Every go-live is a decision someone can defend

Open cases

16

HIGH tier

5

Past their window

4

Weekly capacity

8

Weeks to clear

2

Capacity assumption, stated rather than implied: 2 review sessions a week, 4 cases per session. Every figure above is computed from the rows below — none of them is typed into the copy. Service windows by tier: HIGH 10 days, MEDIUM 15, LOW 20.

Queue audit log

No overrides this session. The log records every application and revocation, with its reason, approver, and expiry.

MH-AI-2026-014 · Chest imaging worklist prioritization. A critical finding that waits in the queue costs time a patient may not have — and a wrong ranking buries the sickest patient at the bottom. This model reorders the radiology worklist so likely-critical studies are read first.

HIGHscore 7 · MEDIUM at 3+, HIGH at 7+ · Ruleset v1.2 — informed by CHAI risk-categorization concepts. No CHAI endorsement is implied; the weights are Meridian's own.

Decision fingerprint: fnv1a:587cfd8f — computed from the canonical JSON of the case inputs and ruleset v1.2. Change an input above and it changes; change it back and the exact hex returns.

• E1 · Local validation on Meridian dataRequired — tier is HIGH

  Vendor numbers were earned on someone else's population. Performance is re-measured here before anyone relies on it.

  On file

• E2 · Subgroup performance reportRequired — clinical use at HIGH tier

  An average that looks fine can hide a group the model fails. Performance is broken out by the subgroups the use case touches.

  Not on file

• E3 · Privacy and security reviewRequired — data sources include PHI

  Data flows, access controls, and retention reviewed against the PHI handling obligations in the vendor agreement, under HIPAA where PHI is present.

  On file

• E4 · Model card on fileRequired — every case, every tier

  What the model is, what it was trained on, and where it is known to fail — written down before go-live, not reconstructed after an incident.

  On file

• E5 · Monitoring plan with a named ownerRequired — tier is HIGH

  A dashboard nobody owns is decoration. The plan names the person who looks, what they look at, and how often.

  On file

• E6 · Rollback plan with a named ownerRequired — tier is HIGH

  How the system is switched off, who can do it, and what the workflow reverts to — tested, not theoretical.

  On file

• E7 · Regulatory screenRequired — clinical use requires the screen

  A documented determination of whether the use falls under medical-device or other regulatory oversight, with the reasoning attached.

  On file

1. G1. A Clinical or Security block ends the review. It cannot be outvoted, averaged, or escalated around.
2. G2. A block from any other role also blocks. Blocks are resolved by fixing the objection, not by counting votes.
3. G3. A HIGH-tier case with any required evidence missing is blocked. The gate does not open on a promise to supply it later.
4. G4. Missing required evidence below HIGH tier, or any reviewer requesting evidence, returns the case for evidence.
5. G5. Any approval carrying conditions makes the whole decision conditional, with the conditions recorded on it.
6. G6. Only when none of the above applies is the case approved — with owners and a reassessment date attached.

Audit log — the trail a regulator reads first

1. 01 · 2026-02-03 (fictional) Intake received from Radiology service line.
2. 02 · 2026-02-04 (fictional) Risk tier computed under ruleset v1.2.
3. 03 · 2026-02-10 (fictional) Cross-functional review convened; all six roles recorded a position.
4. 04 · 2026-02-11 (fictional) Subgroup performance report (E2) requested from vendor; not yet on file.

