Care, With Context

I’ll optimize for trustworthy decision support, not diagnosis. First I’ll clarify who is allowed to see and act, whether a source is authoritative for each fact, how late claims/labs arrive, identity-error tolerance, offline duration, and whether a recommendation can trigger an order or only suggest review. My safety invariant is that every opportunity shows the supporting and contradicting facts, their source and freshness, the policy/model version, and an explicit uncertainty state.

I’ll separate source observations, resolved longitudinal facts, recommendation candidates, clinician decisions, and downstream actions. Collapsing those into one mutable patient row makes identity repair, audit, and feedback impossible.

Actors: clinicians in the field, care coordinators, supervisors, member-identity stewards, clinical-policy owners, data stewards, security/compliance, and SREs. Required: source ingestion and watermarks; conservative identity resolution; bitemporal timeline; effective-dated rule and model evaluation; deduplicated opportunities with evidence and contraindications; visit package prefetch; encrypted offline view and action outbox; synchronization; clinician accept/dismiss/defer with reason; downstream task creation; and quality/impact monitoring.

Mock NFRs: 60,000 visits/day; 99.95% online control-plane availability; scheduled packages ready 30 minutes before 99% of visits; online recommendation p95 under two seconds; offline for 72 hours; RPO under five minutes and RTO under one hour for actions. Out of scope: autonomous diagnosis, medication prescribing, automatic claim denial, replacing EHRs, and unsafe probabilistic identity merges.

Average visit preparation is 0.694/s; a 20× peak is 13.9/s. Packages create 180 GB/day of payload and roughly 5.4 TB/month before CDN/cache effects. The exact mean is 7.5 visits/clinician/day, so three offline days require 67.5 MB of encrypted package payload per device on average—about 72 MB if capacity planning rounds to eight visits—plus app overhead. That is manageable, but deletion and key revocation matter.

If opportunity generation takes 400 ms of CPU/visit, peak work is about 5.6 cores; with 40% headroom the calculator rounds to eight, and I would provision eight to ten plus tenant/region reserve. Scale pressure comes from fan-in, member timeline cardinality, package freshness, and synchronized field bursts more than request QPS. Content-addressing can deduplicate unchanged evidence across rescheduled packages only inside the same tenant, region, authorization, and key domain; cross-tenant deduplication would create isolation and side-channel risk.

A SourceObservation is immutable and carries source record ID, event/effective time, ingest time, status, and payload digest. A MemberLink maps source person to enterprise member with method, score, evidence, version, and steward state; uncertain matches remain candidate links and do not join clinical truth. A resolved ClinicalFact preserves contributing observations and both valid-time and system-time.

An OpportunityVersion stores evidence fact IDs, contradictions, source watermarks, rule/model/calibration manifest, severity, expiry, and explanation. A clinician action points to the exact opportunity version and includes offline device sequence plus idempotency key. A new lab supersedes the opportunity rather than rewriting what the clinician saw. All keys and secondary indexes are physically prefixed by tenant and residency region even when the table abbreviates them; member or visit IDs are never treated as globally safe partition keys.

Connectors capture CDC or batch extracts into immutable source zones with contract checks and per-source watermarks. An identity service creates deterministic links from trusted identifiers and a steward queue for ambiguous cases. A timeline builder materializes bitemporal member facts. On source change or visit schedule, a durable orchestrator evaluates effective-dated rules and calibrated models, then an explanation service assembles supportive, contradictory, and missing evidence.

Thirty minutes before a visit, a package service pins a member-link version, fact watermark vector, opportunity versions, policy manifest, expiry, and authorization scope; it encrypts and signs the package. The mobile app verifies it, keeps PHI in hardware-backed storage, records actions in a monotonic local outbox, and syncs through an idempotent gateway. Server-side reconciliation revalidates identity, freshness, opportunity state, and user authority before creating downstream tasks.

I use source-specific namespace IDs as immutable anchors, then deterministic high-confidence matches such as verified member ID plus date of birth. Probabilistic matches only propose a link with interpretable evidence; high-risk merges require a steward, and one-to-many contradictions block. The member graph is versioned, so a split or merge has reverse lineage to every derived fact, opportunity, package, and action.

