Operational proofLive demo state
- Source coverage
- 80%
- Owner acknowledgement
- 88%
- Ready for access review
- 3
- Verified closures
- 3
Production pilots add incumbent comparison, adjudicated precision, median review time, and closure-throughput denominators.
Program layer / synthetic demonstration
Program Audit & Closure
One operating surface for the layers Synorthopic already supports: bounded cohort proof, configurable review protocols, legacy implant identity, accountable closure, and a human-reviewed handoff into documentation and access.
Synthetic program state is session-only and creates no external action.
01
DetectEvidence-bounded episode reconstruction
Existing engine02
ResolveIdentity, source coverage, and abstention
Layered03
OwnNamed person, due date, acknowledgement
Layered04
CloseReviewed disposition and portable receipt
Layered05
ActCoding and payer packet preparation
Existing engineEpisodes in demo10Bounded synthetic denominator
Actionable queue550% of demo episodes
Past due4Open as of Aug 1, 2026
Owner coverage80%8 open or closed episodes assigned
Structured identity80%3 exact identities recall-ready
Pilot command center
Prove value before making claims.
These measures update as you work the synthetic queue. They are program evidence, not clinical-outcome evidence.
Claim ledgerHard boundary
- Actionable-case yield Measurable now
- Review burden Measure in pilot
- Time savings Unproven
- Avoided complications Unproven
- Autonomous clinical action Not allowed
Pilot decisionPre-register
Expand only if the queue adds signal without creating unsafe work.
Set the minimum actionable yield, acceptable precision, review-time ceiling, owner coverage, and safe-abstention criteria before seeing results.
Open validation labConfigurable protocol builder
Expand scope without hard-coding treatment.
Protocols define which records enter review, when they return, what evidence can close them, and who owns the work. They never declare that removal is indicated.
Trauma
Temporary fixation closure
External fixation / K-wires / Flexible nails
- Review window
- 84 days
- Default owner
- Trauma APP or surgical coordinator
Pediatric orthopaedics
Growth-sensitive hardware review
Guided-growth plates / Flexible nails / Telescoping rods
- Review window
- 180 days
- Default owner
- Pediatric RN or service-line coordinator
Adult reconstruction
Staged infection handoff
Antibiotic spacers / Cement beads / Temporary fixation
- Review window
- 42 days
- Default owner
- Reconstruction program coordinator
Spine
Staged and growth-friendly spine review
Growing rods / Tethering systems / Temporary fixation
- Review window
- 90 days
- Default owner
- Spine program coordinator
Legacy implant and UDI reconciliation
Measure what the record can identify. Never fill a gap by guessing.
Public device registries can enrich a reviewed identity; they cannot prove implantation, current presence, or the appropriate next step.
80%structured
- Exact UDI
- 3
- Manufacturer + catalog
- 3
- Manufacturer + model
- 2
- Descriptive / unresolved
- 2
UDI completeness layer
Produces a readiness and exception report. It does not claim CEHRT compliance or reconstruct production identifiers without evidence.
| Episode | Evidence tier | Device detail | Source support | Recall lookup |
|---|---|---|---|---|
| Exact UDI | Fictional Ortho SystemsAFX-210 | 4/52 identity references | Eligible to queryExact, reviewed, patient-free | |
| Manufacturer + catalog | Fictional Pediatric ImplantsTBP-24 | 5/51 identity reference | HoldIdentity threshold not met | |
| Descriptive only | Not establishedNo structured catalog or model | 3/61 identity reference | HoldIdentity threshold not met | |
| Manufacturer + model | Fictional Trauma DevicesFlexRod 3.5 | 3/41 identity reference | HoldIdentity threshold not met | |
| Manufacturer + catalog | Fictional Ortho SystemsSS-42 | 4/41 identity reference | HoldIdentity threshold not met | |
| Exact UDI | Fictional Thoracic SystemsAS-340 | 5/52 identity references | Eligible to queryExact, reviewed, patient-free | |
| Exact UDI | Fictional Ortho SystemsAFX-220 | 5/52 identity references | Eligible to queryExact, reviewed, patient-free | |
| Manufacturer + catalog | Fictional Trauma DevicesKW-16 | 4/41 identity reference | HoldIdentity threshold not met | |
| Manufacturer + model | Fictional Spine SystemsGrowLine | 5/61 identity reference | HoldIdentity threshold not met | |
| Unresolved | Not establishedNo structured catalog or model | 1/50 identity references | HoldIdentity threshold not met |
Human-owned closure workflow
Every open obligation gets a person, a date, and a reviewed ending.
