Collect
Group de-identified notes, radiology reports, implant logs, and structured device records under opaque, device-specific episode codes so two implants in one patient do not become a false conflict.
Retrospective orthopaedic hardware reconciliation
Know what the chartcan prove about hardware.
Synorthopic reviews de-identified operative notes, implant logs, clinic notes, radiology reports, and FHIR device records. It assembles a longitudinal hardware inventory, preserves the exact words that support each episode, surfaces contradictions across adult and pediatric orthopaedics, and hands a human the smallest defensible clinical or administrative decision.
Evidence assembly—not autonomous medicine. It does not prove physical presence from documentation alone, identify hardware from radiographs, infer removal intent, or write to an EHR.
Sample case · PEDS-CW-812past planned date
Agent found a follow-up gap
Operative note
“Hardware: Pectus Support Bar System”
Clinic note
“Plan: remove the Nuss bar on 2026-07-15”
ResolutionPast planned date · verify removal
Exact quotes verifiedNo removal inferred
What it actually does
Turns a stack of records into reviewable implant episodes.
Extract evidence
Propose hardware name, manufacturer, model, catalog, UDI, site, dates, and lifecycle language—with the exact quote—and retain every explicitly named construct family in a multi-component description.
Reconcile
Merge exact agreement into a patient-level inventory of implant episodes, explicit removals, open temporary loops, and unresolved state—then stop on contradictions.
Human closeout
Confirm evidence, mark unresolved, or label a conflict; save an audit row and jump to the next case from the keyboard.
New · downstream access workflow
Carry a reviewed implant episode into documentation, coding, and prior-authorization preparation.
The same evidence-bounded workflow now covers adult external fixation, staged antibiotic spacers, trauma hardware, and every other family with an explicit removal plan—not only pediatric implants. It prepares missing-documentation checks, a governed SpineCPT private handoff, and payer-routing steps while keeping final codes, medical necessity, and submission human.
Open access & coding workbenchInteractive workbench
Scrub the chart, not the mouse.
Synthetic examples span guided growth, pediatric and adult trauma, documented removal, revision exchange, growing rods, flexible nails, external fixation, and adult spine instrumentation. Lifecycle-sensitive families receive review priority, but family membership never asserts removal.
Select type-separated NDJSON plus, when available, one de-identified cohort-roster JSON and one completion-manifest JSON. The roster must exactly match the selected Patient resources; when supplied, every clinical resource must also resolve to exactly one matched Patient. Absolute FHIR references require a matching completion-manifest request base. To verify package provenance, also select the matching flattened ES256 JWS JSON and public JWK together. Imports stay in this browser with no upload, persistence, or EHR write. This hosted prototype is not approved for PHI. Exact roster and patient-link agreement do not establish roster authority, EHR authorization, or source completeness. A valid signature still does not establish who owns the supplied key.
Signed EHR-event intakeNo signed EHR queue has been loaded.Synthetic only · exact reviewer allowlist · exact tenant binding · no autonomous disposition
13review records in batch
6open temporary loops
2removal documented
4structured identity
1source conflicts
0/13human reviewed
Resolution queue
Every open disposition keeps a reason and a next evidence task.
No saved unresolved or conflicting dispositions are waiting for another evidence pass.
No administrative EHR task has been prepared in this browser session.Queue statusClearHuman review remains the controlling action
Longitudinal hardware inventory
What the supplied chart documents across time.
Each device row stays separate. Patient-level reports that cannot be tied to exactly one device stay explicitly unassigned, and a same-site multi-device chart becomes an attribution risk instead of a guessed implant. Every row names the next administrative evidence task. Missing removal documentation never becomes proof that hardware remains in the body. Exact serial-bound evidence can still surface a cross-date link candidate without merging episodes.
10opaque patient groups
12separate implant episodes · 1 unassigned
9no completed-removal record
2removal documented
1conflicted episodes
2 + 1episode-link candidates + attribution risks · 0 links reviewed
PEDS-RV-7312 implant episodes · 1 unassigned evidence bucket · 1 link candidate · 1 attribution risk
Same-site attribution riskPEDS-RV-731-UNASSIGNED / PEDS-RV-731-E1 / PEDS-RV-731-E2Patient-level evidence matches the documented site of 2 device episodes · 8 evidence IDsNo device assigned automatically · episodes not merged · physical presence not inferred
Same-day revision candidatePEDS-RV-731-E1 PEDS-RV-731-E2Same documented date, same body site, compatible laterality, and explicit revision or exchange language · 8 evidence IDsReview every linked episode before confirming relation · not merged · physical continuity not inferred
PEDS-RV-731-UNASSIGNEDPatient-level evidence · device unassignedOther / unresolved
Device attribution unresolvedThe record belongs to the patient, but not yet to one implant episode.