Freshness is a vector, not one timestamp: each source has event-time watermark, ingest time, expected cadence, completeness status, and known lag distribution. An opportunity can require “lab through T, pharmacy through T−1d, claims through T−45d.” Explanations show these limits. Corrections append a reversed/superseding observation and recompute only impacted members using lineage. Policy decides whether stale/absent data causes abstention, lower confidence, or a caution—not a guessed negative.

The package is an immutable read snapshot; offline writes are commands in a local outbox with device ID, monotonically increasing sequence, opportunity version, user, captured time, and idempotency key. The gateway acknowledges only after durable storage, deduplicates on device sequence, and returns per-command status. Sync may be repeated safely.

We do not last-write-win clinical decisions. The server checks a state machine and authority: notes can merge as separate attributed entries; duplicate equivalent accepts collapse; accept versus resolved/cancelled becomes a conflict requiring human reconciliation. The UI shows the newer evidence and asks the clinician to confirm or withdraw. A downstream task uses a business idempotency key and outbox; an unknown timeout is reconciled by key. Package expiry prevents indefinite use, but emergency offline access has explicit scope and audit.

I freeze the disputed link and stop new package generation. A steward creates a split version; reverse lineage enumerates mixed facts, opportunity versions, packages, accesses, clinician actions, and external tasks. We do not erase the original audit. Correct member timelines and opportunities are regenerated under new identities.

Unacted recommendations are revoked. Viewed or acted cases create privacy/safety incidents with minimum-necessary notification and supervisor workflow. External tasks receive correction/cancellation through idempotent reconciliation; unknown outcomes stay open. We analyze whether matching evidence or threshold caused the merge and add a canary/adversarial pair to the identity golden set. Identity false-merge rate is a hard safety gate, not an average matching score.

Green package construction is not fresh data. A source-silence detector compares event watermark and expected cadence; when pharmacy exceeds policy lag, affected opportunities become STALE_SOURCE and high-risk recommendations abstain. The package manifest exposes the stale watermark and the UI cannot hide it.

The contraindication produces a priority revocation message. Connected devices invalidate package/opportunity IDs immediately; offline devices cannot be reached, so server-side downstream actions are blocked on sync and the app shows a prominent “reconnect required” gate for expired high-risk content. For truly offline care, policy defines a safe fallback such as clinician verification from the source system—not false confidence. On reconnect, new facts arrive before pending commands are reconciled.

Strong consistency protects identity link publication, opportunity state, authorization, command acceptance, and downstream action intent. Timeline/search projections are eventual and labeled with watermarks. CDC and job delivery are at least once; unique source-event and stage keys make them idempotent. Per-source queues isolate stalled connectors; package generation reserves capacity for next-hour visits and sheds background recomputation first.

Tenant and region are mandatory partition keys in databases, queues, caches, indexes, object paths, and telemetry; service identities are purpose-scoped. PHI uses envelope encryption, short-lived tokens, device attestation, remote key revocation, minimal offline retention, and redacted logs. Monitor connector freshness/completeness, identity candidate/false-merge rates, timeline lag, opportunity yield/override/outcome by slice, package readiness/age, sync backlog/conflicts, downstream unknowns, access anomalies, and SLO burn. Restore immutable events plus manifests into a warm region and reconcile device command high-water marks.

First run identity and freshness dashboards only; then construct timelines and compare with source experts; shadow opportunities against historical visits with point-in-time replay; show explanations to a small clinician group without ranking; canary low-risk opportunity types; then enable downstream task creation after dual-run reconciliation. Keep a kill switch per rule/model/source slice.

Measure evidence correctness, opportunity precision/recall on adjudicated review, clinician acceptance/dismissal reasons, action completion, time saved, duplicate alerts, subgroup disparity, and—where causal design permits—care outcomes versus matched or randomized controls. Acceptance alone is not health benefit and can reflect alert fatigue. The trade-off is freshness/coverage versus safe abstention; I expose staleness and miss some suggestions rather than fabricate a complete chart.

I’ll summarize identity, bitemporal facts, explainable opportunities, offline command safety, and outcome evaluation.