…
imran-siddique Jul 21, 2026
157a83f
fix(healthcare): do not log the patient identifier in clear text
imran-siddique Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,22 @@ jobs:
if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
run: python validate_artifacts.py

healthcare:
runs-on: ubuntu-latest
defaults:
run:
working-directory: healthcare
steps:
- uses: actions/checkout@v7

- name: Set up Python 3.11
uses: actions/setup-python@v6
with:
python-version: "3.11"

- name: Run clinical engine tests
run: python -m unittest discover -s tests -v

embodied-action-receipts:
runs-on: ubuntu-latest
defaults:
Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ End-to-end integration examples showing cMCP, Agent Manifest, and TRACE working
|---|---|---|---|
| `embodied-action-receipts/` | Fixture-style offline verification for embodied action receipts: accepted chain, missing receipt, signature mismatch and valid controller rejection | Software-only fixtures | TRACE action-receipt evidence boundary |
| `financial-services/` | Corporate credit risk agent: six-step assessment with CDD, exposure and IFRS 9 guardrails on the write | SEV-SNP / TDX | EU AI Act Art. 9/12, CRR Art. 395, EBA/GL/2020/06, EU AML, DORA Art. 9 |
| `healthcare/` | Clinical decision agent: EU AI Act Art. 14 HITL deny on high-risk treatment plans | SEV-SNP / TDX | EU AI Act Art. 14, HIPAA |
| `healthcare/` | Clinical agent on a coherent ICD-10 patient: drug-interaction check feeds EU AI Act Art. 14 HITL and contraindication denies | SEV-SNP / TDX | EU AI Act Art. 14, HIPAA |
| `industrial-embodied-ai/` | Material-movement agent with cMCP authorization, an independent safety-controller boundary and offline-verifiable closed-session evidence | TEE / software-only development mode | OT security and industrial robot safety references |
| `multi-tenant-saas/` | HR SaaS with an EU tenant (enforcing GDPR residency/Art. 9) and a US tenant (advisory) on one catalog | TDX | GDPR Art. 6/9/44, customer DPA |
| `startup-tpm/` | 15-minute quickstart on any cloud VM with Trusted Launch | TPM 2.0 | Development / staging |
Expand Down
99 changes: 67 additions & 32 deletions healthcare/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
# healthcare: Clinical Decision Support Agent Demo

End-to-end demo of a hospital AI agent processing patient records through a cMCP Runtime with Cedar policy enforcement and signed TRACE Trust Records for healthcare regulatory compliance (EU AI Act Art. 14, HIPAA).
End-to-end demo of a hospital AI agent running a clinical assessment through a cMCP Runtime with Cedar policy enforcement and signed TRACE Trust Records for healthcare regulatory compliance (EU AI Act Art. 14, HIPAA).

The worked patient is a fictional 54-year-old with type 2 diabetes and hypertension. Diagnoses carry ICD-10 codes, medications carry dosing, and the agent runs a drug-interaction check whose result feeds the human-oversight guardrails, so a deny reflects the real safety outcome of the plan.

---

Expand All @@ -9,14 +11,17 @@ End-to-end demo of a hospital AI agent processing patient records through a cMCP
**1. EU AI Act Article 14 - human oversight for high-risk AI**
The Cedar policy blocks any treatment plan write where `patient_risk_category == "high"`. The deny response carries the policy's `@annotation` metadata as structured advice (`regulation: eu-ai-act-art-14`, `reviewer_role: attending-physician`), and the audit chain records the deny as machine-readable Art. 14 evidence.

**2. HIPAA PHI protection at the tool boundary**
All three tools are classified `compliance_domain: hipaa_phi` in the attested catalog. A Cedar rule forbids PHI tools when no attestation evidence is present, enforcing "PHI only flows through attested runtimes" at the policy layer.
**2. A medication-safety guardrail that fires on the assessment result**
The agent runs `ehr.drug_interaction_check` against the patient's current medications and documented allergies, then passes `has_severe_contraindication` into the write call. A Cedar rule blocks the write when a severe contraindication is present, so the guardrail acts on the actual interaction result rather than on a static flag.

**3. HIPAA PHI protection at the tool boundary**
All four tools are classified `compliance_domain: hipaa_phi` in the attested catalog. A Cedar rule forbids PHI tools when no attestation evidence is present, enforcing "PHI only flows through attested runtimes" at the policy layer.

**3. Cryptographic proof of the tool call sequence**
**4. Cryptographic proof of the tool call sequence**
Every call is recorded in a hash-chained audit log persisted to SQLite. Closing the session seals the chain into a signed `RuntimeClaim` (the TRACE Trust Record): which tools ran, in what order, what was denied - verifiable without trusting the agent process.

**4. Two demo paths**
Run without flags for the happy path (all three calls allowed). Run with `--trigger-hitl` to see the Art. 14 block fire with the advice payload.
**5. Three demo scenarios**
`--scenario standard` (all four calls allowed), `--scenario high-risk` (Art. 14 block on a high-risk patient), `--scenario contraindication` (a proposed drug that the patient is allergic to blocks the write).

