Why Identity Is the Missing Layer of Responsible AI
Independent commentary on Impersonation Latency and the five NHID-Clinical controls, mapped to NIST AI RMF, ISO/IEC 42001, and HIPAA.
DBC-01 Coverage Expanded from Real-Corpus Mining
Detection of DBC-01 (Deceptive Behavior Claim) against real conversational phrasing — measured on the Fabricate Battle-Test Corpus (550 real-world voice AI conversations) — was 0.5% prior to this update. Mining the corpus for missed phrasing patterns and additively expanding the heuristic phrase list raised that to 2.5%.
- DBC-01 real-corpus detection: 0.5% → 2.5%
- 3 new heuristic phrases added, additive only — no existing phrases removed or renamed
- 3 new regression tests added; full suite at 306 passing
- IDG-01 (100%) and EIT-01 (94.7%) continue to hold up well against real phrasing; PDX-01 (58.6%), DBC-01, and ATR-01 (0%) remain known weak points and active work — see the Evidence Pack for the full breakdown
Community Channels Consolidated to GitHub
Discord and Reddit are no longer used for NHID-Clinical community discussion. All community activity — questions, implementation experiences, and proposal feedback — now happens in GitHub Discussions on the main repository.
v1.3 Final — Milestone Closeout
Six previously-open items are closed out under the existing v1.3 spec version — no version bump, no v1.4 branding. Shipped this cycle:
- Implementation Registry — self-attestation listing for vendor implementations, seeded empty
- Spanish and Mandarin disclosure support for Beacon's voice agent
- Cryptographic agent identity binding (NHID-Auth) wired into the conformance API, with durable passport-revocation storage
- Production failure-mode handling — bounded retries with jittered backoff on outbound network calls
- Payer-initiated call guidance and a SIP header standards-feedback position paper
- 284 passing Python tests (18 skipped), 66 passing TypeScript middleware tests
Community Channels Consolidated to GitHub
Discord and Reddit are no longer used for NHID-Clinical community discussion. All community activity — questions, implementation experiences, and proposal feedback — now happens in GitHub Discussions on the main repository.
v1.3 Reference Implementation Live
The reference implementation is now fully operational. Key deliverables shipped this cycle:
- Live AWS Lambda conformance endpoint — no key required for demo and adapter routes
- VAPI + Twilio reference adapters — paste a native call payload, get a pass/fail result instantly
- PowerShell module for payer teams (
NHIDClinical.psm1) - 198 passing conformance tests
- Interactive governance simulator running real policy checks
- Operational blueprint (PDF)
Still early — no production pilots yet. Actively seeking first shadow evaluation partners.
NHID-Clinical v1.3 Published
v1.3 is the first public release of this open proposal. It suggests four behavioral expectations for AI voice agents in healthcare payer–provider administrative calls, focused on early disclosure of automated status.
Pilot Partners Sought
We are actively seeking payer and provider organizations to run a 90-day shadow evaluation — no vendor changes, no production risk. Observe incoming AI voice calls against the v1.3 behavioral baseline and help shape the standard before v2 ships.
Submitted to NIST
NHID-Clinical was submitted as a public comment to NIST docket NIST-2025-0035 (AI-agent security). Comment ID: NIST-2025-0035-0026. This is a public comment — not a regulatory filing or endorsement. The RFI drew 932 public comments in total before the period closed in March 2026.
Community Channels Open
NHID-Clinical community discussion channels are now open. Join to ask questions about this proposal, share implementation experiences, and contribute to future versions. (Update, June 2026: community discussion has since moved to GitHub Discussions — see the June 2026 announcement above.)