NHID-Clinical FAQ

What is NHID-Clinical?

NHID-Clinical is an early-stage voluntary open proposal (v1.3, May 2026) that addresses a specific problem in healthcare payer–provider voice workflows: AI voice agents that interact with payer staff without disclosing they are automated systems.

It is not an official standard, certification program, or regulatory requirement. It is one person's attempt to name the problem and suggest a starting point for shared expectations.

What problem does it address?

Impersonation latency — the gap between when an AI voice agent begins a call and when the person on the other end realizes they are not speaking to a human.

An AI calls as "Sarah from Dr. Smith's office," handles several minutes of normal workflow conversation, and only admits "I'm an automated system" when challenged. By then, sensitive operational data has already been exchanged — without clear consent or accountability.

Who created this?

Brianna Baynard, after working in healthcare payer operations and personally experiencing these calls from AI systems that presented as human. It is an individual volunteer effort, not backed by any organization or standards body.

Is this mandatory?

No. Completely voluntary. Payers, providers, and vendors can choose to reference it, adapt it, or ignore it entirely.

What does the proposal actually suggest?

Four behaviors for AI voice agents in B2B healthcare administrative calls:

• Identify as an automated system before any operational data is exchanged
• Avoid behavioral patterns designed to sound human (fake breathing, filler sounds, etc.)
• Provide a clear, easy path to a human when requested
• Maintain basic logs of the interaction

The full proposal document has detailed discussion of each. Download the PDF →

Who is this for?

• Payers receiving AI calls from providers or vendors
• Providers and vendors building AI voice agents
• Operations and compliance teams who want clearer expectations

It does not apply to patient-facing calls, internal tools, or clinical decision AI.

How is this different from HIPAA or TCPA?

Those regulations cover patient data privacy and consumer call consent. Neither specifically addresses the B2B scenario where an AI agent calls a payer office on behalf of a provider — which is where the impersonation latency problem actually occurs.

This proposal is designed to address a gap, not replace existing rules.

Why are NPIs a security risk in voice calls?

NPIs are public identifiers. Anyone can find a provider's NPI in the NPPES registry and use it when calling a payer. Without a real-time authorization check, a caller can claim to be from that practice and request operational data — claim status, eligibility, authorization details — and the payer's system has no mechanism to refuse.

NHID-Clinical v1.3 addresses the disclosure side: did the caller identify as an AI? v2 addresses the authorization side: is this AI actually delegated by the provider it claims to represent? The goal is that a payer can know not just that they're talking to an AI, but that the AI truly represents the provider it claims to. The reference implementation includes 173 passing tests to ensure deterministic policy enforcement.

Can I get feedback on my implementation?

Informal peer feedback is available on a limited basis. Email contact@nhid-clinical.org with your context. This is not certification or formal assessment.

What is the NIST connection?

NHID-Clinical was submitted as a public comment to NIST docket NIST-2025-0035 (AI-agent security) in January 2026. Comment ID: NIST-2025-0035-0026. This is a public comment — it does not imply NIST endorsement or recognition.

How can I give feedback or get involved?

Email:   contact@nhid-clinical.org
Discord:  discord.gg/eP8FxXkGU6
Reddit:   r/NonHumanAuth

Real-world experience from payers and implementers is what this proposal most needs.

Join the community →