Implanted not explicitly datedRemoved not suppliedLast dated evidence not supplied
Agent next evidence taskReview patient-level evidence against candidate devicesHuman review pending · 4 evidence IDs
PEDS-RV-731-E1titanium elastic nailsIntramedullary fixation
Removal documentedCompleted removal is explicit in the supplied record.
Implanted 2024-01-15Removed 2025-06-20Last dated evidence 2025-06-20
Agent next evidence taskConfirm the documented removalHuman review pending · 12 evidence IDs
PEDS-RV-731-E2lateral locking plate and screwsPlates & screws
Implant documented · no removal recordImplantation is dated; completed removal is not present in this batch.
Implanted 2025-06-20Removed not suppliedLast dated evidence 2025-06-20
Agent next evidence taskObtain a definitive implant identityHuman review pending · 5 evidence IDs
PEDS-IM-4221 implant episode · 1 conflict
PEDS-IM-422Hardware description unresolvedFIM-35-SS
Temporary · no removal recordTemporary intent or a removal plan is explicit; completed removal is not.
Implanted 2025-09-18Removed not suppliedLast dated evidence 2025-09-18
Agent next evidence taskReconcile the conflicting sourcesHuman review pending · 9 evidence IDs
PEDS-CW-8121 implant episode
PEDS-CW-812Pectus Support Bar SystemFictional Chest Wall Devices · PSB-13
Temporary · no removal recordTemporary intent or a removal plan is explicit; completed removal is not.
Implanted 2023-08-10Removed not suppliedLast dated evidence 2026-07-01
Agent next evidence taskSearch for completed-removal evidenceHuman review pending · 15 evidence IDs
PEDS-EF-5181 implant episode
PEDS-EF-518Taylor Spatial FrameExternal fixation
Temporary · no removal recordTemporary intent or a removal plan is explicit; completed removal is not.
Implanted 2026-01-09Removed not suppliedLast dated evidence 2026-01-09
Agent next evidence taskSearch for completed-removal evidenceHuman review pending · 7 evidence IDs
PEDS-GG-1041 implant episode
PEDS-GG-104tension-band plates with 4.5 mm cannulated screwsGrowth modulation · Plates & screws
Temporary · no removal recordTemporary intent or a removal plan is explicit; completed removal is not.
Implanted 2025-02-14Removed not suppliedLast dated evidence 2026-05-08
Agent next evidence taskSearch for completed-removal evidenceHuman review pending · 8 evidence IDs
PEDS-HIP-2561 implant episode
PEDS-HIP-256locking cannulated adolescent blade platePlates & screws
Temporary · no removal recordTemporary intent or a removal plan is explicit; completed removal is not.
Implanted 2025-10-03Removed not suppliedLast dated evidence 2025-10-03
Agent next evidence taskSearch for completed-removal evidenceHuman review pending · 8 evidence IDs
PEDS-TR-3111 implant episode
PEDS-TR-311three 2.0 mm lateral-entry K-wiresPins & wires
Temporary · no removal recordTemporary intent or a removal plan is explicit; completed removal is not.
Implanted 2026-06-30Removed not suppliedLast dated evidence 2026-06-30
Agent next evidence taskSearch for completed-removal evidenceHuman review pending · 7 evidence IDs
PEDS-SP-2072 implant episodes · 1 link candidate
Cross-date identity candidatePEDS-SP-207 <-> PEDS-SP-207-FUExact manufacturer + model + serial across 2024-11-21 to 2026-06-12, same body site, and compatible laterality · 8 evidence IDsReview every linked episode before confirming relation · not merged · same physical device not inferred · physical presence not inferred
PEDS-SP-207MAGEC 2 Rod, 5.0mm 70mm StandardNuvasive, Inc · MC2-5070S
Implant documented · no removal recordImplantation is dated; completed removal is not present in this batch.
Implanted 2024-11-21Removed not suppliedLast dated evidence 2024-11-21
Agent next evidence taskCompare against the latest inventory sourceHuman review pending · 8 evidence IDs
PEDS-SP-207-FUMAGEC 2 Rod, 5.0mm 70mm StandardNuvasive, Inc · MC2-5070S
Hardware state unresolvedHardware is described, but implantation and removal state are not established.
Implanted not explicitly datedRemoved not suppliedLast dated evidence 2026-06-12
Agent next evidence taskObtain an implant or removal sourceHuman review pending · 7 evidence IDs
ADULT-SP-6041 implant episode
ADULT-SP-604pedicle screw system with bilateral spinal rodsSpine instrumentation · Plates & screws
Implant documented · no removal recordImplantation is dated; completed removal is not present in this batch.
