NHID-Clinical FAQ

NHID-Clinical is a voluntary, practitioner-led open framework (v1.3) that addresses a specific problem in healthcare payer–provider voice workflows: AI voice agents that interact with payer staff without disclosing they are automated systems.

It is not an official standard, certification program, or regulatory requirement. It is an independent, practitioner-led effort to name the problem and define a testable baseline for shared expectations.

It also does not evaluate model fairness, clinical safety, or output quality — those remain separate governance responsibilities. See the scope boundary note for what stays out of scope and how NHID-Clinical integrates underneath those programs.

Impersonation latency — the gap between when an AI voice agent begins a call and when the person on the other end realizes they are not speaking to a human.

An AI calls as "Sarah from Dr. Smith's office," handles several minutes of normal workflow conversation, and only admits "I'm an automated system" when challenged. By then, sensitive operational data has already been exchanged — without clear consent or accountability.

Brianna Baynard, after working in healthcare payer operations and personally experiencing these calls from AI systems that presented as human. It is an individual volunteer effort, not backed by any organization or standards body.

No. Completely voluntary. Payers, providers, and vendors can choose to reference it, adapt it, or ignore it entirely.

No. There is no certifying body, no accreditation and no badge. A pass on the conformance suite means your implementation produced the expected verdict on every published case and that someone else can reproduce the result from the same inputs. It does not mean anyone has certified you, and the implementation registry is a self-attestation list.

No. The controls are mapped to CMS-0057-F, the NIST AI RMF and other instruments, but mapping is not compliance and compliance is not certification. Nothing here confers HIPAA, TCPA or any other compliance status, and nothing on this site is legal advice. The mapping tells a compliance team which control produces which kind of evidence; the determination stays theirs.

No one. NHID-Clinical has no adopters, no customers, no completed pilots and no production deployments. The first step for any organization is an observe-only shadow evaluation on its own call traces, and we are looking for the first partners. When that changes it will be said here, with names.

Not in a shadow evaluation. The engine evaluates call traces you already hold, after the fact; nothing is inserted into the call and no caller is blocked. A vendor may choose to run the same engine inside its own call path, and the hosted API exists for integration testing with synthetic data, but that is a deployment decision made by the deployer. This project operates nothing in anyone’s live traffic.

Four behaviors for AI voice agents in B2B healthcare administrative calls:

• Identify as an automated system before any operational data is exchanged
• Do not claim to be a human or a licensed professional
• Provide a clear, easy path to a human when requested
• Maintain basic logs of the interaction

The full proposal document has detailed discussion of each. Download the PDF →

• Payers receiving AI calls from providers or vendors
• Providers and vendors building AI voice agents
• Operations and compliance teams who want clearer expectations

It does not apply to patient-facing calls, internal tools, or clinical decision AI.

Those regulations cover patient data privacy and consumer call consent. Neither specifically addresses the B2B scenario where an AI agent calls a payer office on behalf of a provider — which is where the impersonation latency problem actually occurs.

This proposal is designed to address a gap, not replace existing rules.

NPIs are public identifiers. Anyone can find a provider's NPI in the NPPES registry and use it when calling a payer. Without a real-time authorization check, a caller can claim to be from that practice and request operational data — claim status, eligibility, authorization details — and the payer's system has no mechanism to refuse.

NHID-Clinical v1.3 addresses the disclosure side: did the caller identify as an AI? v2 addresses the authorization side: is this AI actually delegated by the provider it claims to represent? The goal is that a payer can know not just that they're talking to an AI, but that the AI truly represents the provider it claims to. The reference implementation includes 2278 passing tests to ensure deterministic policy evaluation.

Informal peer feedback is available on a limited basis. Email contact@nhid-clinical.org with your context. This is not certification or formal assessment.

NHID-Clinical was submitted as a public comment to NIST docket NIST-2025-0035 (AI-agent security) in January 2026. Comment ID: NIST-2025-0035-0026. This is a public comment — it does not imply NIST endorsement or recognition.

Email:   contact@nhid-clinical.org
GitHub:  github.com/NHID-Clinical/NHID-Clinical/discussions

Real-world experience from payers and implementers is what this proposal most needs.

Read the evaluation guide →

The Discussions, Issues, the status labels and how to contribute are on the About page.