Alignment · June 2026
Regulatory Alignment
How NHID-Clinical maps to current healthcare AI governance requirements.
Note: NHID-Clinical is an open governance framework, developed independently from direct payer operations experience. It is not an accredited standard, certification, or regulatory requirement.
How NHID-Clinical Maps to Current Requirements
This is not legal advice. NHID-Clinical is voluntary. The table below shows how the controls relate to key regulations and guidance as of June 2026. Fairness and clinical-safety governance are intentionally out of scope — see the scope boundary note.
| Regulatory Driver | Specific Requirement | NHID-Clinical Control |
|---|---|---|
| CMS-0057-F Prior Auth Final Rule | FHIR API, 72-hour turnaround, 5-year retention | HL7 FHIR R4 AuditEvent (validated) + session trace (ATR-01) — mapping spec |
| MACPAC May 2026 | AI transparency in prior auth, human review pathway | IDG-01 + EIT-01 (escalation) + ATR-01 |
| DOJ FCA 2026 Enforcement Focus | Explainability + audit trail for AI-assisted billing | Structured trace + CTS conformance (ATR-01) |
| State AI Laws (CA, TX, MD, etc.) | Inspectable, auditable AI decisions | IDG-01 + DBC-01 + L1/L2/L3 tiers |
| NIST AI RMF / CAISI | Cross-org agent identity + authorization | NHID-Auth v2 + NIST-2025-0035-0026 comment |
FHIR R4 AuditEvent Emission
Every NHID-Clinical conformance test suite (CTS) execution produces a HL7 FHIR R4 Bundle of AuditEvent resources — one per conformance milestone. These Bundles are validated against the FHIR R4 base specification (version 4.0.1) in CI before every merge.
What is emitted per call:
- nhid-session-start — call session initialised (DCM Application Activity)
- nhid-identity-disclosure — IDG-01 gate evaluated; outcome reflects pass/fail (DCM Security Alert)
- nhid-auth-verification — provider NPI authorization recorded, when present (DCM User Authentication)
- nhid-phi-gate — PDX-01 pre-data-exchange gate decision (DCM Security Alert)
- nhid-phi-exchange — PHI exchange begins, when gate cleared (DCM Patient Record)
- nhid-escalation — EIT-01 escalation event, when triggered (DCM Application Activity)
- nhid-call-end — session terminated; outcome reflects aggregate policy decision (DCM Application Activity)
Conformance scope: Validated against HL7 FHIR R4 base specification only.
No conformance to any named HL7 Implementation Guide is claimed or implied.
DICOM audit event type codes (DCM 110100, 110110, 110113, 110114) are used for
AuditEvent.type.
Three agent slices capture the AI voice agent (requestor), payer system (destination),
and provider organisation (on-behalf-of, when NPI is present).