Plain-English definitions for the standards, protocols, compliance frameworks, and technologies that power modern health systems. A reference for healthcare IT professionals, developers, and decision-makers.
Book a 30-Minute Architecture WalkthroughAn authorisation model that evaluates policies based on attributes of the user, resource, action, and environment rather than static roles. ABAC enables fine-grained access decisions such as "only the treating clinician may view this record during an active encounter." It is well suited to healthcare systems where access requirements are complex and context-dependent.
A centralised directory where AI agents publish their capabilities, endpoints, and trust credentials so that other agents can discover and interact with them. In healthcare, an agent registry ensures that only verified, compliant agents participate in clinical workflows. GHARRA is Symphonix Health’s managed service implementation of this concept for the healthcare domain.
A communication standard that enables autonomous AI agents to discover, authenticate, and collaborate with each other. A2A protocols define how agents exchange tasks, results, and status updates in a secure, structured manner. Nexus is Symphonix Health’s governed A2A protocol designed specifically for healthcare use cases.
Adaptive Protocol for Ensemble Execution Strategies. A BulletTrain component that dynamically selects which combination of AI models to invoke for a given clinical task based on urgency, complexity, and required confidence. APEX evaluates model responses using consensus, majority-voting, or specialist-override patterns to produce reliable outputs.
An Integrating the Healthcare Enterprise (IHE) profile that defines how systems should create, store, and protect audit records and authenticate network nodes. ATNA ensures that every access to patient data is logged immutably and that communicating systems verify each other's identity before exchanging sensitive information.
A legally binding contract between a healthcare entity and a vendor that handles patient data on its behalf. A BAA defines permitted uses and disclosures of patient data, requires the vendor to implement appropriate safeguards, and establishes breach notification obligations. BAAs are a cornerstone of regulatory compliance in the United States under HIPAA.
A locally deployed large language model within BulletTrain, designed to handle clinical natural language processing tasks without sending patient data to external services. Named after Aneurin Bevan, the founder of the National Health Service. Bevan handles terminology mapping, clinical note summarisation, and structured data extraction within the data boundary of the deployment.
The Symphonix Health intelligent Health Information Exchange, built on the OpenHIE framework. BulletTrain implements the mediator pattern and comprises 160+ microservices covering the full healthcare data lifecycle, from patient registration through clinical workflows to insurance claims. It provides standards-compliant interoperability and orchestration across every standard including FHIR, HL7v2, CDA, X12, and DICOM.
Pre-built integration connectors within BulletTrain that facilitate bidirectional data exchange with external systems such as electronic health records (EHRs), laboratory information systems (LIS), and pharmacy management systems. BulletLink connectors handle protocol translation, data mapping, and error handling for each connected system.
An XML-based document markup standard from HL7 for encoding clinical documents such as discharge summaries, progress notes, and referral letters. CDA documents are both human-readable and machine-processable. Consolidated CDA (C-CDA) is a widely adopted implementation guide that defines templates for common document types used in health information exchange.
Systems that provide clinicians with knowledge and person-specific information at the point of care to assist with diagnostic and treatment decisions. Modern CDS systems use a combination of clinical rules, evidence-based guidelines, and AI models to surface alerts, recommendations, and risk scores. CDS is designed to augment, not replace, clinical judgement.
The international standard for transmitting, storing, and sharing medical images and related metadata. DICOM covers modalities including X-ray, CT, MRI, ultrasound, and pathology imaging. It defines both the file format for images and the network protocol for transferring them between imaging devices, archives, and viewing workstations.
A security mechanism that binds an access token to the cryptographic key of the client that requested it. DPoP prevents stolen tokens from being replayed by a different client, because each request must include a fresh proof that the sender holds the private key. In healthcare APIs, DPoP adds an extra layer of protection against token theft and man-in-the-middle attacks.
An approach that combines outputs from multiple AI models to produce a more reliable clinical assessment than any single model alone. Each model may specialise in different aspects of a case (imaging, lab values, clinical notes), and their outputs are aggregated using voting, weighting, or arbitration strategies. Ensemble approaches reduce the risk of individual model errors affecting patient care.