The demo records local state transitions only. Production tasks, outreach, scheduling, and EHR writes remain separately authorized customer integrations.
syn-001 / Trauma
Review nowAnkle external fixation episode
A return-to-OR plan is documented, but no completion record is present in the synthetic chart.
ProtocolTemporary fixation closure
Due dateMay 18, 2026
OwnerN. Patel, RNTrauma coordinator
AcknowledgementPending
Required source coverage4 of 5
IdentityExact UDIFictional Ortho Systems
Recall screeningLookup eligibleExact reviewed identity only
Session audit0 local events
No demo actions yetTry an assignment or acknowledgementNothing leaves this page
Removal-specific payer and documentation layer
Act only after the lifecycle state is human-confirmed.
Synorthopic reuses the existing access workbench and private SpineCPT boundary. This program layer controls when a case is ready to enter that workflow.
Evidence-linked packet
Carry reviewed facts, missing-document flags, provenance, and the human disposition into an editable administrative packet.
Open existing access layer ->Private SpineCPT bridge
Use the licensed local code library through its existing adapter boundary. The public site never contains or transmits the proprietary catalog.
Inspect coding boundary ->CRD / DTR / PAS readiness
Prepare modular CMS-aligned adapter requests while keeping policy interpretation, code confirmation, and submission under human control.
View adapter contracts ->Portable closure receipt
Export a reviewed lifecycle disposition for transfer or audit. This is not a generic implant passport or a clinical recommendation.
Connection truth
Program integration evidence
These five boundaries support the program workflow. Implemented means local code is tested; it does not mean a customer connection, customer data path, or external write is live.
Implemented4Tested local code paths
Concept1Documented boundaries only
Sandbox or higher0Dated external proof required
Live customer connections0No configuration-inferred status
External writes0Production authorization required
Device identityImplemented
AccessGUDID device identity lookup
A patient-free, credential-free, read-only AccessGUDID lookup is implemented; registry identity does not prove patient use.
- Standard
- NLM AccessGUDID Device Lookup API
- Version
- API v3
- Current runtime
- Public read-only
- Direction
- Read
Current boundary
A public registry match can enrich device identity; it cannot establish that the device was implanted in a patient or support a clinical decision.
Local evidence
- Conservative device-identifier normalization
- Bounded same-origin proxy with one credential-free upstream GET
- Exact returned-identifier verification
- Timeout, redirect, content-type, and byte limits
Still required
- mapping and conformance
- positive control canary
- monitoring and rollback
CodingImplemented
Private SpineCPT candidate handoff
A patient-free private SpineCPT handoff contract is implemented; the licensed engine is not bundled, connected, or publicly verified.
- Standard
- Synorthopic SpineCPT private-provider contract
- Version
- lookup request/response v1
- Current runtime
- Local exchange only
- Direction
- Local exchange
Current boundary
No SpineCPT source, license key, terminology library, live service, or proprietary descriptor is present in this repository.
Local evidence
- Patient-free request schema
- Request-bound response validation
- Candidate and file-size limits
- Licensed-content rejection
- Human final-code authority
Still required
- customer registration
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- licensed content authorization
- monitoring and rollback
PayerConcept
Prior-authorization evidence exchange
Prior-authorization packet preparation is local; no payer transport, policy service, submission, or response integration is implemented.
- Standard
- Da Vinci CRD/DTR/PAS/CDex or X12 278
- Version
- PAS 2.2.1; customer-profiled companion guides
- Current runtime
- Not connected
- Direction
- Request / response
Current boundary
Local packet preparation does not implement payer policy retrieval, attestation, submission, response, or medical-necessity determination.
