Tamper-Evident Clinical Decision-Support Lineage (ONC HTI-1)

Objective

ONC HTI-1 pushes predictive decision support toward source attributes and intervention transparency: you must be able to show what a suggestion was based on, which model produced it, and that a clinician — not the machine — decided. This recipe keeps that lineage in a tamper-evident immutable table.

Step 1: An immutable CDS lineage table

CREATE IMMUTABLE TABLE cds_lineage (
    encounter_id  TEXT,
    model_version TEXT,
    sources       TEXT,     -- cited chart / guideline records
    suggestion    TEXT,
    clinician     TEXT,
    action        TEXT      -- accepted / modified / declined
) WITH (ENCRYPTION = 'AES256GCM');

Omit WITH (ENCRYPTION = 'AES256GCM') if AIDB_IMMUTABLE_MASTER_KEY is not set; the table is still append-only and hash-chained.

Step 2: Record a suggestion and the clinician's decision

INSERT INTO cds_lineage VALUES (
    'ENC-20260728-8842',
    'cds_sepsis_v2',
    'G-114 Sepsis bundle; vitals 14:20; lactate 3.1',
    'Consider blood cultures + broad-spectrum antibiotics within 1h (suspected sepsis).',
    'Dr. A. Nguyen',
    'accepted'
);

Step 3: Prove the lineage was never altered

VERIFY TABLE cds_lineage;

is_valid | message
---------+----------------------------------------------------------------
true     | chain verified: 1 record(s) ... per-record lineage anchored
         | (tamper-evident); ...

Why it matters

Every suggestion carries its cited sources, its model version, and the clinician's action, in an append-only chain you can verify with one query — the reconstructable, source-attributed trail HTI-1 asks for, and the clinician always decides. It is the audit layer under grounded clinical retrieval and patient similarity.