HAREMed

Every patient. Every access. Every query. Proof.

HAREMed is designed to provide runtime governance for healthcare AI—producing cryptographic evidence intended to support HIPAA compliance workflows, patient consent enforcement, and PHI access tracking.

Sector Disclaimer: Vertical examples illustrate intended application domains. Sector-specific compliance requires independent legal and technical validation.

The Challenge

Healthcare AI Has a Proof Problem

You're deploying AI to assist with clinical workflows. But when your compliance officer asks "What patient data did the AI access for this decision?"—you can't answer.

What You Have Today

AI assistants touching patient data
Logs that document access but not enforcement
No proof of what data informed AI outputs
Manual compliance reviews after the fact
IRB asking questions you can't answer

What You're Missing

Proof of what data the AI accessed for any query
Evidence that patient consent was checked before access
Documentation showing HIPAA was enforced at runtime
Artifacts you can hand to auditors or regulators
Cryptographic proof, not just policy documents

HAREMD Workflow

Governed Patient Encounter

Every clinical AI operation passes through the Arbiter. Every decision produces cryptographic proof.

Intake: Create Patient Capsule

Nurse creates patient encounter capsule with demographics, intake notes, and vitals. Capsule carries policy and consent bindings from creation.

EXECUTE + PoA

PLAN: Physician Summary

Physician uses AI assistant to summarize patient history, risk factors, recent labs. Read-only mode—no state changes. Evidence of what was retrieved.

PLAN mode

EVAL: Proposed Clinical Plan

AI proposes assessment and treatment plan. Validation Gate checks against ground truth (labs, allergies, medications). Nothing committed yet—proposals only.

EVALUATE mode

Validation: Policy & Consent Check

Validation Gate confirms: consent covers this use, PHI access is within scope, policy permits this action. If PASS, physician can proceed.

Validation Gate

EXECUTE: Commit Assessment

Physician commits the finalized assessment and plan. Proof-of-Action generated with: actor identity, RLTA timestamp, validation result, policy snapshot.

EXECUTE + PoA

Audit: Export Proof Bundle

Compliance can export the full proof bundle: all PoAs, lineage entries, policy snapshots. Verifiable without trusting mutable logs.

Evidence Export

Capabilities

Governance Capabilities in HAREMed

Patient Consent Enforcement

Every AI operation is checked against the patient's consent bindings. No consent for research use? AI can't access that data for research queries.

PHI Access Tracking

Every piece of PHI accessed by AI is recorded with cryptographic proof. Not a log entry—an Evidence Artifact that proves what was accessed, when, and under what policy.

HIPAA Minimum Necessary

The Arbiter enforces minimum necessary access. AI can only access the specific data elements required for the current operation—nothing more.

Break-Glass with Evidence

Emergency access paths exist but are heavily evidenced. Break-glass produces enhanced proof artifacts for audit and review.

Research Data Governance

Separate consent rails for treatment vs. research. IRB requirements enforced at runtime. Data use agreements tracked and enforced.

Revocation with Continuity

Patient exercises right to revoke? Data access is crypto-shredded but lineage preserved. You can prove the revocation happened and was enforced.

Compliance Mapping

Regulatory Alignment

HAREMed mechanisms are designed to align with healthcare regulatory requirements. Regulatory interpretation and compliance determination remain deployer responsibility.

Regulation	Requirement	HARE Mechanism
HIPAA §164.502	Minimum necessary	Lane-scoped access with role-based filtering
HIPAA §164.524	Access to records	Patient-facing audit bundles with lineage
HIPAA §164.528	Accounting of disclosures	Evidence Artifacts as disclosure records
GDPR Article 17	Right to erasure	Revocation with crypto-shred, lineage preserved
GDPR Article 30	Records of processing	Evidence chain as processing record
21 CFR Part 11	Electronic records	Signed Evidence Artifacts, RLTA timestamping

Use Cases

Where HAREMed Applies

Clinical Decision Support

AI assistants helping physicians with diagnosis, treatment planning, medication review—with proof of what patient data informed each recommendation.

Medical Coding & Billing

AI-assisted coding with evidence of what clinical data was accessed. Audit-ready documentation for billing compliance.

Research Data Analysis

AI querying research datasets with IRB-approved consent enforcement. Proof of data use agreement compliance.