Implanted 2023-03-02Removed not suppliedLast dated evidence 2023-03-02
Agent next evidence taskObtain a definitive implant identityHuman review pending · 4 evidence IDs
PEDS-TR-3191 implant episode
PEDS-TR-319two 1.6 mm K-wiresPins & wires
Removal documentedCompleted removal is explicit in the supplied record.
Implanted 2026-05-20Removed 2026-06-18Last dated evidence 2026-06-18
Agent next evidence taskConfirm the documented removalHuman review pending · 11 evidence IDs
No-removal rule: “No completed-removal record in this batch” is a documentation finding, not proof of current physical presence. Every inventory row remains human-review required and makes zero EHR writes.
Bounded extraction is readySynthetic cases are loaded. No chart data has left this page.
Case PEDS-HIP-256
locking cannulated adolescent blade plate
UDI exactOpen temporary-hardware loop
Hardware / implantlocking cannulated adolescent blade plate
ManufacturerMissing
ModelMissing
Catalog numberMissing
UDI-DI00841132135631
Body siteproximal femur
Lateralityleft
Implant date2025-10-03
Lifecycle intenttemporary internal fixation
Removal planreassess removal after osteotomy union and surgeon review
Removal statusMissing
Removal dateMissing
FHIR device-use statusMissing
Public device identityPublic registry match · review only
ReadyResolve UDI in GUDID to translate the chart-backed DI into manufacturer, brand, model, and catalog evidence.
Identity, not patient or lifecycle truth.
One same-origin POST sends only the fixed DI to Synorthopic; one credential-free server GET sends it to the fixed registry endpoint. No full UDI, lot, serial number, patient data, PHI, EHR read, or write. Uses public FDA GUDID data via NLM AccessGUDID. This product uses publicly available data from the National Library of Medicine (NLM), National Institutes of Health, Department of Health and Human Services; NLM is not responsible for the product and does not endorse or recommend this or any other product.An exact DI match does not prove that this device was implanted, remains physically present, was intended to be temporary, or was removed. Those claims still need chart evidence and human review.
Source records
Inspect the de-identified text already loaded
Quote-backed candidates0 selected · human acceptance required
Procedure
Hardware / implant
UDI-DI
Body site
Laterality
Implant date
Lifecycle intent
Removal plan
Broad hardware coverage
Temporary when explicit. Orthopaedic when relevant.
Component-aware recognition can preserve several construct families from one source description across pediatric and adult orthopaedics, without pretending every implant is temporary or that this catalog is exhaustive.
01Growth modulationplates · physeal screws · staples
02Growth-friendly spinegrowing rods · VEPTR · Shilla
03Pediatric telescoping rodsFassier-Duval · Bailey-Dubow · Sheffield
04Subtalar arthroereisissinus tarsi implants · calcaneo-stop screws
05Pins & wiresK-wires · Steinmann pins · transfixion pins
06Skeletal traction & halohalo rings · traction pins · cranial tongs
07External fixationmonolateral · circular · hexapod
08Intramedullary fixationflexible · rigid · cephalomedullary nails
09Cerclage & tension-band fixationcerclage wires · cables · tension bands
10Bone staple fixationcompression · memory · nitinol staples
11Resorbable fixationpolymer · magnesium · bioabsorbable fixation
12Joint fusion / arthrodesisankle · hindfoot · SI-joint fusion implants
13Osteotomy wedges & spacersHTO · DFO · Evans / Cotton wedges
14Bone graft substitutes & void fillerscalcium phosphate · calcium sulfate · bioactive glass
15Plates & screwslocking plates · screws · blade plates
16Spine instrumentationpedicle screws · rods · cages
17Spinal structural reconstructioncorpectomy cages · vertebral body replacements
18Vertebral body tetheringvertebral body tethers · anchors
19Spinal motion preservationartificial discs · dynamic spacers
20Limb lengthening / transportPRECICE · FITBONE · transport nails
21Rib & chest-wall reconstructionrib plates · clips · replacement prostheses
22Pectus support barsNuss · pectus support bars · stabilizers
23Soft-tissue fixationanchors · buttons · interference screws
24Osteochondral fixationosteochondral pins · screws · darts
25Cartilage & meniscus scaffoldscartilage · chondral · meniscal scaffolds
26Implanted joint unloadingimplanted knee shock absorbers · unloading implants
27Antibiotic spacers & carrierscement spacers · beads · coated rods
28Implantable bone stimulationinternal stimulators · implanted growth stimulators
29Arthroplasty / endoprosthesisjoint components · megaprostheses
30Osseointegration attachmentbone-anchored prosthetic attachments
31Patient-specific custom implantscustom triflange · pelvic · 3D-printed implants
32Other / unresolvedexact chart wording preserved
EHR connection path
Integrate read-only first. Earn write-back later.
