Healthcare · 13 linked questions

Clinical Documentation Copilot for a Multi-National Hospital Network

A caselet: architect a GDPR-compliant, in-region Claude system over an existing clinical-notes RAG pipeline, holding a p95 < 3s point-of-care SLA and a fixed budget — while the CISO, an outage, and Legal reshape the constraints mid-flight.

One evolving scenario Questions build on the context Rate your confidence

How to use it · Read the brief, then work top to bottom — the situation evolves as you go. Rate your confidence before submitting; on review, the “ confident & wrong” questions are the misconceptions worth fixing first. A study tool, not the graded exam.

The scenario

Meridian Health operates hospitals across the EU and the US and wants a Claude-powered copilot that drafts clinical summaries, answers questions over a patient's chart, and surfaces relevant prior notes at the bedside. An existing RAG pipeline already indexes clinical notes, but it was built for internal analytics and does not enforce who may see which patient's data. You must productionize it for point-of-care use without moving PHI out of its region of origin and without exceeding an approved annual budget.

Architecture: Retrieval-augmented Claude copilot: clinician query -> retrieval over a per-region clinical-notes vector store -> Claude generates a grounded summary/answer with citations back to source notes. Human clinician remains the decision-maker; the system is decision-support, not autonomous.
Existing stack: OpenSearch/pgvector hybrid index over de-identified-for-analytics clinical notes; embedding + chunking pipeline already running; an internal identity provider (OIDC) that already models clinician-to-patient care relationships and department scopes. No Claude fine-tuning is planned or available.
Compliance: GDPR (EU patients) plus HIPAA/BAA-style obligations (US patients). Signed BAA/DPA required with any processor. PHI must not appear in application or model-provider logs. Auditable access trail per clinician per patient.
Regions: EU patient data must stay in-region (EU data residency); US patient data stays in US. Two active regions today (eu-central, us-east); a third EU region is planned. No cross-region PHI replication.
Budget: Fixed approved annual envelope for inference + platform; roughly 60 percent already earmarked for real-time bedside traffic, leaving limited headroom for bulk/back-office workloads.
SLA: Point-of-care interactive p95 < 3s end-to-end (retrieval + generation + guardrails). Back-office/overnight documentation workloads have no interactive SLA and may run asynchronously.

Keep this context in mind — later questions build on it, and the situation evolves as you go.

0 of 13 answered

P3 · Q1Data residency and provider platform selection
Meridian needs EU patient data to remain in the EU while still using Claude. Which deployment approach best satisfies the residency requirement for the copilot?
How confident are you?
P1 · Q2Access control in RAG retrieval
The existing index does not restrict which clinician can retrieve which patient's notes. What is the most robust way to enforce per-clinician access scoping in the copilot?
How confident are you?
P3 · Q3Latency budgeting for an interactive SLA
Bedside interactions must hold p95 < 3s end-to-end. Which design choice most directly protects that budget without degrading answer quality?
How confident are you?
The situation changes
The CISO joins and mandates fail-closed safety
A newly hired CISO reviews the design and issues two non-negotiables. First, every request must pass input and output guardrails that are fail-closed: if a guardrail service is unavailable or errors, the request must be blocked, never allowed through unchecked. Second, PHI must never be written to application logs, traces, or the model provider's logs — observability has to work without persisting patient content. The team must now revisit its safety and logging posture before go-live.
P5 · Q4Fail-closed guardrailsSelect 2
Given the CISO's fail-closed mandate, which TWO behaviors correctly implement the guardrail layer for the bedside copilot?
How confident are you?
P4 · Q5Observability without persisting PHI
The CISO forbids PHI in any logs, but the team still needs to debug and monitor the copilot. Which approach best reconciles the two?
How confident are you?
P6 · Q6Cost control with asynchronous batch
A large overnight job re-summarizes the day's discharge notes for the records team. With most of the budget reserved for bedside traffic, how should this workload run?
How confident are you?
The situation changes
An unplanned regional outage
During a peak afternoon, the eu-central managed-platform endpoint suffers a partial outage and interactive requests there begin failing the p95 target. Leadership asks whether EU bedside traffic can temporarily fail over to the healthy us-east region to keep the copilot available. The residency constraint (no cross-region PHI) has not changed.
P3 · Q7Failover under residency constraints
What is the most appropriate response to the eu-central outage, given the unchanged residency rule?
How confident are you?
P5 · Q8Escalation policy vs model confidence
The team must decide when the copilot should stop and route a case to a human or a stricter workflow. What should trigger escalation?
How confident are you?
P4 · Q9Grounding and hallucination control
Clinicians report the copilot occasionally asserts facts not present in the retrieved notes. Which change most directly reduces this while keeping the interactive path fast?
How confident are you?
The situation changes
Legal adds a data-retention requirement
Legal issues a new requirement: copilot-generated content that becomes part of the medical record must follow the same clinical retention schedule, while derived artifacts that are NOT part of the record (transient prompts, intermediate retrieval sets, guardrail telemetry) must be minimized and purged on a short, defined timeline. Right-to-erasure requests for EU patients must be honored across the copilot's stored data.
P6 · Q10Retention and right to erasureSelect 2
Which TWO measures best satisfy Legal's retention and erasure requirements?
How confident are you?
P4 · Q11Pre-production evaluation
Before go-live, how should the team gain confidence that the copilot is safe and accurate enough for bedside use?
How confident are you?
P1 · Q12Auditability of access
Compliance asks for proof of exactly which clinician accessed which patient's information through the copilot. What best provides this?
How confident are you?
P5 · Q13End-to-end compliance postureSelect 2
At final architecture review, which TWO statements correctly describe the copilot's compliance-by-design posture across everything established in this caselet?
How confident are you?

All case studies