Confidentiality
Task-, role-, relationship- and application-specific access rather than indiscriminate record disclosure.
Safety & governance
Trust before automation.
CareStrand is designed around minimum-necessary access, source provenance, explicit permissions, meaningful human control and auditable workflow evidence.
!
Current status: prototype, not assured clinical deployment
The safeguards below are product architecture and demonstration controls. Formal local information governance, cyber-security, clinical-safety, accessibility and regulatory evidence must be completed before any production use.
Clinical safety
Defined intended purpose, hazard controls, source authority and human approval for clinically significant action.
Security
Organisation-controlled gateway, managed credentials, least privilege, monitoring and revocable application access.
Resilience
Clear degraded mode, source-system independence, retry and reconciliation rather than silent partial failure.
Context before AI
The intelligence provider should not receive “the whole record”.
CareStrand’s policy and Context Compiler filter the patient information before any approved application or model provider receives it.
Access decision
Role, purpose, care relationship, organisation and application determine whether access is permitted, limited, denied or emergency.
Context package
Only approved information groups and fields are assembled, with sensitivity rules and source provenance retained.
Governed output
The result is cited, reviewed and converted into a draft, task or approved action according to the permission tier.
App Passport
A connected application must declare what it is and what it may do.
CareStrand separates platform assurance from application assurance and local deployment assurance.
- Supplier, application, model and model version
- Intended purpose, users and patient population
- Required data and prohibited categories
- Permitted output and transaction scope
- Hosting, retention and training policy
- Evidence, regulatory status and known limitations
- Human approval, monitoring, rollback and revocation
Documentation application
3Draft output tier
✓Current encounter
×Restricted notes
HumanFinal approval
A model or permission change invalidates the previous approval evidence and requires review.
Permission ladder
No application expands its own authority.
Each capability is separately approved and can be suspended or revoked.
!
Not part of the initial deployment
Autonomous clinical action, unrestricted ordering, generic prescribing and silent alteration of the authoritative record.
Production assurance
What must be completed before live clinical use.
Information governance
- Controller and processor roles
- Lawful purpose and DPIA
- Transparency and retention
- Subprocessors and data location
Clinical and regulatory
- Intended-purpose analysis
- Clinical safety officer and hazard log
- Manufacturer and deployment safety cases
- Medical-device assessment where relevant
Technical and operational
- Independent security testing
- Identity, monitoring and incident response
- Downtime and disaster recovery
- Accessibility and usability evidence
Does CareStrand train models on direct-care data?
The intended default is no. Any secondary use for model development or research would need a separately defined purpose, governance, data minimisation and approval.
Who remains responsible for the clinical decision?
The clinician and clinical service retain responsibility for care, while CareStrand and connected suppliers remain responsible for safe design, reliable context, permissions, provenance, monitoring and their contractual obligations.
Can a clinician connect any AI tool they prefer?
Not where identifiable clinical information is involved. Applications must be approved by the organisation and receive only the permissions in their current App Passport.
What happens when the gateway is unavailable?
CareStrand should enter a clear degraded mode: already loaded information remains visible where safe, new remote actions pause, and source systems remain independently accessible.
Governance collaboration
Design the safety case with the organisation—not after the build.
We want to work with clinical, digital, information-governance, cyber and patient representatives to define a bounded demonstrator and evidence plan.
CareStrand is currently a synthetic prototype for demonstration and product development. It is not connected to production clinical systems and must not be used with identifiable patient information or for clinical decision-making.