This build now contains the SMART authorization-code + PKCE engine and GET-only FHIR census transport, and can run both end to end against a fictional EHR. Activating them for a real hospital still requires customer registration, approved scopes, a secure tenant-bound session runtime, and site-specific completeness validation. Until then, this is a synthetic integration simulator, not a deployed clinical system.
EHRSMART on FHIREHR launch + backend services
R4 resources
DeviceDeviceUseStatementProcedureDiagnosticReportDocumentReferenceBinaryAppointment
Site-specific implant tables may supplement standard FHIRSynorthopicEvidence queuehuman decision + audit trail
Credential-free EHR metadata tools load on approach.
The chart scrub queue remains usable while this independent module loads. It cannot receive credentials or patient data.
Executable SMART + FHIR path
Prove both chart launch and service-auth paths.
Chart launch uses authorization code + PKCE S256. Retrospective service access uses SMART Backend Services with a one-time private_key_jwt signed by ES384, bounded FHIR Group Bulk Data discovery, multi-patient windows, and HMAC-bound resume checkpoints. The background demonstration encrypts its synthetic manifest in tenant-partitioned D1, acquires a short lease for each window, compare-and-swaps the cursor, and purges the completed row. Both paths finish in the same FHIR queue. Patient-filtered document records can hydrate bounded text notes through authenticated, same-server Binary reads; source URLs are stripped. Neither path returns its token, code, verifier, assertion, private key, raw Patient resources, checkpoint, or patient identifier in the audit.
SMART authentication2 supported modesEHR launch · scheduled backend
FHIR transportGET onlyDevice · use · procedure · document · Binary note
Mapped evidenceNot runMulti-implant patients stay separated
External effects0 writesSynthetic auth and transport remain local
Not run yet. The demonstration uses a fictional authorization server, fictional records, and in-memory transports.
The reusable launch boundary now keeps private SMART state in an encrypted, tenant-hashed, ten-minute D1 session with atomic one-time callback consumption. A disabled-by-default bridge can now exercise a registered vendor sandbox and return fictional FHIR evidence through a same-origin popup directly into this queue. It is hard-coded to synthetic data and a single configured sandbox tenant; startup also requires a visibly non-production hostname and an explicit synthetic-data attestation. Those configuration checks reduce accidental misuse but do not certify the remote dataset. A live customer deployment still requires authenticated customer-to-tenant mapping, approved key management, monitored exchange, and an approved PHI runtime. This build blocks PHI, does not schedule a clinical job, and is not connected to a hospital.
Silent, read-only census
Pull permitted device and note evidence, run reconciliation, and compare against the incumbent registry. No chart changes.
- SMART app registration
- Least-privilege read scopes
- Site-specific completeness testing
Deep-link back to source
Launch in patient context, show exact provenance, and let the reviewer finish inside the institution’s authorized workflow.
- SSO and role mapping
- Immutable access audit
- Human acceptance recorded
Bounded administrative write-back
Create an allow-listed task or structured reconciliation result only after an explicit human action and rollback testing.
- No autonomous clinical orders
- Idempotency and duplicate checks
- Customer change control
Security & compliance readiness
Architecture-ready is not compliant.
Current statusPrivate de-identified prototypeNot approved for PHI or clinical use
Live deployment gatesWhat this running build permits—not what a roadmap promises.
Runtime controlschecking deployed boundariesFail-closed state: EHR access, customer data, persistence, and external actions remain unavailable.
HIPAArequired before PHI
Organization + product controls
- ○Documented enterprise risk analysis and risk management
- ○BAAs with hosting, model, monitoring, and support vendors
- ○SSO, MFA, role-based access, minimum-necessary scopes
- ○Encryption, key management, audit logs, retention/deletion
- ○Incident response, breach process, training, contingency plan
SOC 2independent examination
Evidence over a real operating period
- ○Define system boundary and Trust Services Criteria scope
- ○Assign control owners; approve policies and risk register
- ○Automate evidence for access, changes, vendors, incidents
- ○Complete readiness, remediate gaps, then Type I examination
- ○Operate controls consistently for a Type II period
AI boundaryenforced in product
Automation without losing focus
- ✓Exact quote and value verification
- ✓No model tools and no automatic trusted fields
- ✓Conflicts and missing fields fail visibly
- ✓Human disposition required before closeout
- ✓No EHR write, order, outreach, or image diagnosis
PHI + model prerequisite
Before any PHI reaches an OpenAI endpoint, the customer must have an applicable BAA and eligible API configuration, including the required retention controls. store: false alone is not a HIPAA program.