A European Union regulation establishing a legal framework for the development and deployment of artificial intelligence systems. The EU AI Act classifies AI systems by risk level and imposes requirements proportional to that risk. Healthcare AI systems that assist in clinical decision-making are classified as high-risk and must meet strict requirements for transparency, human oversight, data governance, and accuracy.
An architectural pattern where multiple independent systems or organisations agree to trust each other's identity assertions and share resources without centralising all data in one place. In healthcare, federation enables a clinician authenticated by one hospital's identity provider to access records at another hospital without creating a separate account. Federation preserves data sovereignty while enabling interoperability.
A modern, web-based standard from HL7 International for exchanging healthcare data. FHIR uses RESTful APIs, JSON, and XML to represent clinical and administrative data as discrete "resources" (Patient, Observation, MedicationRequest, etc.). FHIR R4 is the current normative release and is the most widely adopted interoperability standard in healthcare worldwide.
The European Union regulation governing the collection, processing, storage, and transfer of personal data. GDPR grants individuals rights over their data including access, rectification, erasure, and portability. It requires organisations to have a lawful basis for processing, implement appropriate security measures, and report breaches within 72 hours. Healthcare data is classified as a special category requiring additional protections.
A managed service registry hosted by Symphonix Health that enables AI agents in healthcare to discover each other, verify trust credentials, and resolve capabilities before initiating communication. GHARRA acts as a DNS-like directory for the healthcare agent ecosystem, ensuring that only verified agents with validated compliance credentials can participate in clinical workflows.
The tier model that governs how much autonomy an agent has for a specific action when assuming a human persona: T0 human-reserved (the agent may only draft), T1 synchronous human-in-the-loop, T2 act-then-review, and T3 autonomous. An unclassified action fails closed to T0, and a set of statutory actions — Mental Health Act applications, death registration, controlled-drug destruction among them — are human-reserved in code regardless of policy configuration.
The electronic sharing of patient data between healthcare organisations, providers, and systems. An HIE can refer to both the process of exchanging data and the organisations that facilitate it. HIEs enable care coordination by giving authorised providers access to a patient's records regardless of where the care was delivered, reducing duplicate tests and improving clinical outcomes.
United States federal legislation that establishes national standards for the protection of patient data. HIPAA's Privacy Rule governs how patient data may be used and disclosed, while the Security Rule requires administrative, physical, and technical safeguards for electronic patient data. The Breach Notification Rule requires covered entities to notify affected individuals when their data is compromised.
A certifiable security framework that harmonises requirements from multiple regulations and standards (HIPAA, NIST, ISO 27001, and others) into a single assessment. HITRUST certification demonstrates that an organisation meets a comprehensive set of security and privacy controls. It is widely used in the United States healthcare industry as evidence of robust information security practices.
A messaging standard widely used in healthcare for the electronic exchange of clinical data between systems. HL7v2 messages use a pipe-delimited text format and cover events such as patient admissions (ADT), laboratory orders (ORM), results (ORU), and scheduling. Despite being an older standard, HL7v2 remains the most widely deployed messaging format in hospitals worldwide.
A globally recognised coding system maintained by the World Health Organization for classifying diseases, disorders, injuries, and related health conditions. ICD-10 is the current standard used in most countries for clinical coding and billing. ICD-11, the successor edition, adds greater clinical detail, digital-native structure, and improved support for post-coordination of complex diagnoses.
A compact, URL-safe token format for securely transmitting claims between parties. JWTs are digitally signed (and optionally encrypted) and are widely used in healthcare APIs for authentication and authorisation. A JWT typically contains claims about the user's identity, roles, and permissions, allowing receiving systems to verify access rights without querying a central authority on every request.
A type of artificial intelligence model trained on vast amounts of text data that can understand, generate, and reason about natural language. In healthcare, LLMs are used for clinical note summarisation, terminology mapping, literature analysis, and conversational interfaces. Responsible deployment requires careful attention to accuracy, bias, hallucination risk, and data privacy.
