Regulatory Alignment

The table below shows how the controls relate to key regulations and guidance as of June 2026. Fairness and clinical-safety governance are intentionally out of scope — see the scope boundary note.

Direct the control’s artifact is the evidence the requirement asks forPartial the control contributes evidence toward the outcome· no mapping claimed

¹ IDG-01 is designed to support the disclosure obligation described in EU AI Act Article 50(1). Nothing more is claimed. Where the rows come from: CMS-0057-F — FHIR API for PA transactions (ATR-01, FHIR R4 AuditEvent), AI transparency in decisions (IDG-01), human review availability (EIT-01). MACPAC May 2026 — AI transparency in prior auth and a human review pathway (IDG-01, EIT-01, ATR-01). DOJ FCA 2026 — explainability and an audit trail for AI-assisted billing (ATR-01, with the conformance test suite). State AI laws — inspectable, auditable AI decisions (IDG-01, DBC-01). NIST AI RMF — MEASURE 2.8 Direct for IDG-01, DBC-01, EIT-01, ATR-01; MAP 4.2 Partial for all five plus opt-in DLG-01; MEASURE 2.7 Partial for DLG-01.

The NIST CAISI request for information on AI agent security (docket NIST-2025-0035) is answered by NHID-Auth v2 rather than by a v1.3 control; NIST-2025-0035-0026 is a public comment, not an endorsement. STIR/SHAKEN is a carrier-layer attestation that a number is legitimate, not a control mapping; see below. FHIR output is validated against the R4 base specification (4.0.1) only; no Implementation Guide conformance is claimed.

Every NHID-Clinical conformance test suite (CTS) execution produces a HL7 FHIR R4 Bundle of AuditEvent resources — one per conformance milestone. These Bundles are validated against the FHIR R4 base specification (version 4.0.1) in CI before every merge.

AWhat is emitted per call

1. nhid-session-startCall session initialized (DCM Application Activity).
2. nhid-identity-disclosureIDG-01 evaluated; outcome reflects pass or fail (DCM Security Alert).
3. nhid-auth-verificationProvider authorization recorded, when present (DCM User Authentication).
4. nhid-phi-gatePDX-01 decision (DCM Security Alert).
5. nhid-phi-exchangePHI exchange begins, when the gate cleared (DCM Patient Record).
6. nhid-escalationEIT-01 escalation event, when triggered (DCM Application Activity).
7. nhid-call-endSession ends; outcome reflects the aggregate decision (DCM Application Activity).

{
  "resourceType": "AuditEvent",
  "id": "nhid-ae-a54cc51015487d44",
  "type": {
    "system": "http://dicom.nema.org/resources/ontology/DCM",
    "code": "110113",
    "display": "Security Alert"
  },
  "subtype": [
    {
      "system": "https://nhid-clinical.org/fhir/CodeSystem/audit-event-subtype",
      "code": "nhid-identity-disclosure",
      "display": "NHID Identity Disclosure"
    }
  ],
  "action": "E",
  "recorded": "2026-06-09T14:30:05.000Z",
  "outcome": "0",
  "outcomeDesc": "AI identity disclosed and assertion text confirmed",
  "agent": [
    {
      "type": {
        "coding": [
          {
            "system": "http://dicom.nema.org/resources/ontology/DCM",
            "code": "110153",
            "display": "Source Role ID"
          }
        ]
      },
      "who": {
        "identifier": {
          "system": "https://nhid-clinical.org/fhir/agents",
          "value": "agent_4001krn32nmwe5t8mqzgee0w84rj"
        },
        "display": "agent_4001krn32nmwe5t8mqzgee0w84rj"
      },
      "requestor": true
    },
    {
      "type": {
        "coding": [
          {
            "system": "http://dicom.nema.org/resources/ontology/DCM",
            "code": "110152",
            "display": "Destination Role ID"
          }
        ]
      },
      "who": {
        "display": "Payer Organization"
      },
      "requestor": false
    },
    {
      "type": {
        "coding": [
          {
            "system": "https://nhid-clinical.org/fhir/CodeSystem/agent-role",
            "code": "principal",
            "display": "Principal Organization (on behalf of)"
          }
        ]
      },
      "who": {
        "identifier": {
          "system": "http://hl7.org/fhir/sid/us-npi",
          "value": "1234567890"
        },
        "display": "Sunny Dental Group"
      },
      "requestor": false
    }
  ],
  "source": {
    "site": "nhid-clinical.org",
    "observer": {
      "identifier": {
        "system": "https://nhid-clinical.org/fhir/systems",
        "value": "nhid-policy-engine-v1"
      },
      "display": "NHID-Clinical Policy Engine v1"
    },
    "type": [
      {
        "system": "http://terminology.hl7.org/CodeSystem/security-source-type",
        "code": "4",
        "display": "Application Server"
      }
    ]
  },
  "entity": [
    {
      "what": {
        "identifier": {
          "system": "https://nhid-clinical.org/fhir/sessions",
          "value": "CA1234567890abcdef1234567890abcd"
        }
      },
      "type": {
        "system": "http://terminology.hl7.org/CodeSystem/audit-entity-type",
        "code": "2",
        "display": "System Object"
      },
      "role": {
        "system": "http://terminology.hl7.org/CodeSystem/object-role",
        "code": "20",
        "display": "Job"
      },
      "description": "NHID-Clinical call session"
    },
    {
      "what": {
        "identifier": {
          "system": "https://nhid-clinical.org/fhir/sessions",
          "value": "CA1234567890abcdef1234567890abcd"
        }
      },
      "type": {
        "system": "http://terminology.hl7.org/CodeSystem/audit-entity-type",
        "code": "4",
        "display": "Other"
      },
      "description": "Hi, this is Ida, an AI assistant calling from a provider office on behalf of a dental facility. I am not a human."
    }
  ]
}

AuditEvent Mapping Spec → Example Bundle (JSON) → Payer Ingestion Guide →

ATrust stack

ANIST AI RMF 1.0 — subcategory crosswalk (mapped, not certified)

The strongest rows of a subcategory-level crosswalk against the official NIST AI RMF Playbook. Each row is evidence toward an outcome that belongs to the deploying organization, for the voice-call channel only — not a compliance determination or certification. Direct: the control's output is evidence of the outcome itself. Partial: it covers part of the outcome; the rest is the deployer's. Most of the 72 subcategories are organizational and stay with the deployer.

Full crosswalk — all 72 subcategories, the Playbook documentation questions NHID evidence can help answer, what stays out of scope, and candidate gaps: NIST AI RMF Playbook crosswalk. This replaces an earlier three-row table whose subcategory mappings did not match the official outcome statements.

The minimum evidence a voice-AI vendor should produce — conformance test results, a disclosure transcript, the escalation phrase list, a FHIR AuditEvent sample and the NPI binding documentation — is specified once, on the Evidence pack. Ask for it by that name.

● NHID-Clinical addresses the operational control point these instruments leave open: establishing identity, disclosure, authorization and evidence before sensitive workflow actions occur. It does not make any system legally compliant, and nothing here is legal advice.