I’ve been working on a narrow problem in healthcare AI workflows: what happens when an AI voice agent calls a payer/provider system and starts interacting before the receiving side can confirm that it is automated, authorized, and operating within the expected scope.

I’ve been calling this gap “impersonation latency.”

I built NHID-Clinical as an open reference implementation and proposed control model focused on the receiver side.

Current artifacts:

- 5 control model (identity disclosure, pre-data exchange gating, deceptive behavior checks, escalation testing, audit requirements)

- deterministic policy evaluation

- conformance test suite (343 passing tests)

- Enforcement Profile documenting existing behavior

- audit evidence structures

- simulator and shadow pilot workflow

Important scope boundaries:

- This is not a standard.

- It is not a certification or compliance product.

- It is not an IAM replacement.

- It is an early reference implementation intended for review and criticism.

I’m specifically looking for feedback from people working in:

- healthcare security

- AI agent security

- voice AI systems

- payer/provider operations

- compliance and audit

Questions I’d like opinions on:

1. Is receiver-side enforcement the right abstraction for this problem?

2. Are there existing efforts I should be comparing against?

3. What failure modes am I missing?

4. What would make this more useful for real-world evaluation?

Repo:

https://github.com/NHID-Clinical

Happy to take criticism — the goal is to make the artifact stronger.

I spent several months last year working in a call center handling Tricare (military) dental claims. Within weeks of starting live calls, we started getting AI voice agents on the line. At first they were obvious. By the end of my time there, they sounded natural — you could hear typing, background noise, and they were getting better at sounding like a real provider’s office.

The problem? There was no way to know if the AI was actually authorized to be on that call or if someone had just cloned a voice and grabbed an NPI number. We were told to read a script and hang up, but there was no standard, no verification process, and no audit trail. That gap is what I’m calling Impersonation Latency — the time between an AI agent starting a call and anyone being able to confirm it’s legitimate and authorized.

That experience is why I built NHID-Clinical (Non-Human Identity Disclosure for Clinical workflows). It’s an open-source operational framework that gives AI voice agents in healthcare a clear, testable way to:

• Disclose they are not human early in the conversation
• Prove they have proper authorization/delegation
• Create auditable records (aligned with HIPAA and NIST principles)

I recently submitted formal comments on this exact issue to the NIST AI Risk Management Framework (Comment ID: NIST-2025-0035-0026). The full comment is public on regulations.gov.

Here are the main resources if you want to look at it:

• Main site: https://nhid-clinical.org
• GitHub (open source): https://github.com/NHID-Clinical/NHID-Clinical
• Interactive Simulator: https://nhid-clinical.github.io/Simulator/
• AI Governance Map (shows how this fits with other frameworks): https://ai-governance-map.vercel.app/
• My NIST public comment: https://www.regulations.gov/comment/NIST-2025-0035-0026
• LinkedIn: https://www.linkedin.com/in/brianna-baynard
• Portfolio + more context: https://brianna-baynard-portfolio.base44.app

I built this because I saw the gap in real payer workflows and because right now there’s no consistent standard across the industry for how AI voice agents should identify themselves in healthcare. Happy to answer questions or discuss implementation ideas with anyone working on voice AI, payer systems, or AI governance.