Sector
In healthcare, compliance decides the architecture before engineering does. The regulatory status of the software, where the data is hosted and the legal regime of the processing are settled at scoping. Discovered mid-project, they end it.
Health data is plentiful and heterogeneous: free-text reports, activity coding, DICOM images, HL7 or FHIR feeds, and a layer of departmental spreadsheets nobody owns. Patient identifiers do not reconcile across systems, and record linkage is often the real technical subject of the project, well before any model.
Most of the clinical information sits in free text, and that text is written fast: ward-specific abbreviations, negations, hypotheses, history mixed with today’s findings. An extractor that does not explicitly handle negation and temporality turns "no evidence of" into a diagnosis. This is not an edge case, it is the leading source of error.
What matters is not average performance, it is behaviour on rare cases and the system’s ability to decline. A model that always produces an output, with the same confidence, is not usable in a care pathway. Explicit refusal and escalation to a human queue are features, not workarounds.
Segregation is real and deliberate: certified hosting, pseudonymisation, access traceability, separation between care and research purposes. These constraints are not bolted on at the end, they shape the first architecture diagram. A well-scoped healthcare project costs less than a badly scoped one restarted six months in.
Three questions come before architecture: where does the data live, under which regime is it processed, and is the software a medical device? Until they are answered, there is no project.
Hosting personal health data collected in the course of prevention, diagnosis, care or social and medico-social follow-up requires HDS certification under the French public health code. The point people systematically miss: the constraint covers training environments, development datasets and backups, not just production. An export "just to test" into an uncovered environment is a non-compliance, however temporary.
Health data falls under the special categories of Article 9: processing is prohibited in principle, and requires both a legal basis and one of the conditions that lift the prohibition. The practical consequence is counter-intuitive: care purposes and research purposes are distinct, and data collected for one does not flow freely to the other. This is the question that decides whether you can train on your own data at all.
Processing health data for research relies on the CNIL reference methodologies, to which a controller can declare compliance, or otherwise on an authorisation. Building a health data warehouse falls under a dedicated framework with its own governance and transparency requirements. Choosing between these routes is the first arbitration of the project, and it drives the schedule far more reliably than the choice of model.
Software intended by its manufacturer for a medical purpose, diagnosis, prevention, prognosis, treatment or monitoring, is a medical device and falls under the classification and conformity assessment set out in the regulation. The line between an operational support tool and a clinical decision support tool can feel thin in conversation and never is in its consequences: it sets the cost, the schedule and the skills you need. We put it in writing at the first meeting.
Some healthcare-related uses are high risk under Annex III, notably systems used for triage in access to emergency services. These obligations stack on top of the Medical Device Regulation where the software is also a device. The two files have neighbouring requirements on risk management and documentation, and building them together is markedly cheaper than reconstructing one after the other, once the product is already on the market.
Success criterion
Precision and recall per entity type on a set annotated by two independent clinicians, with their agreement measured. That agreement is the performance ceiling: below it nothing can be concluded, and the first genuinely useful deliverable is sometimes an improved annotation protocol.
Success criterion
Share of correctly sourced answers and share of well-founded refusals, on a question set written by the professionals themselves. Plus the rate of claims not backed by a cited passage: that figure has to be zero on the qualification set before go-live, and it is not negotiable.
Success criterion
Absolute error per slot on a period after the training window, against a seasonal naive baseline and the current plan. Plus empirical coverage of the intervals: a stated 90 % interval must contain the observed value nine times out of ten, otherwise it is decoration.
Success criterion
Precision at the top of the queue: the share of flagged files where a reviewer confirms a real discrepancy, measured over the first files in the queue at constant review capacity. It is the only number the department cares about, and the one we commit to producing.
Healthcare AI projects rarely fail on the model. They fail on scoping, on data access, and on the clinician’s desktop.
Yes, including for training. HDS certification (the French standard for hosting personal health data) does not cover production alone: it also covers training environments, development datasets and backups. An export "just to test" to an uncovered environment is a non-compliance, even a temporary one. We design on HDS-certified hosting or on your own infrastructure, and we do not take on a project where the data cannot stay in a compliant environment.
It depends on the intended purpose you give it, and we qualify that in writing at the first meeting. Software intended for a medical purpose, diagnosis, prevention, prognosis, treatment or monitoring, falls under the medical devices regulation and its conformity assessment. The line between an organisational aid and a clinical decision aid can be thin in conversation, never in its consequences: it decides the cost, the timeline and the skills to bring together.
In the text itself, not just in the identifier columns. A free-text note contains names, dates, addresses and practitioner names: treating pseudonymisation as a simple swap of identifiers in a table lets everything else leak. We handle it inside the text, then verify it on a re-read sample, because pseudonymisation that has not been checked is only a hypothesis.
It depends on the legal basis for the processing, and it is the project’s first decision. Health data falls under the special categories of Article 9 of the GDPR: processing it requires a legal basis and one of the conditions that lift the default prohibition. A care purpose and a research purpose are not interchangeable, and data collected for one does not move freely to the other. This question decides whether training on your own data is feasible, and it is settled with your DPO before any architecture diagram.
An hour is enough to tell whether your subject stands up. If it does not, we will tell you then, not after three months of project.
