An operational AI governance framework for AI agents calling payers: disclosure before data, evidence per call.

_{Stage: Research — an independent research project and open reference implementation; a Tier 0 shadow pilot is available. Not a standard, a certification or a product. Mapped, not certified. NIST-2025-0035-0026 is a public comment, not an endorsement.}

AI agents now phone insurers and ask for patients' data. "I'm calling from Dr. Patel's office, can I get the member's eligibility?" The representative has seconds to decide, and nothing tells them whether the caller is a person, an AI, or who it really works for. NHID-Clinical checks every turn of that call: did the agent say it is an AI before asking for protected data, did it pose as a person, and did it hand over to a human when asked.

git clone https://github.com/NHID-Clinical/NHID-Clinical.git && cd NHID-Clinical
pip install -e .
nhid pilot --demo --out demo-evidence/

Three synthetic calls, measured offline on your machine:

Calls evaluated:               3
Median Impersonation Latency:  0 turns / 2.0s
First-turn disclosure rate:    66.7%
Calls w/ pre-disclosure PHI:   33.3%
Escalation honor rate:         0.0%
Top violations:                IDG-01 (1), PDX-01 (1), EIT-01 (1)

One agent gave the member's ID and date of birth and asked for the claim status before admitting it was automated, and one refused a human handoff. demo-evidence/ holds the report, the metrics and one result per call. Point it at your own call turns (capture format) with nhid pilot calls.jsonl --share-safe: the kit makes no network calls (a build check enforces it), and the pack is scanned before you choose to share it (pilot kit).

An AI voice agent phones a payer, says it is calling for a provider, and asks for a patient's eligibility, claim status or other protected health information. The payer's representative receives the call and has to decide what to disclose. NHID-Clinical is the open specification, the deterministic reference implementation and the evidence format for that moment: five testable controls, evaluated on every turn, with a machine-readable record of what the agent said and when. A payer can run it on the receiving side; a voice-AI vendor can run it in its own call path to produce evidence for its customers. Same controls, same artifacts. It governs conduct at the interaction boundary, not the AI model, and disclosing, logging or passing every control never by itself authorizes a disclosure.

_{Reference, a conceptual model. The same figure is on the specification page.}

_{The Trust Gateway: corpus scenarios replayed through the engine and recorded verbatim. Shown here, Scenario B (nhid_ec_combo_008): a caller-agent with a human persona asks for protected data before disclosing. A still from the page; scripts/build_gateway_fixture.py regenerates it and CI fails if the page stops matching the engine.}

Four act on the call. One records it.

DLG-01, Delegated Authority, is optional and opt-in, not a sixth control: a signed, scoped, unexpired, unrevoked delegation from the provider, checked against a trust anchor the deployer configures (no registry; the NPI is not checked against NPPES; it constrains what the agent may ask for on the call, and is not database or API authorization). Normative text: specification.

Every control evaluates the same turn independently through evaluate_all, and the most restrictive outcome wins: DENY_DATA > ESCALATE_HUMAN > DISCLOSE_IDENTITY > LOG_ONLY > CONTINUE_AI. There is no composite score, tier or badge (enforcement profile). Impersonation latency is the number of turns between connect and disclosure, target zero; it measures timing and does not detect or prevent impersonation.

Python 3.10 or later.

git clone https://github.com/NHID-Clinical/NHID-Clinical.git && cd NHID-Clinical
pip install -r requirements.txt
python -m uvicorn app:app --port 8000 &    # the integration tests need it
python -m pytest tests/ -q

Expected: 2457 passing, 0 skipped. Without the API the server-dependent integration tests skip themselves; CI starts it and requires zero skips. One request to the hosted adapter route, synthetic payload, no key:

curl -s -X POST https://gfvq4swdtf.execute-api.us-east-1.amazonaws.com/prod/v1/adapters/vapi/check \
  -H "Content-Type: application/json" -d @tests/demo_scenarios/vapi_noncompliant.json

• Payers and health plans (the receiving side): run an observe-only shadow evaluation on call traces you already hold. Nothing is inserted into the call.
• Voice-AI vendors (the calling side): produce the vendor evidence pack: conformance results, disclosure transcript, escalation phrases, a FHIR R4 AuditEvent sample.
• Developers: check one turn against the hosted API or run the engine locally, from the developers page.
• Caller-agent builders: fork Ida, the reference caller-agent. Before she speaks a patient identifier, she presents a per-call, scoped delegation and a proof of possession to the payer gate, and DLG-01 checks them. She uses demonstration keys only.

python -m pytest tests/test_identity.py -v
python examples/issue_and_verify.py

We are looking for the first shadow-evaluation partners: observe-only, no vendor changes, on call traces you already hold. If you are on the payer side, the payer brief says what a representative can and cannot verify on an automated call today. The analysis is an offline batch on de-identified transcripts, run in your environment; there is no hosted scorer and no request for call audio.

Code contributions: CONTRIBUTING · Discussions · contact@nhid-clinical.org. Repository settings only the owner can change are listed in docs/maintainer-checklist-github.md.

Brianna Baynard, AI Governance & Security Researcher · AIGP · ISC² CC · WGU Cybersecurity. Background in healthcare payer operations, identity-verification workflows and regulated-data environments; NHID-Clinical grew out of the impersonation-latency problem seen firsthand on live eligibility, claims and prior-authorization lines. Maintained as an open reference implementation for technical review; criticism is welcome.

LinkedIn · X @baynardmalone · X @NHIDClinical · NIST public comment

Code is Apache-2.0 rather than Creative Commons because CC licenses carry no patent grant and no warranty disclaimer written for software. See NOTICE.