---

Expand Down Expand Up @@ -44,6 +49,7 @@ Run without flags for the happy path (all three calls allowed). Run with `--trig
| server/mock_mcp_server.py |
| ehr.patient_record_lookup |
| ehr.clinical_decision_support |
| ehr.drug_interaction_check |
| ehr.treatment_plan_writer |
+------------------------------------------------------------------+
```
Expand Down Expand Up @@ -72,43 +78,45 @@ cd healthcare
CMCP_DEV_MODE=1 cmcp start --config cmcp-config.yaml
```

**Terminal 3 - happy path:**
**Terminal 3 - the three scenarios:**

```bash
cd examples
python healthcare/agent/clinical_decision_agent.py
```
# A. standard: performing plan, no interaction -> all four steps allow
python healthcare/agent/clinical_decision_agent.py --scenario standard

Expected output:
# B. high-risk patient -> Art. 14 human-oversight block on the write
python healthcare/agent/clinical_decision_agent.py --scenario high-risk

# C. a proposed drug the patient is allergic to -> contraindication block
python healthcare/agent/clinical_decision_agent.py --scenario contraindication
```
Patient: P-2024-008471 | Risk category: standard

[1/3] Calling ehr.patient_record_lookup ...
-> decision: allow
[2/3] Calling ehr.clinical_decision_support ...
-> decision: allow
[3/3] Calling ehr.treatment_plan_writer ...
-> decision: allow

Closing session <id> and fetching the signed TRACE Trust Record ...
Standard scenario:

=== TRACE Trust Record (signed RuntimeClaim) ===
{ "cmcp_version": "1.0", "trace": {...}, "gateway": {...}, "signature": "..." }
```

**HITL path:**

```bash
python healthcare/agent/clinical_decision_agent.py --trigger-hitl
Scenario: standard | Patient: [redacted PHI] | Risk category: standard

[1/4] ehr.patient_record_lookup ...
-> decision: allow active dx: E11.9, I10, E78.5
[2/4] ehr.clinical_decision_support ...
-> decision: allow Type 2 diabetes mellitus, suboptimal glycaemic control
[3/4] ehr.drug_interaction_check ...
-> decision: allow highest_severity=none
[4/4] ehr.treatment_plan_writer ...
-> decision: allow
```

Contraindication scenario (the patient has a documented sulfonamide allergy, so proposing co-trimoxazole trips a severe contraindication):

```
[3/3] Calling ehr.treatment_plan_writer ...
[3/4] ehr.drug_interaction_check ...
-> decision: allow highest_severity=severe
[4/4] ehr.treatment_plan_writer ...
-> decision: deny (POLICY_DENY)
advice from policy:
id: hitl-high-risk
reason: human-review-required
id: medication-contraindication
reason: severe-contraindication-detected
regulation: eu-ai-act-art-14
reviewer_role: attending-physician

Expand All @@ -133,7 +141,7 @@ permit (
};
```

On top of the workflow-scoped permits sit two forbid rules. Annotations on a `forbid` are returned to the caller as structured advice when that rule causes a deny:
On top of the workflow-scoped permits sit three forbid rules (high-risk human oversight, severe medication contraindication, and the HIPAA attestation gate). Annotations on a `forbid` are returned to the caller as structured advice when that rule causes a deny:

```cedar
@id("hitl-high-risk")
Expand All @@ -150,17 +158,34 @@ forbid (
};
```

The second forbid blocks the write when the drug-interaction check returned a severe contraindication:

```cedar
@id("medication-contraindication")
@reason("severe-contraindication-detected")
@regulation("eu-ai-act-art-14")
@reviewer_role("attending-physician")
forbid (
principal,
action == Action::"Ehr.treatmentPlanWriter",
resource
) when {
context.arguments has has_severe_contraindication &&
context.arguments.has_severe_contraindication == true
};
```

Action names follow the cMCP convention: `ehr.treatment_plan_writer` becomes `Action::"Ehr.treatmentPlanWriter"` (PascalCase per underscore segment). Tool arguments are available under `context.arguments`.

---

## The TRACE Trust Record

See `trace-output/example-trust-record.json` - captured from a real run of this demo. Key fields:
`trace-output/` holds one signed record per scenario (`standard-trust-record.json`, `high-risk-trust-record.json`, `contraindication-trust-record.json`), captured from real runs. Verify one with `cmcp verify trace-output/high-risk-trust-record.json` (schema, signature and audit chain pass; hardware attestation fails in software-only dev mode). Key fields:

| Field | Meaning |
|---|---|
| `trace.policy.bundle_hash` / `version` | Exactly which Cedar bundle was enforced (`clinical-hipaa-v2.1`) |
| `trace.policy.bundle_hash` / `version` | Exactly which Cedar bundle was enforced (`clinical-safety-v3.0`) |
| `trace.data_class` | Highest sensitivity touched in the session (`confidential`) |
| `trace.tool_transcript.hash` | Hash of the audit chain tip covering all calls |
| `trace.cnf.jwk` | The runtime's Ed25519 signing key (verifies `signature`) |
Expand Down Expand Up @@ -196,6 +221,16 @@ curl "http://localhost:8443/audit/export?session_id=<id>" | python3 -m json.tool

---

## The tests

`tests/test_clinical_engine.py` checks that diagnoses carry ICD-10 codes, that the differential matches the record, that an appropriate second-line agent is safe, and that a sulfonamide allergy and a drug-drug interaction are both detected.

```bash
python -m unittest discover -s tests -v
```

---

## Regulatory Variants

This demo uses EU AI Act Art. 14 and HIPAA as its primary policy example. Additional
Expand Down
Loading