Safeguards
You are right to be wary.
Here is the machinery.
An AI system, built for insurers, anywhere near decisions about care — that combination has earned suspicion, and this page does not ask you to set yours aside. PRISM's own documentation names the failure mode plainly: a system that reads claims histories and learns utilization phenotypes sits uncomfortably close to technologies that could ration or deny care.
The answer is not a promise about how the system will be used. A promise can be reversed by whoever inherits the system; missing machinery cannot be quietly switched on. Every safeguard below is a mechanism — most of them things PRISM structurally cannot do.
New here? How it works explains the mechanism this page locks down.
Six worries, six mechanisms
Name your worry. Each one has an answer built of parts, not policy.
"It will be used to deny care."
There is no pathway to deny anything. The output space contains positive suggestions and silence — the denial machinery was never built.
Constructive-only →"Its silence will become 'no need to test.'"
Silence is never stored, scored, or reported. The models are not even allowed to stop writing — a stop could be read as a verdict.
Recall, not prediction →"It's reading people's medical records."
It can't. Six columns of billing codes, an age, and a sex — names, addresses, lab values, and notes were never in the data path.
Anonymous by architecture →"It will pressure physicians."
A flag goes to one physician, who is free to ignore it — and the system is structurally blind to whether anyone followed it.
Ordinary decision support →"It profits when care is withheld."
The reverse, by design: revenue exists only when a suggestion leads to a documented early detection. Nothing is earned by a test not happening.
The incentive lock →"A future owner will repurpose it."
Two independent locks — a public-benefit charter and the absent denial machinery. Defeating both takes two separate, visible acts.
The charter lock →Safeguard 1 · Constructive-only architecture
It cannot say "don't test." Not won't — can't.
PRISM can suggest a diagnostic test or say nothing — those are the only two outputs the system is physically capable of producing. Strip it to its moving parts and it does exactly two things: append rows to a patient timeline, and count positives. Neither operation can express "don't." A model generates a test code or fails to generate it. A count rises or stays flat.
The clearest way to see that this is architecture rather than policy is to enumerate what would have to exist for PRISM to deny care:
| A denial-capable system would need | What PRISM has instead |
|---|---|
| an output vocabulary of decisions — "approve", "deny", "not medically necessary" | the output vocabulary is rows of billing codes; there is no decision token to emit |
| training data labeled with what should not happen | training data is timelines of care that actually occurred |
| an aggregator that can weigh votes against an action | counting is additive only; non-firing models add nothing and cancel nothing |
| a connection to claims, orders, or authorizations it could act on | suggestions reach a physician as information; PRISM touches no claim, no order, no authorization |
None of these are disabled features or configuration switches. They are absent components. Turning PRISM into a denial engine would mean rebuilding it — a different output space, different training data, a different aggregation rule, and a different connection to the world. That is the meaning of "architectural, not policy."
Every knob points the same direction
The tunable parameters share one property: they adjust how suggestive the system is, never how restrictive. Lowering the consensus bar surfaces more suggestions; raising it yields fewer, down to silence — never past silence into denial. Adding pools and models can only add potential votes; removing them only quiets the system.
Try it on the documentation's own worked example from the prototype's five-model ensemble — two models firing while three stay silent:
Two fires and three silences is a flag with weight two — not three votes against. A silent model contributes nothing; it cannot cancel, veto, or oppose.
Bar met — the example surfaces as a flag with weight two. The three silent models added nothing and canceled nothing.
Notice the two things the dial cannot do: change a vote, or turn silence into a "no." The prototype itself set no thresholds — it reported raw agreement counts, and five models is the prototype's scale (the production vision is on the order of 100 pools, with any per-condition bar set under medical oversight). Every position on this dial is a level of suggestiveness, and the scale ends at silence.
Healthcare already has abundant mechanisms for saying no; what it lacks is systematic surfacing of the beneficial tests that go unordered. PRISM supplies only that missing half.
Safeguard 2 · Recall, not prediction
Silence is never a signal.
A predictor assigns a calibrated probability, and both ends of that scale carry meaning — including the low end. The moment a screening system speaks that way, its silence acquires a use: "the model saw no need, so the test need not be covered." A tool built to catch missed care would become, in the same breath, an instrument for denying it.
PRISM refuses that failure mode structurally. It is a recall instrument, never a predictor: its only possible statement is "consider this test," and it has no vocabulary for this patient is fine.
The models are never allowed to stop
At inference, every model in the ensemble is denied its end-of-sequence token and forced to keep continuing the six-column table for a fixed budget — in this round, roughly 1,500 tokens, ten or more complete rows. A model allowed to stop would be making a statement: ending the table reads as "nothing more is coming," which is exactly the calibrated no-need prediction PRISM must not emit. Banning the token removes the option entirely.
