Regulatory Alignment
How NHID-Clinical maps to current healthcare AI governance requirements.
How NHID-Clinical Maps to Current Requirements
This is not legal advice. NHID-Clinical is voluntary. The table below shows how the controls relate to key regulations and guidance as of June 2026. Fairness and clinical-safety governance are intentionally out of scope — see the scope boundary note.
| Regulatory Driver | Specific Requirement | NHID-Clinical Control |
|---|---|---|
| CMS-0057-F Prior Auth Final Rule | FHIR API, 72-hour turnaround, 5-year retention | HL7 FHIR R4 AuditEvent (validated) + session trace (ATR-01) — mapping spec |
| MACPAC May 2026 | AI transparency in prior auth, human review pathway | IDG-01 + EIT-01 (escalation) + ATR-01 |
| DOJ FCA 2026 Enforcement Focus | Explainability + audit trail for AI-assisted billing | Structured trace + CTS conformance (ATR-01) |
| State AI Laws (CA, TX, MD, etc.) | Inspectable, auditable AI decisions | IDG-01 + DBC-01 + L1/L2/L3 tiers |
| NIST AI RMF / CAISI | Cross-org agent identity + authorization | NHID-Auth v2 + NIST-2025-0035-0026 comment |
FHIR R4 AuditEvent Emission
Every NHID-Clinical conformance test suite (CTS) execution produces a HL7 FHIR R4 Bundle of AuditEvent resources — one per conformance milestone. These Bundles are validated against the FHIR R4 base specification (version 4.0.1) in CI before every merge.
- nhid-session-start — call session initialised (DCM Application Activity)
- nhid-identity-disclosure — IDG-01 gate evaluated; outcome reflects pass/fail (DCM Security Alert)
- nhid-auth-verification — provider NPI authorization recorded, when present (DCM User Authentication)
- nhid-phi-gate — PDX-01 pre-data-exchange gate decision (DCM Security Alert)
- nhid-phi-exchange — PHI exchange begins, when gate cleared (DCM Patient Record)
- nhid-escalation — EIT-01 escalation event, when triggered (DCM Application Activity)
- nhid-call-end — session terminated; outcome reflects aggregate policy decision (DCM Application Activity)
AuditEvent.type.
Three agent slices capture the AI voice agent (requestor), payer system (destination),
and provider organisation (on-behalf-of, when NPI is present).
STIR/SHAKEN
STIR/SHAKEN attests that a number is legitimate — not that the caller is authorized to access protected health information.
Trust Stack
| Layer | Standard | What it proves |
|---|---|---|
| Carrier | STIR/SHAKEN | Number is legitimate |
| Disclosure | NHID-Clinical v1.3 | AI status declared before PHI exchange |
| Authorization | NHID-Auth v2 | Cryptographic delegation from provider |
CMS-0057-F
This page maps NHID-Clinical v1.3 controls to the CMS Prior Authorization Final Rule (CMS-0057-F) requirements for AI transparency in prior authorization workflows.
NHID-Clinical Alignment
| CMS-0057-F Requirement | NHID-Clinical Control | Artifact |
|---|---|---|
| FHIR API for PA transactions | ATR-01 | FHIR AuditEvent R4 mapping |
| AI transparency in decisions | IDG-01 | CTS conformance test suite |
| Human review availability | EIT-01 | Safe escalation phrases |
NIST AI agent standards
This is an open proposal submitted to NIST docket NIST-2025-0035-0026.
NIST AI RMF Alignment
| NIST AI RMF Function | NHID-Clinical Control |
|---|---|
| GOVERN 1.1 | IDG-01 — AI system status disclosed |
| MANAGE 2.2 | EIT-01 — Human escalation path |
| MEASURE 2.5 | ATR-01 — Auditable trail |
Vendor evidence pack
Minimum evidence a voice AI vendor should produce to demonstrate NHID-Clinical conformance.
- CTS conformance test results (pass/fail for all 5 tests)
- Sample disclosure transcript
- Escalation phrase list
- FHIR AuditEvent sample
- NPI binding documentation