Local evidence
- Criterion-by-criterion evidence matrix
- Documentation-gap detection
- Attachment manifest
- Human submission gate
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- monitoring and rollback
EHR writeImplemented
Human-approved FHIR administrative Task
A human-gated FHIR Task write contract is implemented and synthetic-tested; external EHR writes are disabled.
- Standard
- HL7 FHIR R4 Task customer profile
- Version
- FHIR 4.0.1; customer profile required
- Current runtime
- Synthetic only
- Direction
- Write
Current boundary
The write path is exercised only with synthetic transports; public and read-only deployments enable no EHR writes.
Local evidence
- Human approval capability gate
- Conditional create and idempotency
- Read-after-write verification
- Aggregate receipt only
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- monitoring and rollback
Audit & observabilityImplemented
External immutable audit destination
An external audit-sink contract and patient-free probe are implemented; no customer sink is configured or verified.
- Standard
- Customer-controlled append-only audit sink
- Version
- v1 contract
- Current runtime
- Not connected
- Direction
- Write
Current boundary
The sink and probe interfaces are implemented, but no external destination, schedule, monitoring, or independent archive is loaded.
Local evidence
- Patient-free destination probe
- Monotonic export sequence
- HMAC cursor integrity
- Retry-safe export contract
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- monitoring and rollback
Automation truth
Program rules and identity controls
The program uses deterministic lifecycle and identity preparation only. Neither engine makes a removal decision, confirms physical implant state, learns online, or acts on an external system.
Generative boundaries0Untrusted proposal paths
Deterministic engines2Extractors, verifiers, rules, and policies
Enabled model calls0Public release truth
Customer data enabled0Requires customer proof
External actions0Production authorization required
Online learning0Prohibited by current policy
Deterministic rulesetImplemented
Implant lifecycle closure rules
Deterministic lifecycle program rules are implemented and synthetic-tested; closure and clinical decisions remain human-owned.
- Contract
- synorthopic.lifecycle-closure-program.v1
- Engine
- Repository deterministic code
- Identifier
- lifecycle-closure-program
- Current runtime
- Synthetic fixture
- Release decision
- local demo only
- Test dataset
- lifecycle-closure-synthetic-program-v1
Human gate
Only a human-selected, evidence-backed disposition may close an episode.
Inspect controls and operating envelope
Deterministic checks
- Closed state enums
- Disposition transition rules
- Identity-tier validation
Abstains when
- Missing human disposition
- Insufficient evidence
- Unsupported transition
Prohibited actions
- Removal recommendation
- Autonomous closure
- Patient contact
- EHR or payer write
Evaluation state
- Subgroups: not applicable
- Overrides: local test only
- Incidents: not established
- Rollback: Return the episode to needs-clinician-review without closure.
Deterministic rulesetImplemented
Implant identity matching rules
Patient-free identity consolidation and bounded lookup rules are locally tested; registry matches remain untrusted review evidence.
- Contract
- orthoscrub.customer-implant-identity.v1
- Engine
- Repository deterministic code
- Identifier
- customer-implant-identity
- Current runtime
- Local deterministic
- Release decision
- local deterministic only
- Test dataset
- implant-identity-synthetic-fixtures.v1
Human gate
A reviewer decides whether any match is relevant to the supplied chart evidence.
Inspect controls and operating envelope
Deterministic checks
- Patient-free allowlist
- Exact identifier normalization
- Single bounded lookup
- Conflict preservation
Abstains when
- Conflicting chart identity
- Ambiguous catalog matches
- No safe exact lookup key
Prohibited actions
- Sending patient identifiers
- Inferring implantation
- Promoting registry data into chart truth
Evaluation state
- Subgroups: not established
- Overrides: local test only
- Incidents: not established
- Rollback: Disable enrichment and retain only the source-backed chart identity.
One product, layered by function
Keep the evidence engine. Add accountable program operations around it.
The command center is additive: the existing workbench, validation labs, customer runtime, device identity, and access workflow remain intact.