Clinical Flow

Inspiration

A close friend of mine needed an urgent surgery, but their procedure was delayed for weeks—not for medical reasons, but because of administrative red tape. Specifically, they were caught in the prior authorization process. Seeing them wait in pain while paperwork bounced back and forth between the clinic and the insurance company made me realize how broken the system is. Prior authorization shouldn't be a bottleneck for patient care. That frustration inspired ClinicalFlow: a solution to automate the administrative busywork of prior auth while keeping human doctors firmly in control of clinical decisions.

What it does

ClinicalFlow is a coordinator-facing AI agent that drastically reduces the time required to get a patient's surgery approved. When a doctor requests a procedure, the AI agent takes over the administrative heavy lifting. It opens the case, pulls the payer's exact insurance criteria, gathers the required evidence directly from the patient's electronic health records (EHR), and evaluates the rules.

Crucially, it is governed. If an insurance rule requires clinical judgement (e.g., "are symptoms worsening?"), the agent stops and securely routes the decision to a human doctor. Once the doctor signs off, the AI packages the complete, cryptographically signed submission for the payer. The AI does the busywork, is visibly governed, and stops at the boundary of its competence.

How we built it

We built ClinicalFlow with a robust, enterprise-grade architecture:

• Backend: We used Python 3.12 and FastAPI to build a high-performance REST API.
• Database: Data persistence is handled by PostgreSQL, using SQLAlchemy for queries and Alembic for managing raw SQL migrations.
• AI & Agent Logic: We integrated the Anthropic SDK via the Model Context Protocol (MCP) using fastmcp. This allows the agent to securely and deterministically use tools to read rules and gather evidence.
• Background Tasks: We used arq for asynchronous background processing to handle long-running chart-reading tasks.
• Frontend: The provider console and chat interface were built using TypeScript, Next.js, and styled with Tailwind CSS.
• Security & Hashing: We implemented rfc8785 canonical JSON serialization to ensure that when a doctor cryptographically signs an authorization packet, the hash is identical and mathematically verifiable across all systems.

Challenges we ran into

• AI Hallucinations vs. Clinical Safety: The biggest challenge in healthcare AI is trust. We couldn't let the LLM hallucinate clinical facts or make medical decisions. We solved this by implementing strict "Governance Gates." The AI uses a deterministic tool to pull exact rules, only quotes directly from the chart (never summarizes), and is hard-coded to hand off clinical judgements to a human.
• Agent Tool Coordination: Orchestrating complex multi-step reasoning (reading a rulebook, deciding what records to pull, evaluating them, and pausing mid-flow for human input) required careful state management and asynchronous tool execution.
• Cryptographic Signatures: Ensuring that the doctor's attestation is cryptographically bound to the exact payload required precise canonical JSON serialization (rfc8785) so the signature hash wouldn't break during network transit.

Accomplishments that we're proud of

• The "Honest Core" Architecture: We are incredibly proud of how we built the demo. Instead of a fake mockup or a risky live LLM prompt, we record the LLM's complex reasoning offline, but the UI executes those tool calls live against our real backend API during the presentation. It proves our backend works flawlessly while guaranteeing a smooth pitch.
• Legible AI: We successfully built a UI that makes the AI's work completely transparent. Every tool call, every gathered piece of evidence, and every rule evaluation is clearly visible to the care coordinator.
• Hard Boundaries: We proved that it's possible to build a healthcare AI that knows exactly when to stop and ask a doctor for help.

Built With

• alembic
• anthropic-sdk
• arq
• fastapi
• mcp-(model-context-protocol)
• next.js
• playwright
• postgresql
• pydantic
• pytest
• python
• sqlalchemy
• tailwind-css
• typescript