A universal coding system for identifying laboratory tests, clinical observations, and survey instruments. LOINC codes ensure that a "fasting blood glucose" result from one laboratory can be correctly matched and compared with the same test from another laboratory. LOINC is essential for clinical data aggregation, population health analytics, and meaningful interoperability between systems.
A protocol that standardises how AI models receive contextual information (documents, database records, API results) from external tools and data sources. MCP defines a structured interface for connecting models to the systems they need to query, enabling consistent tool use across different model providers. In healthcare, MCP allows clinical AI agents to securely access patient records, terminology services, and clinical guidelines.
The practice of coordinating multiple AI models within a single workflow, routing each sub-task to the model best suited for it. For example, a clinical workflow might use a local model for patient data extraction, a specialised model for diagnostic reasoning, and a general-purpose model for report generation. Orchestration handles model selection, prompt construction, response validation, and fallback strategies.
An extension of standard TLS where both the client and server present and verify each other's digital certificates during the connection handshake. In healthcare architectures, mTLS ensures that both ends of a communication channel are authenticated and trusted before any data is exchanged. This prevents unauthorised systems from connecting to clinical data services, even if they possess valid network access.
A WHO-endorsed framework and community of practice for building health information exchanges. BulletTrain implements the OpenHIE mediator pattern, where a central orchestration layer mediates between clinical systems, registries, and services. The mediator pattern enables standards-compliant interoperability without requiring point-to-point connections between every system.
A governed Agent-to-Agent (A2A) communication protocol designed for healthcare. Nexus defines how AI agents discover, authenticate, delegate tasks to, and receive results from each other using JSON-RPC 2.0 with Server-Sent Events and WebSocket transports. Every message passes through a 13-point route admission validation to ensure security and compliance.
A BulletTrain component that assembles a unified, longitudinal view of a patient by aggregating data from multiple source systems across different data standards. Patient360 resolves identity conflicts, merges duplicate records, and presents a complete clinical picture including demographics, conditions, medications, allergies, encounters, and laboratory results in a single coherent view.
An executable end-to-end specification of a clinical workflow walked by governed personas against real services — real routes, real policy enforcement, real audit trails. The platform's journey library holds 203 executable scenarios, 111 of them persona-driven; headed runs use a visible browser so a human can watch each leg render. See the Persona-Driven Journeys page.
A standardised nomenclature for clinical drugs maintained by the United States National Library of Medicine. RxNorm provides normalised names and unique identifiers for medications, linking together the various names used by pharmacies, drug manufacturers, and clinical systems. It enables interoperability between prescribing, dispensing, and medication management systems by providing a common language for medications.
The BulletTrain control plane that manages service orchestration, circuit breakers, retry patterns, and system health monitoring. SignalBox provides a real-time view of all active workflows, tracks per-session audit trails, and exposes Prometheus-compatible metrics. It ensures that failures in one microservice do not cascade through the platform. Distinct from SignalBox MCP, the browser automation and evidence engine.
The platform's browser automation, testing and evidence-capture engine. It runs headed by default so a human can watch every step, is persona-aware — a scenario can switch persona mid-run and assert what that persona is allowed to do — and emits signed evidence manifests anchored to the GHARRA transparency ledger. Beyond testing, governed personas use it as their driver for autonomous execution at runtime. One SignalBox directs the platform's workflow sessions; SignalBox MCP drives and attests real user interfaces.
A registered agent worker in the Symphonix agent registry, defined with its skills, tools, guardrails, tests, KPIs, talent grades and autonomy grants — plus promotion and retirement workflows. A SuperPersona can advise, and it can act: it drives work by governed role assumption into a bound human persona, through binding, capability and tier gates that each refuse independently. Fifty-two are registered, spanning clinical, clinical-trials, engineering, operations, data and assurance roles.
The most comprehensive, multilingual clinical healthcare terminology in the world. SNOMED CT provides standardised codes for clinical findings, procedures, body structures, organisms, substances, and pharmaceutical products. It supports precise recording of clinical information and is used in electronic health records to ensure consistent, unambiguous communication of clinical data across systems and borders.
