Status: proposed charter; counsel and reviewers must approve before pilot
Owners: clinical safety chair and community co-chair
ContextSafe turns reviewed expectations into executable assertions. That creates authority and risk. Governance exists to prevent technical convenience, sales pressure, or a single expert from becoming an unexamined clinical rule.
Clinical correctness and respectful representation are separate approval domains. Neither is reduced to the other.
Minimum before pack 1.0:
- one independent clinical informaticist as clinical safety chair;
- one independent laboratory medical director or clinical chemist;
- one interoperability specialist;
- at least two compensated transgender/nonbinary reviewers, one serving as community co-chair;
- one privacy/security reviewer;
- one accessibility/language reviewer;
- founder/product and technical lead, without unilateral clinical approval;
- legal counsel as non-voting advisor.
Seek racial, disability, age, socioeconomic, nonbinary, and care-setting breadth. Do not claim that a small group represents all trans people.
| Artifact/decision | Required approval |
|---|---|
| Technical parser/mapping | technical lead plus interoperability reviewer |
| Clinical oracle or assertion | two clinicians, including relevant specialist; lab lead for LIS content |
| Representation, names, pronouns, scenario language | community co-chair plus one additional community reviewer |
| Privacy boundary | security/privacy lead |
| EN/ES release | accessibility lead, professional translator, community reviewer |
| Pack release | clinical safety chair and community co-chair; technical release owner |
| Accepted clinical residual-risk disposition | customer clinical owner owns local operational risk and release decision; ContextSafe clinical chair independently confirms the governed expectation, severity, and bounded disposition record; both sign and neither substitutes for the other |
| Intended-use/marketing claim | founder, clinical chair, community co-chair, and counsel |
| Assertion withdrawal | either clinical chair or community co-chair may impose immediate temporary hold |
Silence is not approval. Approval includes name/pseudonym, role, date, version, conflicts, rationale, and signature. The ContextSafe chair's signature on an accepted clinical residual risk does not make the customer's release decision; it confirms only the clinical expectation, severity, and boundedness of the recorded disposition. Refusal by either required signer prevents the receipt from representing that risk as accepted.
| Activity | Founder | Clinical chair | Lab lead | Community co-chair | Technical | Security | Counsel |
|---|---|---|---|---|---|---|---|
| Research priorities | A/R | C | C | C | C | C | I |
| Case content | R | A | C | A | C | C | I |
| Assertion predicate | C | A | A where lab | C | R | I | I |
| Source sufficiency | C | A | A where lab | C | R | I | I |
| Pack release | R | A | C | A | C | C | I |
| Security boundary | C | I | I | C | C | A | C |
| Legal claims | R | C | I | C | I | C | A |
| Emergency withdrawal | R | A | C | A | C | C | C |
Dual accountabilities reflect independent safety domains; a release needs all named approvals.
Evidence priority:
- Normative published standard or regulator source.
- Peer-reviewed systematic guidance or professional-society consensus.
- Peer-reviewed study or case report.
- Documented local clinical policy approved by the partner.
- Expert consensus recorded through the governance process.
- Community testimony for experience, language, and harm—not as a substitute for clinical evidence.
Every source records stable URL/identifier, title, publisher, version/date, retrieval date, applicable claim, limitations, and re-review date. Continuous-build standards are labeled as such and pinned to a commit or dated package where possible.
A single case report can motivate a test hazard, but does not establish a universal treatment rule.
Top-level claim: For the named non-production scope, ContextSafe produces a traceable and reviewable comparison between approved synthetic expectations and observed evidence without making patient-specific clinical decisions.
Subclaims:
- SC-01: the pack semantics distinguish identity, administrative records, and clinical context;
- SC-02: assertions have sufficient reviewed evidence and validity controls;
- SC-03: evidence and results are reproducible and tamper evident;
- SC-04: missing evidence cannot produce pass;
- SC-05: clinical and community review cannot be bypassed by automation or sales;
- SC-06: output communicates limitations and unresolved risk;
- SC-07: synthetic execution is isolated and cleaned up;
- SC-08: invalid packs and prior receipts can be withdrawn.
Release evidence for these subclaims is enumerated in Release checklist.
| Hazard | Control | Release evidence |
|---|---|---|
| HAZ-01: GI used as clinical proxy | distinct schema, A-020, negative fixtures | test report |
| HAZ-02: missing LIS range looks normal | A-027–A-030, XFAIL fixture | seeded-fault evaluation |
| HAZ-03: deadname exposed | context-specific display assertions and minimization | accessibility/manual review |
| HAZ-04: uncertain expectation encoded as truth | oracle status, dual review, indeterminate outcome | approval ledger |
| HAZ-05: synthetic record affects operations | namespace, suppression, dry run, cleanup | pilot attestation |
| HAZ-06: real PHI ingested | no-PHI boundary and fail-closed preflight | canary test/tabletop |
| HAZ-07: receipt treated as certification | bounded claims, watermark, contract, comprehension test | counsel/claims review |
| HAZ-08: community consultation is extractive | pay parity, decision rights, withdrawal, conflict policy | compensation and approval records |
This section is planning guidance, not legal advice. US healthcare and state rules change; licensed counsel must review the actual product, contracts, claims, customers, and jurisdictions.
