AcceleratorsSynapse
Synapse CGS
TA neuro-symbolic platform that turns guideline prose into verifiable, bedside-ready decision support, by drawing a hard line between the layer that reads and the layer that computes.
See All Screens
The problem with AI-powered CDS
Guideline prose is hedged by design. Computation isn’t.
“Consider treatment in older individuals” is a clinical judgment call, not a number. Asking a language model to both interpret that hedge and compute a patient’s eligibility produces two well-documented failure modes.
TFailure mode
Lost in the middle
A critical contraindication clause buried deep in a long guideline document is statistically more likely to be dropped from a single long-context pass than one near the start or end.
Failure mode
Fabricated thresholds
A model asked to interpret hedged language will often invent a concrete cutoff, “age > 65,” that reads as authoritative but appears nowhere in the source text.
Synapse-CGS’s answer is architectural, not promptual: separate the layer that reads from the layer that computes, and make the boundary between them a physical one (different services, different networks), not just a code convention.
Architecture
Two layers, one shared core
Two independently deployable services share one pure-Python compiler library, plus a Next.js frontend that routes each persona to its own portal.
Neural layer · cloud
governance_service
Persona: Medical Director / Clinical Board
Ingests guideline PDFs, chunks them with plain regex (never an LLM), runs dual-model Claude extraction, scores consensus and threshold risk, and gates every compile behind human ratification. Persists to Supabase, with no patient table, by design.
Symbolic layer · on-prem
bedside_service
Persona: Treating Clinician
A CDS Hooks patient-view service that evaluates ratified bundles through a deterministic CQL engine, returns four-state cards, and requires a human-signed, SMART-on-FHIR-authenticated action before anything is accepted or dismissed.
Neural layer · cloud
governance_service
Persona: Medical Director / Clinical Board
Ingests guideline PDFs, chunks them with plain regex (never an LLM), runs dual-model Claude extraction, scores consensus and threshold risk, and gates every compile behind human ratification. Persists to Supabase, with no patient table, by design.
A third package, pilot, runs one guideline clause through the entire Neural → Governance → Bedside chain in silent-shadow mode: the end-to-end proof that the architecture behaves as designed, not just its unit parts.
Safety gates
Three gates that make hallucination a schema violation
Rather than asking the model to “be careful,” each gate makes an unsafe state either impossible to construct or automatically blocked.
01
Structured-output guardrail
Extraction is bound to a Pydantic contract; free text is not a representable output. A model validator makes it structurally impossible to encode a value that’s both abstained-from and populated, or asserted and missing.
Constraint._no_guessing
02
Abstain-over-guess, dual-model consensus
Every clause is read independently by two distinct Claude configurations. Disagreement raises review priority; any numeric value not literally present in the source is flagged, and hedge language paired with a concrete number is marked a possible fabrication. An unspecified threshold is refused compilation outright.
422 THRESHOLD_UNSPECIFIED human review queue
03
Exhaustive determinism proof
Before distribution, the same rule and patient values run through the compiler and evaluator 1,000 times, hashing every output. More than one distinct hash blocks distribution entirely: a falsifiable proof, not a code-review assertion, that nothing probabilistic leaked into the runtime path.
1,000 iterations · SHA-256 · single hash required
Standards
Standards, not a proprietary format
The compiled artifact is CPG-on-FHIR and CQL, so a ratified guideline is portable across any CDS Hooks-capable EHR, not locked to this codebase.
Standard
Role in the platform
CPG-on-FHIR
Core output format: a Bundle of Library, PlanDefinition, ActivityDefinition, and per-concept ValueSet resources.
FHIR R4 / US Core
All resources conform to FHIR 4.0.1 and target US Core profiles.
CQL
The Symbolic Layer compiles real, executable Clinical Quality Language, not a proprietary rule DSL.
Implementation Guide
A ratified guideline exports as a standard IG depending on hl7.fhir.us.core, shareable across institutions.
CDS Hooks
Bedside Engine implements the discovery contract and a patient-view hook returning standard cards[].
SMART on FHIR
PKCE App Launch for clinician identity, plus Backend Services (client_credentials + signed JWT) for Governance's own publish calls.
