AcceleratorsCareSync
CareSync AI
A multi-agent FHIR care orchestrator that turns a complex patient’s real record into a citation-backed, role-routed action plan. The LLM proposes; three deterministic layers hold veto power.
See All Screens
The problem
Top 5% of patients, half of the spend
The top ~5% of complex patients drive roughly half of all U.S. healthcare spend, yet each one requires a care coordinator to manually reconcile conditions, labs, medications, encounters, and SDOH screenings scattered across 8–12 open tabs before writing a single note.
30–60
min
manual chart reconciliation per complex patient (CHF + diabetes + depression + SDOH-positive)
140
patients on a typical coordinator panel; the math does not close manually
6
/ day
patients a coordinator can realistically review by hand today
Every hour lost to manual reconciliation is an hour not spent finding the missed HbA1c, the overdue cardiology follow-up, or the positive housing-insecurity screen: the exact gaps that turn into a preventable 30-day readmission or a missed HEDIS measure.
Architecture
Four agents, one bundle, one orchestrator
A central Orchestrator fetches a single $everything bundle from HAPI and dispatches three reader agents in parallel via a race-based async-iterator merge. Their findings, not the raw bundle, feed the Action Planner, which is the only agent that writes FHIR Tasks.
Risk Agent
Risk scoring
reads Condition, Observation, MedicationRequest
Emits risk score + level, readmission probability.
Care Gap Agent
Preventive gaps
reads Condition, Observation
Emits missing preventive care, LOINC-coded gaps.
SDOH Agent
Social barriers
reads QuestionnaireResponse (AHC-HRSN)
Emits social barriers, resource mapping.
Action Planner
The only agent that writes
reads the three agents’ findings, not the raw bundle
Emits prioritized FHIR Tasks, role-routed.
Each agent is a structured-output function call over the Responses API, streamed token-by-token over SSE: the user watches the reasoning arrive, the way they’d watch a care team think out loud, not wait on a black box.
Safety chain
Three deterministic gates hold veto power
The recurring lesson of the build: the LLM is a proposal layer, never the authority. Every safety property that matters is enforced by a pure function sitting after the model call, not by a prompt instruction asking it to “be careful.”
01
Runtime citation validator
Every agent output requires a fhirResourceId on each finding. A pure function checks it against the Set of IDs actually present in the retrieved bundle and drops any miss, logged to the audit trail. A second pass redacts unverified ResourceType/id mentions from the streamed prose itself, via a 96-char lookahead buffer.
Unit-tested in isolation · hallucinated IDs reduced to zero in measured
02
Deterministic risk-level clamp
The Risk Agent’s 0–100 score is post-processed: high/critical requires at least one strong bundle-evidence anchor (multi-condition comorbidity, discharge ≤30 days, or an abnormal lab), and a zero-anchor bundle is forced to low regardless of what the model proposed.
Recovered dev-labeled specificity 0% → 84.6% (held-out 100%)
03
Parity mitigation, not just measurement
Demographic parity (age × sex × race × ethnicity) is computed live from US Core extensions. A pure function flags strata beyond a disparity threshold (small-sample cutoff at n=3); the flag renders on the Governance page and writes an audit row with reason ‘flagged’.
Closes the “parity measured, not mitigated” holdback from the prior evaluation
HL7 standards
Seven standards, load-bearing in code
Not a pitch-slide list: remove any one row below and a named code path breaks.
Standard
Role in the platform
FHIR R4
Patient-data backbone via HAPI. Patient/$everything returns the bundle every agent and every surface reads from.
SMART on FHIR
Backend Services, RS256 JWT assertion (RFC 7523), per-route scope enforcement, HS256/RS256 dual mode.
CDS Hooks 1.1
patient-view discovery + card service, demoed against the public sandbox; recommendations reach the clinician inside the EHR, zero new UI.
FHIR Task
The Action Planner writes one Task per actionable item: role-based owner, priority, due date, lifecycle status, fhirResources[] citations.
FHIR Subscription
Rest-hook on Task create/update; the API relays over SSE, so the Social Worker's mobile queue updates in seconds.
FHIR SDC (AHC-HRSN)
SDOH screening as QuestionnaireResponse (LOINC 71802-3), flattened into Observation.component for the SDOH Agent.
FHIR RiskAssessment
Citation-validated risk scoring surfaces natively rather than as a proprietary JSON blob.
Terminology bindings ride on every resource: LOINC 4548-4 (HbA1c), 30934-4 (BNP), 62238-1 (eGFR); ICD-10 E11.9, I50.9, F33.1; US Core race/ethnicity extensions. A “missing HbA1c > 90 days” gap is a check against a code, not a string match.
Delivery surfaces
One FHIR record, three delivery surfaces
Role is provisioned via JWT and drives both routing and FHIR scope end-to-end. The same Task.status change the Director sees on the web is the same HAPI write the Social Worker made in the field.
web · Director
Population view
Population scatter (risk × cost), drills into a cluster, lands on one patient’s analysis, same data, same audit trail as the per-patient view.
web / mobile · Care Coordinator
Orchestrator view
Patient-detail orchestrator view: streamed AI findings, a clinical task queue, and a care-plan builder, with one-tap FHIR Task assignment.
mobile PWA · Social Worker
SDOH task queue
SDOH-only task queue, pushed via FHIR Subscription rest-hook. Scope-enforced: this role cannot read clinical Observations outside it, by construction.