Intended v1 use is quality assurance in a synthetic, non-production environment. It compares staged system behavior with a pre-approved test oracle. It does not analyze a real patient's data, recommend diagnosis/treatment, control a device, select a patient-specific reference interval, or provide an alert used in care.
That intended use may reduce—but does not eliminate—FDA device-software risk. Before pilot and each new clinical function, counsel must analyze the shipped function and claims against FDA's January 2026 Clinical Decision Support Software guidance and document whether the function is a device, non-device CDS, enforcement-discretion function, or another category. Marketing and actual use must match. RIS/DICOM, live CDS evaluation, production canaries, automated clinical recommendations, or patient-specific inputs trigger a fresh analysis.
ContextSafe does not practice medicine: it does not create local clinical policy, diagnose, prescribe, select treatment, or tell a clinician how to manage a real patient. A licensed customer clinical owner approves local or disputed clinical expectations.
ContextSafe does not practice law: it does not declare compliance, interpret regulations for a customer's facts, or provide legal conclusions. Counsel reviews claims and contracts. “UPL” and unauthorized/unlicensed practice of medicine risks must be evaluated per state; labels alone are insufficient if conduct crosses the boundary.
V1 contractually and technically excludes PHI. Synthetic data are not automatically de-identified data, and a customer mistake can introduce PHI. Counsel determines whether ContextSafe is a business associate for each delivery model; do not claim “HIPAA does not apply” categorically. If PHI is suspected, stop and follow incident response.
Also review applicable state health-data, biometric, breach, employment, and consumer-protection laws. The safest posture is not to collect the data.
HL7, FHIR, DICOM, and ASTP/ONC materials inform the test. ContextSafe is not an HL7 or government certification unless formally authorized. Avoid official logos or wording that implies endorsement. Certification test methods can be inputs; ContextSafe's installed-workflow receipt is a different claim.
Federal and state nondiscrimination requirements are legally and politically volatile. ContextSafe should sell consistent patient safety and data integrity, not promise that a receipt proves compliance with any current civil-rights regime. Counsel owns legal updates; governance owns patient-safety continuity even when certification requirements change.
Before paid pilot, obtain:
- master services and scoped SOW;
- no-PHI/data-boundary schedule;
- customer responsibility for staging isolation, local clinical policy, release decision, and cleanup;
- confidentiality and security incident duties;
- intellectual-property terms for core pack, local mappings, and feedback;
- limitation-of-liability and indemnity review;
- no-third-party-beneficiary and no-certification language where appropriate;
- publication/case-study consent;
- technology E&O, cyber, and any counsel-recommended professional/medical coverage.
Do not use disclaimers to excuse negligent methods or known defects.
Allowed with evidence:
- “evaluated 36 governed assertions across four named checkpoints”;
- “detected a mismatch between these observed fields”;
- “the partner rerun no longer reproduced finding F”;
- “the receipt passed integrity verification.”
Disallowed:
- “certifies trans-safe care”;
- “proves compliance”;
- “eliminates bias”;
- “covers every transgender patient”;
- “clinically correct reference ranges for trans people”;
- “FDA-approved,” “ONC-certified,” or “HL7-certified” without actual authorization;
- “no real competitor” as a fact.
Every external artifact shows scope, date, pack version, system versions, exclusions, indeterminate count, and the statement that results are not patient-specific medical advice or certification.
- Reviewers disclose relevant vendor, employer, research, advocacy, and financial relationships.
- A source author may advise but does not solely approve an assertion relying on their work.
- Community and clinical reviewers receive comparable expert compensation for comparable work.
- Customer-funded local assertions are labeled local and cannot enter core solely because the customer paid.
- Sales targets never determine pack content, severity, or finding closure.
- Reviewer dissent is preserved in decision records.
Proposal → evidence review → clinical/community review → fixture evaluation → release note → customer notification.
A customer may appeal applicability, technical observation, or clinical expectation. The original evidence is frozen. An independent reviewer not involved in the original decision evaluates the appeal. The receipt retains the original and appeal outcomes.
If an assertion may cause harm or materially wrong results:
- Clinical chair or community co-chair places it on hold.
- Pack registry marks affected versions withdrawn within one business day.
- Customers with affected receipts are notified directly.
- Receipt verifier reports the withdrawal.
- Governance determines correction, replacement, or retirement.
- Prior receipts remain immutable but visibly invalidated for reliance on that assertion.
Review quarterly and before each pack release:
- HL7 Gender Harmony published and continuous builds;
- FHIR extension packages and US Core/USCDI changes;
- HL7 v2 Gender Harmony adoption;
- DICOM Supplement 233;
- ASTP/ONC certification/test-method changes;
- FDA CDS and device-software guidance;
- peer-reviewed laboratory guidance and safety reports;
- applicable federal/state privacy and practice rules.
Automated change detection may alert; a named qualified human determines relevance.
Before pilot:
- charter signed;
- reviewer roster and compensation approved;
- conflict disclosures complete;
- core case necessity review complete;
- intended-use/legal memo complete;
- at least pack 0.1 dual-approved;
- dispute, withdrawal, and incident table-tops complete.
Before v1:
- pack 1.0 approvals and dissent published in the private release ledger;
- all high hazards have evidence;
- one external pilot reviewed by the group;
- reviewer workload and wellbeing retrospective complete;
- next review dates funded and scheduled.