The value test
The interface is good. Now measure whether the workflow earns its place.
Live assisted-session measurement
No reviews measured yet
Counts foreground time and actual review-control interactions. Implant identity yield excludes patient-level evidence that has not been safely assigned to a device. The report stays aggregate and local to this browser session.
Reviews measured0/1312 implant episodes · 1 unassigned
Structured identity—of reviewed implant episodes
Foreground time—median per review
Review actions—median pointer + keyboard
Keyboard-only—of measured reviews
Needs resolution0unresolved or conflict
Measurement starts when the first review is savedNo time or click savings claim is valid without a separately locked incumbent baseline. Unsupported identity, missed-conflict, and lifecycle error rates require independent chart adjudication; interface telemetry cannot estimate them.
No case IDs, patient identifiers, source text, quotes, free text, or registry queries · resets on refresh · 0 EHR writes
Prospective incumbent comparison
Lock the current workflow before Synorthopic review
Use observed aggregate metrics from the same cohort and the same definitions: structured means UDI, manufacturer + catalog, or manufacturer + model; unresolved/conflict means the final human disposition. A SHA-256 digest detects edits, but is not an external timestamp, independent verification, or permission to claim savings.
No incumbent baseline locked. Enter observed aggregate metrics before the first assisted review.
Aggregate only · no case IDs or source content · local session order can be reset and is not externally timestamped · independent analysis remains mandatory · do not backfill after seeing results
Independent safety adjudication
Measure errors against blinded human reference review
Two reviewers receive source text without Synorthopic's identity, conflict, registry, lifecycle, or final-review output. Both independently apply the same fixed labels. Any disagreement suppresses every error-rate estimate. Patient-level evidence awaiting device attribution is excluded from implant identity and lifecycle scoring and remains separate attribution workload.
Independent reviewers0/2complete locked slots
Raw agreement—disagreement requires adjudication
Unsupported identity—among confirmed identities
Missed source conflict—among reference conflicts
Lifecycle-state error—temporary / removal documentation
Safety rates blocked until independent evidence is completeDownload a source-only assignment, obtain two independent fixed-label reviews, then import both locked result files.
Assignment: source text, local-only, deidentified attestation required, not approved for PHI · reviewer result: fixed labels only · report: aggregate only, no case IDs or evidence · no threshold, causal, efficacy, or autonomous-use claim
Independent attribution validation
Test whether the right cases and candidate devices are surfaced
This separate study shows two reviewers the device-unassigned record plus every supplied implant episode in the same opaque patient group. It hides Synorthopic's same-site and laterality filter, risk flag, and candidate set. Agreement can measure missed ambiguity, unnecessary review flags, and candidate-device recall without ever assigning the evidence automatically.
Independent reviewers0/2complete locked slots
Raw agreement—exact state + episode-set agreement
Ambiguity sensitivity—reference multi-device cases flagged
False-risk rate—among reference non-ambiguous cases
Candidate-device recall—plausible episodes retained by filter
Shadow terminology evaluation
Evaluation only: locked ruleset orthoscrub.orthopaedic-site-rules.v1 is measured against the current exact-match rule. It does not alter the queue, assign a device, merge episodes, or infer physical presence.
Shadow sensitivity—reference multi-device cases surfaced
Sensitivity delta—shadow minus exact production rule
Shadow false-risk rate—among reference non-ambiguous cases
Candidate-recall delta—plausible-device recall versus exact rule
Prediction changes—included consensus opportunities only
Attribution rates blocked until independent evidence is completeDownload the separate source-only attribution assignment, obtain two independent fixed-label reviews, then import both locked result files.
Assignment: unassigned source + every supplied same-patient episode, local-only, not approved for PHI · reviewer result: fixed association labels + opaque episode codes · report: aggregate only · 0 automatic assignments, merges, or presence inferences
Identity yield
Share of reviewed records with source-backed UDI, manufacturer + catalog, or manufacturer + model identity.
Review burden
Median human seconds per case, clicks per case, and percentage completed keyboard-only.
Safety
Unsupported identity rate, missed conflicts, and erroneous temporary/removal classifications.
Beat the incumbent
Stop if the current EHR report or registry achieves the same reconciled coverage with comparable setup and review effort.
Automation evidence loads on approach.
The queue remains interactive while the bounded model-and-rules evidence ledger loads separately.