The read is binary. A continuation either contains the test code or it does not — a string match, not a judgment call. No confidence score attaches to a single continuation, and none is invented downstream. The two possible outcomes are not mirror images, and the system treats them accordingly:
| Outcome | What it means | What happens to it |
|---|---|---|
| the TEST code appears — a fire | "consider this test" — a pattern worth a human look | counted toward consensus; may become a suggestion to a physician |
| the TEST code does not appear — silence | nothing | never stored, scored, or reported as any statement about the patient — not "low risk," not "cleared" |
Only one of these is an output at all. A fire is a flag; silence is the absence of a flag, and PRISM keeps no ledger of it. There is no "screened and negative" record anywhere in the system, because the system cannot produce that claim in the first place.
Measured, and found empty
This principle is usually asserted on ethical grounds. The 2026 synthetic proof of concept was able to measure it: across the full evaluation grid, every miss on a signal-bearing patient traced to one mechanical cause — a model fires if and only if its prompt contains at least one precursor row. Silence reflected missing input, never a "low-risk" read of the patient. That makes denial-by-silence statistically indefensible, not merely disallowed: a non-fire carries information about what the prompt contained, and none about what the patient needs.
Honest limits
That measurement comes from the 2026 prototype's deliberately clean synthetic data — a fabricated condition injected into synthetic patients precisely so every miss could be traced. It demonstrates the mechanism as an upper bound; it is not a forecast of real-world behavior. And the synthetic world is the favorable case: real claims histories are less complete, so on real data silence can only mean less — one more reason it must never be read as a verdict. The results and their limits →
What ultimately surfaces is consensus: how many independently trained models wrote the same test into the same patient's continuation. That count stays a count — "N of M independent models surfaced this test" — and is deliberately never converted into a percentage chance that a patient does or does not need care. A flag invites attention; a probability invites arithmetic against a threshold, and thresholds are where silence gets weaponized.
Safeguard 3 · Anonymous by architecture
Not de-identified. Never identified.
PRISM does not protect patient identities; it is built never to hold them. Identifying information is not removed, masked, or encrypted out of the data — it is absent from the data path by construction.
That distinction matters. Healthcare privacy usually means de-identification: a standard list of identifiers — under HIPAA's Safe Harbor method, eighteen of them — is stripped from otherwise-complete records. Valuable, but it leaves the full texture of an individual life intact, and that texture can act as a fingerprint: re-identification of de-identified health data through linkage with other datasets is a demonstrated research result, not a hypothetical. PRISM takes the other road — not scrubbing identity out, but never letting it in. A model's entire universe is one table:
| PERSON | WHEN | WHERE | WHO | WHAT | WHY | | ------ | ---- | ----- | --- | ---- | --- |
The fixed two-line header every example begins with. Six columns are the entire input, in training and at inference — every field a small integer, a date, or a code from a finite public vocabulary.
What a row says is: a 45-year-old female saw a family-medicine provider in an office and was prescribed a blood-pressure medication. Very large numbers of people match every individual row; the fields that would distinguish one of them — names, member numbers, addresses, birthdates, the identity of the physician or the pharmacy — were never in the columns to begin with.
| Never present in PRISM's data | What a model sees instead |
|---|---|
| name, member ID, policy number, SSN, any government identifier | a one-way hash (production design) whose map lives only with the insurer |
| date of birth | an integer age, advancing naturally down the timeline |
| address, city, ZIP, any geography | nothing — location is not a column |
| which physician, hospital, lab, or pharmacy | provider specialty and the kind of setting, as standardized codes |
| employer, income, insurance tier, household or family links | nothing |
| lab values, vitals, clinical notes | nothing — the record shows that a test was billed, never what it found |
Honest limits
Individual rows are anonymous; a long, dated timeline is itself a distinctive object. That whole-record uniqueness is exactly why the linkage design matters: the map from timelines back to people exists in one place — inside the insurer, who already knows its members — and the production posture keeps PRISM's hardware inside the insurer's walls, so timelines never travel. Status matters here too: the 2026 proof of concept ran entirely on fabricated patients, with no identities to protect, so everything in this section is architecture and production design — not an exercised privacy record.
The same absence does ethical work. What a model cannot see, it cannot be biased by: income, employer, neighborhood, race, insurance tier, facility prestige — none of these are inputs, so none can steer a suggestion. Age and sex remain visible because they are medically necessary. This does not make the system bias-free — utilization itself reflects unequal access to care, and a thin record yields a thin pattern — but it removes the direct inputs, and the constructive-only architecture bounds the failure mode: the worst a biased pattern could produce is an extra suggestion to consider a test, never a denial.
Safeguard 4 · Ordinary decision support
One flag, one physician, entirely free to ignore it.
When enough independent models agree, one thing happens: a suggestion travels through the communication channels the insurer already uses for care-gap alerts, to exactly one recipient — the patient's primary-care physician. Never to patients directly, never to specialists, never to anyone else. Nothing PRISM emits can reach a patient except through a physician's independent judgment.
The flag itself is deliberately modest: "N of M independent models surfaced this test." A flag, not a probability, and certainly not a diagnosis. Every test it can suggest is an established, approved diagnostic with standard interpretation — the novelty is entirely in noticing when an existing test might be worth considering, never in the intervention itself. And the basis is independently reviewable: the patient's own claims history, which the physician can inspect, weigh, and disagree with. The physician holds the whole-patient context; PRISM does not know why a visit happened, only that it was billed.