{
  "auditTrail": [
    {
      "date": "2026-02-03 (fictional)",
      "event": "Intake received from Radiology service line."
    },
    {
      "date": "2026-02-04 (fictional)",
      "event": "Risk tier computed under ruleset v1.2."
    },
    {
      "date": "2026-02-10 (fictional)",
      "event": "Cross-functional review convened; all six roles recorded a position."
    },
    {
      "date": "2026-02-11 (fictional)",
      "event": "Subgroup performance report (E2) requested from vendor; not yet on file."
    }
  ],
  "caseId": "MH-AI-2026-014",
  "evidenceManifest": [
    {
      "because": "tier is HIGH",
      "id": "E1",
      "label": "Local validation on Meridian data",
      "onFile": true,
      "status": "required"
    },
    {
      "because": "clinical use at HIGH tier",
      "id": "E2",
      "label": "Subgroup performance report",
      "onFile": false,
      "status": "required"
    },
    {
      "because": "data sources include PHI",
      "id": "E3",
      "label": "Privacy and security review",
      "onFile": true,
      "status": "required"
    },
    {
      "because": "every case, every tier",
      "id": "E4",
      "label": "Model card on file",
      "onFile": true,
      "status": "required"
    },
    {
      "because": "tier is HIGH",
      "id": "E5",
      "label": "Monitoring plan with a named owner",
      "onFile": true,
      "status": "required"
    },
    {
      "because": "tier is HIGH",
      "id": "E6",
      "label": "Rollback plan with a named owner",
      "onFile": true,
      "status": "required"
    },
    {
      "because": "clinical use requires the screen",
      "id": "E7",
      "label": "Regulatory screen",
      "onFile": true,
      "status": "required"
    }
  ],
  "gate": {
    "outcome": "not yet run",
    "recorded": false
  },
  "intake": {
    "autonomy": "assistive",
    "clinicalContext": true,
    "dataSources": "DICOM images and order metadata from the radiology PACS. Contains PHI.",
    "decisionRole": "augment",
    "intendedUse": "Rank incoming chest radiographs by likelihood of a critical finding so the riskiest studies are read first.",
    "model": "TriageRank CXR",
    "oversight": "A radiologist reads every study regardless of rank; the model changes order, never disposition.",
    "owners": {
      "evidence": "Dr. Amara Osei (CMIO office)",
      "monitoring": "Dr. Lena Vasquez (Data Science)",
      "rollback": "Ruth Alvarez (Radiology Operations)"
    },
    "phi": "yes",
    "submitted": "2026-02-03 (fictional date)",
    "system": "Chest imaging worklist prioritization",
    "users": "Radiologists and radiology residents at Meridian Health (fictional).",
    "vendor": "Helix Imaging AI (fictional vendor)",
    "version": "3.2.0",
    "writeBack": "no"
  },
  "reviews": [
    {
      "decision": "Approve with conditions",
      "rationale": "Condition: quarterly subgroup review on portable and pediatric films, and ranking auto-disables if weekly case mix shifts beyond the agreed bounds.",
      "reviewer": "Dr. Amara Osei, CMIO office",
      "role": "Clinical"
    },
    {
      "decision": "Approve",
      "rationale": "Local validation on 41,200 Meridian studies holds up against the vendor claim. Monitoring thresholds are set and owned.",
      "reviewer": "Dr. Lena Vasquez",
      "role": "Data Science"
    },
    {
      "decision": "Approve",
      "rationale": "PHI stays inside the PACS boundary; no data leaves Meridian infrastructure. Retention unchanged from current radiology policy.",
      "reviewer": "Priya Nair",
      "role": "Privacy"
    },
    {
      "decision": "Approve",
      "rationale": "Read-only integration, no new external egress, vendor access reviewed. No objection.",
      "reviewer": "Marcus Webb, CISO office",
      "role": "Security"
    },
    {
      "decision": "Approve",
      "rationale": "Vendor holds the regulatory clearance for this indication; our use matches the cleared labeling.",
      "reviewer": "Daniel Cho",
      "role": "Legal / Compliance"
    },
    {
      "decision": "Approve",
      "rationale": "Rollback is a worklist-config flag, tested in staging on 2026-01-28 (fictional date). Reading-room workflow unchanged.",
      "reviewer": "Ruth Alvarez",
      "role": "Operations"
    }
  ],
  "risk": {
    "decisionHash": "587cfd8f",
    "floors": [],
    "rulesFired": [
      {
        "id": "R1",
        "label": "Decision role is augment — output shapes a human decision",
        "points": 2
      },
      {
        "id": "R3",
        "label": "Data sources include PHI",
        "points": 2
      },
      {
        "id": "R7",
        "label": "Used in a clinical context — errors can reach patient care",
        "points": 3
      }
    ],
    "ruleset": "v1.2",
    "score": 7,
    "tier": "HIGH"
  },
  "synthetic": true,
  "system": "Meridian Health (fictional) — AI governance review desk demonstration"
}

Where each field lands when someone asks about frameworks

The ISO/IEC 42001 column names clause themes, not clause numbers — quoting numbers this page cannot cite would be exactly the fabricated precision this desk exists to catch.