Private Clinical AI

Evidence-Grounded, On-Device Documentation and Decision Support

A Royal Softworks whitepaper · AssistantGeneral

---

Abstract

Healthcare imposes two requirements that cloud AI struggles to meet at once: protected health information must not leave the institutional boundary, and clinical output must be tied to real evidence rather than plausible-sounding invention. AssistantGeneral keeps PHI on the clinician's device — including on-device dictation — and grounds answers in primary literature with an explicit check against retracted studies. This paper describes the architecture and the clinical-safety design, and is candid about where human judgment remains mandatory.

---

1. Two hard requirements

Privacy. PHI is governed by HIPAA, GDPR, and institutional policy. Transmitting it to a commercial AI cloud requires a BAA and a residency story, and many institutions forbid it regardless. The result is that the leading AI tools are unavailable for the actual clinical record.

Evidence. Clinicians will not — and should not — trust an assistant that invents citations or relies on studies that have since been retracted. An ungrounded clinical claim is a patient-safety issue.

2. Privacy by architecture

AssistantGeneral runs the clinical stack on the device:

• The model, the document index, and the embeddings are local.
• Dictation is on-device — Whisper transcribes the spoken note locally, so the audio and transcript never leave the machine.
• Document generation (letters, summaries) runs in a local sandbox.
• A cloud model is attached only if institutional policy permits it.

For a practice or department, the governance plane — policy, SSO/SCIM, audit, shared knowledge bases — runs on the provider's own admin server. PHI stays inside the institutional perimeter end to end.

3. Evidence by design

The Doctor agent is restricted to research-grade sources and carries a mandatory disclaimer ("general information, not medical advice or diagnosis; seek urgent care for emergencies"). Its research tools are built for clinical rigor:

• pubmed_search and europepmc_search — peer-reviewed literature, cited by PMID.
• clinical_trials_search — registered trials, cited by NCT identifier.
• retraction_check — run before relying on a study, so the agent never cites withdrawn or corrected evidence.

The agent is instructed to prefer systematic reviews, meta-analyses, and major-body guidance, and to cite specifically.

4. The groundedness gate

On top of source selection, AssistantGeneral applies a groundedness gate to clinical answers. After the model drafts a response, the gate checks each factual claim against the evidence actually gathered, and for any unsupported claim it re-retrieves targeted evidence and sends the draft back to be supported, qualified, or removed — a bounded, closed re-RAG loop. In a clinical context this is the difference between an answer that sounds authoritative and one that is tied to the literature.

5. Capabilities, mapped to clinical workflows

Shipped workflows include:

• Clinical Note Summariser — structured summary of a clinical note.
• Differential Diagnosis Generator — an educational differential from presented findings, with a clinician-review disclaimer.
• Drug Interaction Checker — potential interactions across a medication list.
• Referral Letter Drafter and Discharge Summary Generator — documents drafted from structured inputs.
• Triage Assessment — structured urgency assessment from presenting symptoms.
• Medical Research Summariser and Clinical Guidelines Lookup — literature synthesis and guidance retrieval.
• ICD-10 Code Mapper — documented conditions mapped to ICD-10.
• Consent Form Explainer — plain-language explanation of a consent form.

When a question concerns the patient's own record, the agent first gathers it from the local knowledge base before reasoning — keeping the analysis grounded in the actual chart.

6. The interface matches the setting

A Medical UI preset provides a privacy-focused layout that hides external connectors, deep web search, and the raw-trace lens — appropriate for a clinical environment.

7. Scope and responsibility — stated plainly

AssistantGeneral is a clinician-productivity and decision-support tool that requires professional review. It is not a diagnostic device, and it is positioned and labeled as such throughout. Every specialist interaction begins with a disclaimer; the differential and triage workflows are educational aids for a qualified clinician, not autonomous decisions. The combination of on-device PHI handling, evidence-grounded sourcing, retraction checking, and the groundedness gate is what makes the tool deployable in a setting where both privacy and safety are non-negotiable.

---

Evaluate it with the network disabled: dictate a note, summarize it, and ask a clinical question — and watch the retraction check filter a withdrawn study. Contact Royal Softworks.