--- title: "Private Clinical AI — Whitepaper" description: "AI documentation and evidence-grounded decision support without protected health information leaving the machine, with a groundedness gate on claims." url: "https://royalsoftworks.com/resources/healthcare-ai-on-device/" source: "https://royalsoftworks.com" format: "markdown" note: "Markdown rendering of the HTML page at `url`. Same content, same canonical URL." --- [All resources](https://royalsoftworks.com/resources/) # Private Clinical AI ## Evidence-Grounded, On-Device Documentation and Decision Support **A Royal Softworks whitepaper · AssistantGeneral** --- ## Abstract Healthcare imposes two requirements that cloud AI struggles to meet at once: protected health information must not leave the institutional boundary, and clinical output must be tied to real evidence rather than plausible-sounding invention. AssistantGeneral keeps PHI on the clinician's device — including on-device dictation — and grounds answers in primary literature with an explicit check against retracted studies. This paper describes the architecture and the clinical-safety design, and is candid about where human judgment remains mandatory. --- ## 1\. Two hard requirements **Privacy.** PHI is governed by HIPAA, GDPR, and institutional policy. Transmitting it to a commercial AI cloud requires a BAA and a residency story, and many institutions forbid it regardless. The result is that the leading AI tools are unavailable for the actual clinical record. **Evidence.** Clinicians will not — and should not — trust an assistant that invents citations or relies on studies that have since been retracted. An ungrounded clinical claim is a patient-safety issue. ## 2\. Privacy by architecture AssistantGeneral runs the clinical stack on the device: - The **model**, the **document index**, and the **embeddings** are local. - **Dictation is on-device** — Whisper transcribes the spoken note locally, so the audio and transcript never leave the machine. - **Document generation** (letters, summaries) runs in a local sandbox. - A cloud model is attached only if institutional policy permits it. For a practice or department, the governance plane — policy, SSO/SCIM, audit, shared knowledge bases — runs on the _provider's own_ admin server. PHI stays inside the institutional perimeter end to end. ## 3\. Evidence by design The **Doctor agent** is restricted to research-grade sources and carries a mandatory disclaimer ("general information, not medical advice or diagnosis; seek urgent care for emergencies"). Its research tools are built for clinical rigor: - **`pubmed_search`** and **`europepmc_search`** — peer-reviewed literature, cited by PMID. - **`clinical_trials_search`** — registered trials, cited by NCT identifier. - **`retraction_check`** — run _before_ relying on a study, so the agent never cites withdrawn or corrected evidence. The agent is instructed to prefer systematic reviews, meta-analyses, and major-body guidance, and to cite specifically. ## 4\. The groundedness gate On top of source selection, AssistantGeneral applies a **groundedness gate** to clinical answers. After the model drafts a response, the gate checks each factual claim against the evidence actually gathered, and for any unsupported claim it **re-retrieves targeted evidence** and sends the draft back to be supported, qualified, or removed — a bounded, closed re-RAG loop. In a clinical context this is the difference between an answer that _sounds_ authoritative and one that is tied to the literature. ## 5\. Capabilities, mapped to clinical workflows Shipped workflows include: - **Clinical Note Summariser** — structured summary of a clinical note. - **Differential Diagnosis Generator** — an educational differential from presented findings, with a clinician-review disclaimer. - **Drug Interaction Checker** — potential interactions across a medication list. - **Referral Letter Drafter** and **Discharge Summary Generator** — documents drafted from structured inputs. - **Triage Assessment** — structured urgency assessment from presenting symptoms. - **Medical Research Summariser** and **Clinical Guidelines Lookup** — literature synthesis and guidance retrieval. - **ICD-10 Code Mapper** — documented conditions mapped to ICD-10. - **Consent Form Explainer** — plain-language explanation of a consent form. When a question concerns the patient's own record, the agent first gathers it from the local knowledge base before reasoning — keeping the analysis grounded in the actual chart. ## 6\. The interface matches the setting A **Medical UI preset** provides a privacy-focused layout that hides external connectors, deep web search, and the raw-trace lens — appropriate for a clinical environment. ## 7\. Scope and responsibility — stated plainly AssistantGeneral is a **clinician-productivity and decision-support** tool that requires professional review. It is **not** a diagnostic device, and it is positioned and labeled as such throughout. Every specialist interaction begins with a disclaimer; the differential and triage workflows are educational aids for a qualified clinician, not autonomous decisions. The combination of on-device PHI handling, evidence-grounded sourcing, retraction checking, and the groundedness gate is what makes the tool deployable in a setting where both privacy and safety are non-negotiable. --- _Evaluate it with the network disabled: dictate a note, summarize it, and ask a clinical question — and watch the retraction check filter a withdrawn study. Contact Royal Softworks._ ## Evaluate AssistantGeneral See the product this paper describes — a private, local-first AI agent with an enterprise control plane that runs on your own infrastructure. [Explore AssistantGeneral](https://royalsoftworks.com/products/assistant-general/) [Talk to us](https://royalsoftworks.com/contact/)