Subscription / Task / AuditEvent
A rest-hook Subscription drives clinician notification; every accept/dismiss mirrors as a real FHIR AuditEvent.
Standards
Where the build actually stands
A code-complete prototype, validated end-to-end offline. Not yet in a live clinical environment.
1,000
x
Determinism loop per rule
2
Independent Claude readings per clause
3
M7 pilot scenarios proven end-to-end
The pilot’s clearest result
A third package, pilot, runs one guideline clause through the entire Neural → Governance → Bedside chain in silent-shadow mode: the end-to-end proof that the architecture behaves as designed, not just its unit parts.
Anticipated impact
Design targets, not measured results
No patient outcomes exist yet
Faster, cheaper, safer translation
The target release gate is recall ≥ 0.98 and precision ≥ 0.95 on safety-critical fields, high enough that human review time shifts from drafting logic to ratifying it.
Fewer guideline-concordant care gaps
The four-state model (Met / Not Met / Borderline / Data Missing) is built to surface eligible-but-untreated patients as a proactive, cited suggestion rather than a passive chart note.
Equitable access
Bedside runtime cost is near-zero (CPU-only, no AI call, no network egress), so a lower-resource hospital can consume a guideline a well-resourced center already extracted, without its own AI budget.
Key learnings
What the build taught us
Making an invalid state unrepresentable beats prompting the model to “be careful.” The highest-leverage safety control was a type-system constraint, not a prompt instruction.
On schema-bound extraction
On schema-bound extraction
Determinism has to be tested exhaustively, not sampled. A rule that is “usually” deterministic is not safe for a clinical alert.
On the 1,000-loop harness
On the 1,000-loop harness
The riskiest failure mode is a plausible number, not a missing one. A model that quietly turns “consider treatment in older individuals” into “age > 65” is dangerous precisely because it looks correct.
On hedge-language detection
On hedge-language detection
A client-supplied identity field is a security gap even when every other gate is airtight. Closing it required a genuine SMART-on-FHIR session, not a policy note.
On authenticating the accept/dismiss path
On authenticating the accept/dismiss path
Building the scaffolding for a control is not the same as enforcing it. A well-tested component sitting unwired into any route is not an active control.
On the un-invoked rate limiter
On the un-invoked rate limiter
Ethics, privacy & governance
Abstain-over-guess as an ethical default
The system is built to prefer visible uncertainty, routed to a human, over a confident-looking but invented number.
Human ratification is mandatory for every terminology binding and every compiled rule; no AI-extracted concept-to-code mapping is auto-approved.
Architectural PHI segregation. The AI-calling and PHI-touching services run on separate networks; the cloud database has no patient table by design, and the on-prem database stores only an opaque patient reference and the specific values that justified an alert, never a full chart.
Silent-shadow-first rollout. Before any alert is shown to a clinician, the system evaluates and logs with nothing displayed, specifically to measure false-positive rate before real people are exposed to its judgment.
What comes next
Roadmap
Every layer from gesture to database trigger was chosen to keep the experience calm and instant.
Gold-standard evaluation (M6)
Measure extraction accuracy against a held-out, dual-annotated clinical corpus before any real guideline is trusted.
Single-site silent shadow
Evaluate and log against real (de-identified where possible) patient data with no cards shown, to size false-positive and alert-volume risk safely.
Single-site prospective phase
Show cards for real; measure clinician acceptance, dismissal, and override rates as explicit alert-fatigue guardrails.
Multi-site rollout
Export each ratified guideline as a shareable HL7 FHIR Implementation Guide so other institutions can adopt it without re-running extraction.
Let’s go from 0 to 1+
Tell us how you dream it. We’ll show you how to ship it.
A 30-minute discovery call with a senior engineer, not a sales rep. Walk away with a build plan, a timeline, and a clear next step.
✓Reply within 1 business day
✓NDA on request, no obligation
✓Talk to engineers who’ve shipped in your industry
✓HIPAA and SOC 2-aware engineering
Prefer to talk now? +1 858 683 3692
Start the conversation
Takes about 30 seconds.