Measured evidence
Measured evidence, honestly staged
The eval harness runs against citation-validated outputs: the same shape the product shows a clinician. Dev-labeled (16 of 26 patients) plus held-out (10 of 26); zero of 26 labels are clinician-validated yet.
Agent
Metric
Note
Risk
Sens. 66.7% · Spec. 84.6%
(held-out 100%, FP=0)
(held-out 100%, FP=0)
Regression from 100%→66.7% traced to label/generator drift on one patient, not a clamp bug; label repaired.
Care Gap
Sens. 100% · Spec. 0%
Single negative example (maria-chen); negative sample set is growing 1 → 5.
SDOH
93.8% agreement (15/16)
Held against dev-interpreted ground truth.
Variance probe
81.25% per-patient agreement
Run after each rubric change as a stability check. LLMs reject seed and reasoning-tier temperature, so determinism is controlled at the prompt + post-processing layer.
8–15
s
wall-clock per complex bundle
200
ms
cache-hit re-visit, zero cost
5
concurrent analyses per Node process
Economics & impact
Where the economics come from
Measured, not estimated, per the latest cost-capture run against a 22-patient live cohort.
Risk Agent
$2.4827
Care Gap Agent
$2.8080
SDOH Agent
$1.2578
Action Planner
$2.1415
Average / patient
$0.3950
Per 1,000-patient month
$395.00
Review time
30–60 minutes of manual reconciliation collapses to ~8–15 seconds of streamed orchestration: a 95–98% reduction, letting a coordinator plausibly move from ~6 to ~25–40 patients reviewed per day.
Avoided CHF readmissions
A 30-day CHF readmission runs $15,000–$20,000 (Medicare HRRP-published). The AI’s day-1 value is flagging the 7–30 day post-discharge window and pushing the three AHA/CMS-bundle actions: 7-day follow-up, daily weight monitoring, BNP/renal panel. Preventing 5 per quarter across a 500-patient panel saves $75,000–$100,000/quarter against a $0.40/patient marginal AI cost.
HEDIS incentive revenue
A risk-bearing ACO has $1–3M/year at stake on measures the Care Gap Agent maps to directly (LOINC 4548-4, 30934-4, 62238-1), found earlier, closed with one-tap Task assignment, documented audit-ready on the same FHIR write.
Key learnings
What the build taught us
Citation enforcement is a runtime property, not a prompt property. “Do not invent IDs” in the prompt is a useless safety guarantee; a pure-function Set lookup at the API boundary is a testable one.
On moving the gate to the API seam
Over-call is a rubric failure compounded with a clamping failure, and a clamp that suppresses a true positive is itself a safety concern. Ground truth has to be regenerated when the generator changes, not treated as fixed.
On the non-monotonic calibration path (30.8% → 0% → 69.2% → 84.6%)
When model output disagrees with ground truth, investigate the world before patching the rubric. The parity-mitigation path is the same rule applied to equity: measure, flag, audit, act, never just measure.
On the label-repair incident
A stock reference image’s signature-only JWT validation is not the same as scope enforcement. Standards-correctness depends on every layer enforcing its own part: the app tier closed the gap; the HAPI-tier rebuild is the next one.
On HAPI’s default JWT posture
The eval harness is the product, not the appendix. It catches LLM regressions, validates rubric changes, produces real cost numbers, and pins label/generator self-consistency; treating it as a check-box was the initial mistake.
On what changed after the over-call regression
Ethics, privacy & governance
Decision support, not decision-maker
The platform never blocks a clinician’s action, never overrides a coordinator’s override, never auto-orders. The output is a prioritized, cited FHIR Task list that a human acts on.
Deterministic safety nets outrank the LLM. The risk clamp, the citation validator, and the heuristic confidence scorer are all deterministic; in a live disagreement, the deterministic layer wins, and every clamp downgrade is written to the audit trail.
Confidence is evidence-derived, not self-reported. The model never grades its own output.
scoreRiskFlag = min(0.9, 0.3 + 0.2·citationCount + 0.2·hasAbnormalLab + 0.2·recentEncounter)
No real PHI in the POC. Seeded data is synthetic: hand-authored hero patients plus a deterministic ~500-patient Synthea-style population, disclosed in the model card. A real deployment needs a BAA, the Keycloak + rebuilt-HAPI + PostgreSQL tier, and a real hospital FHIR endpoint first.
Compliance posture: no HIPAA, SOC 2, or HITRUST claim at the POC stage. Real training data is disclaimed and the Synthea substitution is documented in the model card (NIST AI RMF, 9 sections, asserted by an integrity test).
Let’s go from 0 to 1+
Tell us how you dream it. We’ll show you how to ship it.
A 30-minute discovery call with a senior engineer, not a sales rep. Walk away with a build plan, a timeline, and a clear next step.
✓Reply within 1 business day
✓NDA on request, no obligation
✓Talk to engineers who’ve shipped in your industry
✓HIPAA and SOC 2-aware engineering
Prefer to talk now? +1 858 683 3692
Start the conversation
Takes about 30 seconds.
