How we keep AI safe in a hospital

Patient identifiers are redacted before any model call. The AI works on the clinical question, not on who the patient is — names, contact details and IDs never leave the platform with a prompt.

Agent answers are also held to the record: outputs that reference patient data must cite the chart they came from, so a clinician can check every statement at its source.

Every AI output is a draft until a human approves it. Nothing enters the chart without a clinician's signature, a pharmacist signs off every medication reconciliation, and a biller approves every claim appeal before it leaves.

The gate is enforced in the platform, not in policy documents — an unsigned draft cannot become part of the record.

Every AI action is audit-logged: which agent acted, what it read, what it produced, who approved it and when. Administrators can reconstruct any agent decision after the fact — the same discipline hospitals already apply to controlled drugs and blood units, applied to AI.

Agents run against an offline evaluation harness on scheduled test suites — separate from live patient traffic. Dry-run modes let your staff watch an agent work before it is allowed to act, and evaluation results gate what ships.

AI spending is capped per facility with daily budgets and per-call metering, and the platform falls back to smaller models automatically when a task doesn't need the largest one. MedOrbit runs on enterprise LLMs (AWS Bedrock / OpenRouter).

Each agent has a kill switch: one flag turns it off instantly, per facility — no deployment, no support ticket.

Cloud-first, hosted in India (AWS Mumbai region) for data residency. Your patient data stays in-country, encrypted in transit and at rest, with access limited by role and audit-logged.

Statutory information and data requests are handled in-system, and patients or their representatives can raise a DPDP request directly: hello@medorbit.ai (subject: DPDP data request).