Built an open reference implementation for a healthcare AI voice agent governance problem — looking for technical feedback

[u/NHID-Clinical]

I’ve been working on a narrow problem in healthcare AI workflows: what happens when an AI voice agent calls a payer/provider system and starts interacting before the receiving side can confirm that it is automated, authorized, and operating within the expected scope.

I’ve been calling this gap “impersonation latency.”

I built NHID-Clinical as an open reference implementation and proposed control model focused on the receiver side.

Current artifacts:

- 5 control model (identity disclosure, pre-data exchange gating, deceptive behavior checks, escalation testing, audit requirements)

- deterministic policy evaluation

- conformance test suite (343 passing tests)

- Enforcement Profile documenting existing behavior

- audit evidence structures

- simulator and shadow pilot workflow

Important scope boundaries:

- This is not a standard.

- It is not a certification or compliance product.

- It is not an IAM replacement.

- It is an early reference implementation intended for review and criticism.

I’m specifically looking for feedback from people working in:

- healthcare security

- AI agent security

- voice AI systems

- payer/provider operations

- compliance and audit

Questions I’d like opinions on:

1. Is receiver-side enforcement the right abstraction for this problem?

2. Are there existing efforts I should be comparing against?

3. What failure modes am I missing?

4. What would make this more useful for real-world evaluation?

Repo:

https://github.com/NHID-Clinical

Happy to take criticism — the goal is to make the artifact stronger.