The boundaries are architectural facts, not usage guidelines:
| Action | PRISM |
|---|---|
| suggest an established screening test | yes — this is its entire output |
| order a test | no; the physician orders it, or doesn't |
| interpret results | no; PRISM never sees test results or lab values at all |
| diagnose a condition | no; a suggestion is a flag that a pattern warrants a look, nothing more |
| recommend or provide treatment | no; treatment is outside the output space entirely |
| deny, delay, or discourage care | no pathway exists — the denial machinery was never built |
Free to ignore — invisibly
Physician review is not a safety feature layered onto PRISM; it is the operating principle the whole deployment is shaped around. Without a physician choosing to act, the system is inert: no automated workflow proceeds, no alert escalates, no order fires by default. A suggestion nobody acts on does nothing at all. The human is not a checkpoint a future, more confident version might optimize away — the human is the mechanism by which pattern recognition becomes medicine. Remove the physician and PRISM does not become autonomous; it becomes useless.
And there are no metrics on whether physicians follow suggestions — no dashboards scoring responsiveness, no penalties for dismissal, no rewards for uptake. This is not restraint; it is architecture. Claims data is PRISM's only window into the world — it learns that a suggestion was acted on only if the suggested test later appears in claims, the same mechanism that settles its compensation — so a physician who quietly dismisses every suggestion is, from the system's side, indistinguishable from one who never received them. That invisibility is the point: a physician may have reasons no billing pattern can capture, and a system that cannot see whether it was followed cannot pressure anyone into following it.
Status
This is the deployment posture designed for the real-data phase — none of it has been exercised yet. The 2026 synthetic prototype validated the screening method; the posture around it will be tested, legally and operationally, only when that phase arrives.
Safeguard 5 · The incentive lock
No revenue path runs through gatekeeping.
The compensation model was designed backwards from this page's worries. Under the structure PRISM will pilot with its first client — a designed structure, not yet in operation — PRISM charges nothing for access, suggestions, or membership. It is paid only when a suggestion leads to a documented early detection, verified in the claims stream the insurer already processes. There is no fee-for-service and no per-member fee, so no revenue attaches to a test not happening.
If the chain breaks at any point — the physician declines, the test comes back negative, no treatment follows — PRISM earns nothing and the client owes nothing. A suggestion is a flag, not a billable event. Over-suggestion doesn't pay either: a test that finds nothing completes no chain, and every suggestion must first pass a physician who keeps full authority over the order. Restraint is priced in.
The same design covers the patient: a PRISM-suggested screening is designed to carry no out-of-pocket cost — no copay, no deductible — because the financial benefit of the screening accrues first to the insurer, so asking the patient to pay would mean charging them for someone else's savings; and because even modest cost-sharing measurably suppresses screening completion.
Put this beside the architecture and the alignment closes: a system that profits only from confirmed early detections and can emit only positive suggestions has its constraint and its motive aligned by construction. One makes denial impossible to build; the other makes it unprofitable to want.
Safeguard 6 · The charter lock
Bound to the mission by law — and by missing machinery.
PRISM operates as a Public Benefit Corporation, incorporated in Delaware in 2026, so that its commitment to patient outcomes is a charter-level legal obligation, not a mission statement. A Delaware PBC changes the directors' duty itself: the charter names a specific public benefit — improving patient health outcomes through earlier detection of medical conditions — and directors are legally required to weigh that benefit alongside financial return. Choices that favor patients over short-term profit are what the governing documents demand, not managerial generosity.
The binding survives changes of control. The public benefit lives in the certificate of incorporation, so it persists through new investors, new management, new owners, and the departure of the founder. Removing it would require amending the charter itself — a deliberate, visible, stockholder-level act. Anyone who acquires PRISM acquires the obligation with it.
And the charter never stands alone. The mission is held by two locks, not one:
Lock one — the charter (legal)
Prevents governance decisions that subordinate patient benefit to profit. Fails only if the charter is amended by stockholder vote — a deliberate, public act.
Lock two — the architecture (technical)
Prevents the deployed system from emitting any care-restricting output, because the machinery doesn't exist. Fails only if the software is deliberately rebuilt.
The locks are independent — neither depends on the other holding. Subverting the mission would require both a formal legal amendment and an intentional re-engineering of the system: two separate acts, by two separate mechanisms, each visible. No single decision, owner, or pressure defeats both at once.
One honest boundary, stated plainly: the PBC form does not, by itself, make the technology work — the synthetic prototype carries that burden, and real-data validation is still ahead. What the structure guarantees is narrower: whatever PRISM becomes, it is bound to become it in service of the benefit written into its charter.
Keep going
Where to take what's left of your doubt.
The measurements
The 2026 synthetic proof of concept: setup, results, ablations — and what it deliberately does not prove.
See the evidence →The skeptic's page
Where doubt should land: signal isolation, the no-holdout design, explained misses, and the unproven leaps.
Stay skeptical →The clinician's view
What a flag is and is not, how one would arrive, and why your judgment is the mechanism — not a checkpoint.
The clinician's view →