ecko
Clinical note structuring
A package granted empty capabilities is mechanically incapable of exfiltrating PHI - a stronger claim than a policy document.
The problem
Clinical notes are unstructured prose. Quality programmes, billing, and research cohorts
all want the same thing: problems, meds, labs, and timing in a schema. Doing that with a general-purpose
script language means trusting that nobody called requests.post with the note text.
HIPAA and GDPR reviewers distinguish between "we have a policy" and "the toolchain makes exfiltration impossible". The second is what gets a faster sign-off.
Why Ecko
- Pure extraction modules
- Structure the NLP step as a package with
capabilities: []and import it withgrant []. It can callaiin mock mode in CI and a local model or approved endpoint in production - but it cannot open a socket on its own. - Typed clinical structs
- Model an encounter as records with required fields. A hallucinated ICD code or impossible dose fails validation before it reaches the EHR interface.
- Trace without content
- JSONL tracing records call metadata. Combine with
secreton note bodies so traces never carry raw PHI even when tracing is left on in staging.
In practice
# vendor/structure/ecko.json -> "capabilities": []
import structure grant []
type Med = { name: str, dose: str, route: str }
fn parse_note(text: secret(str)) -> list(Med) {
ai "List medications mentioned" from reveal(text)
}
Try it on your workload.