Compliance posture

Privacy, Security and Breach Notification Rules · implemented per NIST SP 800-66 r2

Every Security Rule safeguard is mapped to where it lives: role-based access, a 15-minute automatic logoff, an encrypted identifier vault and an append-only audit trail.

• Control ids cite the NIST SP 800-66 activity each satisfies.
• Direct identifiers live only in an encrypted vault; one service may decrypt them, and every decrypt is logged.
• Breach workflow follows the 60-day HHS notice and the 500-plus media notice.

e1 → i1 → r2

Controls carry HITRUST domain tags so one implementation produces evidence for the assessment hospitals ask vendors for. Target: e1 readiness at pilot, i1 in year one.

• Tagged domains include access control, transmission protection, password management, and data protection and privacy.
• r2 is planned alongside the first large health-system deployment.

Security · Availability · Confidentiality · Privacy

Controls map to the Trust Services Criteria and evidence is collected automatically where possible. No audit has been performed yet; the first window opens after the pilot.

• Change management runs through reviewed pull requests, CI gates and versioned database migrations.
• Boundary protection: security headers, an allow-listed CORS policy and rate limiting.

ISMS · Annex A · health informatics

Annex A tagging yields a Statement of Applicability, and the health-informatics additions — patient-record audit trails, pseudonymisation, clinical-system availability — are built in.

• Data-leakage prevention: a log scrubber and no identifiers in URLs.
• Supplier relationships are tracked in a business-associate registry with agreement status per vendor.

AI management system · AI risk

An inventory of every AI use with its intended purpose, a human decision on every recommendation, stored tool traces, and a bias review of risk adjustment.

• Nothing the AI produces is applied automatically.
• Every answer stores the tool calls that produced it, so a reviewer can see exactly which queries ran.

Govern · Identify · Protect · Detect · Respond · Recover

The executive view of the register, with the health-sector cybersecurity practices for vulnerability management, backups, access and incident response.

• Dependency scanning in CI and image scanning in the container registry.
• Encrypted automated database snapshots with cross-region copies and point-in-time recovery.

Civil Code §56 · Health & Safety Code §1280.15 · Civil Code §1798.82

The pilot state's stricter medical-privacy law, the 15-business-day clock for reporting unlawful access to the state health department, and consumer privacy for non-medical personal data.

• The incident-response runbook has a California branch with the 15-business-day clock.
• No marketing use of medical information, ever.

ONC information blocking

Kairos never blocks export: every dataset is downloadable as a FHIR Bundle, NDJSON or CSV.

• Kairos is not an EHR and is not ONC-certified, and it still treats export as a right, not a feature.

Non-device CDS (2022)

Kairos stays non-device software: it shows the basis for every recommendation, supports rather than replaces clinician judgment, and never analyses medical images or physiological signals.

• Copy rules enforce this: "flagged for review", "recommended for release", never a clinical conclusion about a patient.

OIG gainsharing safeguards

The safeguards are enforced in software: a safety gate, indicated-only stewardship, caps, independent validation, a documented method and attorney review before any program activates.

• The value program is the platform's highest legal-risk feature, so it is designed to fail closed.

Accessibility

Keyboard navigation, 4.5:1 text contrast, visible focus and labelled controls on every page — a hospital procurement requirement.

• Charts carry text alternatives and data tables; status is never conveyed by colour alone.