rotascale
Sign in See it live

Solutions — sector

A denial is a clinical decision. Name who authorised it.

Clinical software has carried authorisation and audit for thirty years, and all of it assumes a person: a clinician signs, a pharmacist checks, a coder reviews. An agent works in the gaps between those moments, at a volume nobody samples, and the audit trail underneath it was built to answer who typed this rather than under whose authority did this run.

EU AI Act Annex III · GDPR Art. 9 National health and data protection authorities not mapped
Status
High-risk under Annex III where used in triage or eligibility
Applies to
Prior authorisation, documentation, safety, clinical operations

Special category data, treated as such

Article 9 puts health data in its own class, and the platform's position is that special category attributes are declared and never inferred. Rotascale does not read clinical free text looking for a diagnosis, and does not guess at one from a code or a referral pattern.

That is a design decision with a cost, and it is the right one. A detector that infers a condition has created special category data about a patient in order to protect it, in a system that was not asked to hold any. What the platform does detect is identifiers with a checksum — a Medicare number, an IBAN — where a wrong answer is arithmetic rather than judgement.

Deployed where the records already are

Single-tenant inside your environment, up to and including airgapped. No payload reaches us on any code path, and a deployment configured to reach a service outside your network refuses to start rather than doing it quietly. The evidence a supervisor eventually reads is produced on your infrastructure and signed by a key you can hold yourself.

Which matters here more than elsewhere: the governance layer for a clinical estate cannot be the one component that ships records to a third party.

Scope

Not a medical device
RotaGrant is not cleared as one and is not a component of anyone's cleared device. Where your system is regulated as SaMD, that burden sits with you and this software does not reduce it — it governs what the agents around it are permitted to do.
No BAA, because no PHI
We hold no HIPAA attestation and sign no business associate agreement. The deployment model is the reason: nothing reaches us to be an associate of. Confirm that against your own network controls rather than our word for it.
Evidence, not interpretation
The platform assembles what happened and names what it could not find. Whether that satisfies a regulator is a clinical and legal judgement that stays with you, and every pack says so inside its own signature.

A clinical decision-support system is a different conversation, and the useful first question there is your regulatory strategy rather than your governance platform.

The agents your teams are about to ship

Four places where an agent already acts, and the specific thing that goes wrong in each.

  1. 1 authority Is there any authority for this?
  2. 2 status Is the grant active?
  3. 3 window Is now inside the grant's window?
  4. 4 scope Does the grant cover this action?
  5. 5 clean_context Was the context clean, where that is required?
  6. 6 bounds Do the per-action limits hold?
  7. 7 policy Does the policy on the grant permit it?
  8. 8 budget Is there room under the ceiling?
  9. 9 review Does this need a person?
Nine gates, evaluated in this order before the action. The lit ones are the gates that hold the four agents below — which is what differs between one industry and the next. The order does not.
Prior authorisation agent authority

Assembles the clinical case for a procedure, checks it against policy, and issues the determination.

Consequential action
Denies or approves a course of treatment
What goes wrong
A denial is a clinical consequence for a patient. If nobody can name the human whose authority the agent acted under, there is no one to appeal to.
What is recorded
The accountable clinician or administrator behind the grant, and the determination with its reasoning.
Pharmacovigilance triage clean_context

Reads adverse event reports from many sources, deduplicates, codes, and prioritises what a safety physician sees first.

Consequential action
Deprioritises a report below the review threshold
What goes wrong
It ingests a narrative from an untrusted source and lets its content steer the triage. The failure is silent: nobody reviews what was never surfaced.
What is recorded
Which content was untrusted, where it entered the trajectory, and whether the decision downstream of it was permitted to stand.
Clinical documentation agent scope

Drafts notes and updates the record from the encounter, so clinicians stop typing at 9pm.

Consequential action
Writes to the patient record of record
What goes wrong
Write scope that was drawn for drafting quietly covers amendment. An agent editing history is a different product from an agent writing notes.
What is recorded
Every write with the scope that permitted it, and the refusal of every write that exceeded it.
Cohort and trial matching agent bounds

Searches records to find patients eligible for a study or an intervention.

Consequential action
Exports a patient cohort out of the clinical system
What goes wrong
The query that was supposed to return eleven patients returns eleven thousand, and the export happens before anyone reads the number.
What is recorded
The bound that was set, the size that was attempted, and the refusal.

Ambition is the point of these: none of them is a chatbot. Each is an agent taking an action with a consequence somebody has to answer for — which is exactly the moment a bounded authority stops being paperwork and starts being the reason the project is allowed to ship.

What your information governance board will ask

Not hypothetical questions. These are the ones that arrive in writing, with a deadline, and the honest answer to most of them is a query rather than a project.

What patient data left the building?
None reaches Rotascale on any code path — the platform runs single-tenant inside your environment, including airgapped, and the deployment refuses to start if a setting selects a service outside your network.
Which model made this determination, and was it the one we validated?
The model version is inventoried and sealed into the decision record. A pack states what was deployed when the decision was made, not what is deployed now.
Can a clinician see why the agent stopped?
The refusal names the gate and the reason in the console, in the same vocabulary the policy was written in — not a stack trace and not a generic error.
Who signed off the authority this agent holds?
A grant carries the named human who issued it, what it permits, and when it expires. Revoking it stops every agent below it in the same act, and a rehearsal proves the blast radius before you need it.

Identifiers this deployment verifies here

Every one of these is a checksum, not a shape. The claim is “this is a valid Medicare number and the check digits agree”, not “this looks like one” — which is why the count on a screen can be cited rather than caveated.

FamilyHow it is verified
Australian Medicare number — weighted check digit
National identifier (PL, BE, NO) — scheme-specific weighted checksum
US Social Security Number — structural rules only — asserted, not observed
Bank account (IBAN) — mod-97 over the rearranged string

And what it does not look for. Names, addresses and dates of birth in free text carry no checksum, and finding them needs a model this deployment does not run. Neither are card numbers, medical record numbers, or national schemes beyond the three above. A clean screen means no verified identifier was found — never that the payload holds no personal data.

Written for this sector

13 posts touch this sector — the five most recent are above.

RotaGrant ships no clause map for Healthcare. The engine takes clause maps as data, so one can be authored — by you, by your counsel, or with us — and it will be scored like any other. What this page will not do is imply a mapping that does not exist, because a readiness percentage against an instrument nobody encoded is a number with no denominator.

See it on your own problem

Bring the agent closest to a patient record. We will draw the write scope where your IG board would draw it, then try to exceed it, and show you what the refusal looks like to the clinician.

A walkthrough is a working deployment with your clinical safety and IG leads in the room, not a slide deck — bring the agent you are most nervous about and we will put it behind a grant while you watch. If you would rather look first, the demo needs a work address and one click.

Healthcare walkthrough See the live demoOr talk to sales →