A family of transaction standards used primarily in the United States for healthcare administrative and financial data exchange. Key X12 transactions include the 837 (claims submission), 835 (payment and remittance advice), 270/271 (eligibility enquiry and response), and 278 (prior authorisation). X12 enables automated processing of insurance claims and payments between providers, payers, and clearinghouses.
A security architecture that operates on the principle of "never trust, always verify." In a zero trust model, every request for access to resources is fully authenticated, authorised, and encrypted regardless of whether it originates from inside or outside the network perimeter. For healthcare systems handling sensitive patient data, zero trust eliminates implicit trust and enforces continuous verification at every layer.
A system that orchestrates the handoffs, referrals, and information sharing between multiple care providers involved in a patient's treatment. A care coordination platform ensures that every clinician in the chain — from general practitioner to specialist to discharge team — has access to the same up-to-date clinical context, reducing duplication and improving continuity of care.
The use of artificial intelligence to assist clinicians in making diagnostic, treatment, and management decisions at the point of care. AI clinical decision support systems analyse patient data, apply clinical guidelines, and generate evidence-based recommendations — including differential diagnoses, medication suggestions, and risk scores — while maintaining full audit trails and clinician override capability.
Software services that map, validate, and translate between healthcare coding systems such as SNOMED CT, ICD-10, ICD-11, LOINC, RxNorm, and dm+d. Clinical terminology services enable systems to understand that a diagnosis recorded in one coding system is equivalent to the same diagnosis in another, which is essential for interoperability, analytics, and clinical decision support.
The use of software — often AI-driven — to automate repetitive clinical processes such as referral management, appointment scheduling, results routing, and discharge planning. Clinical workflow automation reduces administrative burden on clinicians, decreases turnaround times, and ensures that steps are not missed in complex multi-step care pathways.
Automated verification of whether a newly prescribed medication conflicts with a patient's existing medications, allergies, or clinical conditions. Drug interaction checking systems evaluate potential adverse interactions such as serotonin syndrome risk, QT prolongation, cytochrome P450 conflicts, and contraindications, alerting prescribers before the order is submitted.
A healthcare data platform built natively around the HL7 FHIR R4 standard, providing pre-built connectors, resource validation, terminology mapping, and API endpoints for exchanging clinical data between systems. Unlike legacy governed connectivity platforms that add FHIR as an adapter layer, a FHIR integration platform uses FHIR as its primary data model throughout the stack.
The policies, processes, and technical controls that determine how healthcare data is collected, stored, accessed, shared, and deleted across an organisation or health system. Health data governance encompasses consent management, data residency rules, audit trails, access control, retention policies, and regulatory compliance — ensuring that patient data is handled safely and lawfully at every stage.
An infrastructure layer that exposes clinical data and operational functions through secure, standards-based application programming interfaces (APIs). A healthcare API platform handles authentication, rate limiting, data transformation, and compliance enforcement, allowing internal and external applications to access health system capabilities without direct database access.
A governed connectivity platform that enables healthcare systems to exchange clinical, administrative, and financial data using recognised standards such as FHIR R4, HL7v2, CDA, X12, and DICOM. A healthcare interoperability platform mediates between systems of different ages, vendors, and architectures — translating protocols, validating content, and maintaining audit trails across every exchange.
The process of routing patient referrals from one care provider to another — including priority assessment, capacity checking, document attachment, and tracking. AI-assisted referral management can automatically classify urgency, match patients to specialists based on clinical need and availability, and ensure that referral letters contain complete and accurate clinical context.
The process of translating clinical terms between SNOMED CT (Systematized Nomenclature of Medicine — Clinical Terms) and other coding systems such as ICD-10, ICD-11, LOINC, or RxNorm. SNOMED CT mapping is essential for interoperability between systems that use different terminologies, enabling consistent clinical data interpretation across organisational and national boundaries.
See the platform in action: Cross-Border Demo • Agent Topology Demo
Walk through the architecture with our team and see how BulletTrain implements these standards in a governed, AI-native platform.