Atlas EHR Copilot

An autopilot agent for the EHR — one Qwen model acts, another Qwen model objects, the clinician holds the pen.

Comment

Inspiration

Clinicians spend more time driving their EHR than caring for patients, and order entry is the worst offender: menu-diving dozens of times a day for work they can state in one sentence. We wanted to prove that an autopilot agent can take over that workflow safely, with the clinician holding the pen.

What it does

Atlas is an autonomous EHR copilot. A clinician types (or speaks) plain-English intent, like "order a CBC and start metformin 500mg BID" or "any care gaps?". An agentic loop powered by Qwen on Alibaba Cloud Model Studio reads the live FHIR R4 chart, reasons over it, and drafts correctly-coded actions (LOINC, SNOMED, RxNorm).

Before the clinician sees any proposal, the Qwen Safety Sentinel — a second, independent qwen-max reviewer layered on top of deterministic rule checks — adversarially audits it for allergy conflicts, drug interactions, duplicate therapy, and wrong codes, and attaches a pass/warn/block badge. Every chart mutation is queued behind a human-in-the-loop confirm gate and recorded in a hash-chained audit log. Ambiguous requests (a medication with no dose) become clarifying questions, never guesses.

A photographed paper med list becomes structured, reconciled proposals via qwen-vl-max. Replies carry per-claim evidence provenance: inline FHIR citations, deterministically validated and rendered as clickable evidence chips that light up the matching chart section. A Live System Console visualizes the agent's key logic in real time over SSE: routing decisions, every FHIR call, every reasoning round, sentinel verdicts, real latencies, token counts, and estimated cost.

How we built it

  • All inference on Alibaba Cloud Model Studio (DashScope, OpenAI-compatible endpoint), orchestrated across four Qwen models: a smart router sends each request to qwen-turbo, qwen-plus, or qwen-max by clinical complexity; the bounded agent tool loop (search_fhir / read_fhir / propose_write) runs on the routed tier; qwen-max drafts structured orders via forced function calling with SSE-streamed narration AND runs the adversarial Safety Sentinel; qwen-vl-max performs OCR and structured medication-list extraction from photos.
  • Next.js 16 backend (API routes only), FHIR R4 against the public HAPI sandbox with synthetic patients, plus an Epic-sandbox path via a Chrome extension using SMART-on-FHIR (PKCE).
  • An Atlas MCP server exposes the PHI-safe toolset (sanitized chart reads, write-boundary validation, Safety Sentinel reviews) over the Model Context Protocol, so any MCP-capable agent can use Atlas as clinical-safety infrastructure. Writes are never executed over MCP.
  • Production rails: a structural FHIR validator at the write boundary, a SHA-256 hash-chained tamper-evident audit log, timeout + retry + circuit-breaker resilience on every model call, and per-turn cost accounting.
  • CI on every push: 30 unit tests (PHI-isolation boundary, sentinel rules, tamper-evidence, resilience, validation), lint, production build.
  • PHI isolation enforced in code: the model only ever receives de-identified, coded data (codes, values, banded age). A 6-assertion test suite fails the build if PHI could reach the model payload.

Challenges we ran into

Bounding agent autonomy without losing capability: we preload a PHI-stripped chart snapshot (5 parallel FHIR searches) so most turns resolve in 1-2 reasoning rounds, cap the tool loop at 5 rounds, and route reads to auto-execute while writes only ever queue for confirmation.

The harder design problem was trust. We benchmarked against the published architectures of Abridge, Microsoft Dragon Copilot, Ambience, Hippocratic AI, Navina, Regard, Suki, Glass Health and OpenEvidence, and rebuilt Atlas around the three patterns they converge on that we lacked: per-claim evidence provenance, a supervisory model tier, and automation-bias guards.

Accomplishments that we're proud of

A production-shaped, layered safety model: a deterministic rule layer (unit-tested, model-free allergy and duplicate checks), an independent second-model adversarial review so the author never grades its own homework, confirm-before-write with an explicit override for flagged items, test-enforced PHI isolation, a tamper-evident audit trail, typed env validation, retry-hardened clients, and a mock-FHIR failover that keeps the demo alive if the public sandbox goes down. The sentinel fails open to "unreviewed", never a silent pass, and the human always holds the pen.

What we learned

Autonomy in high-stakes domains is not one brilliant model; it is a system. A model that acts, a model that objects, deterministic rails around both, and a human holding the pen. Qwen's tiered model family is what makes that architecture practical: the latency and price spread between qwen-turbo and qwen-max is wide enough that routing becomes a feature rather than an optimization.

What's next for Atlas

Real SMART-on-FHIR production OAuth, more writable resource types, and persistent clinician preference memory so Atlas gets sharper with every session.

Built With

  • actions
  • alibaba
  • chrome
  • cloud
  • context
  • epic
  • extensions
  • fhir
  • github
  • model
  • next.js
  • protocol
  • qwen-max
  • qwen-plus
  • qwen-turbo
  • qwen-vl-max
  • r4
  • smart-on-fhir
  • studio
  • tailwind
  • typescript
  • vercel
  • vitest
  • zod
Share this project:

Updates