Inside the Loop // Issue 12
At 16:02:44 on the thirtieth of October, a patient weighed 87.543 kilograms. At 16:02:45 she weighed 49.895. One second. Thirty seven and a half kilograms.
I did not find that in a leaked file or a whistleblower’s spreadsheet. I found it by making an ordinary web request, carrying no password of any kind, to a developer sandbox published by Oracle Health. The record came back over the standardized interface that federal certification requires them to expose. [1] Nothing was broken. Nothing warned me. The system had accepted that number at entry, indexed it, and served it back when asked.
In Issue 08 I argued that the public data was never the hard part, and that the reasoning was. [2] This summer I stopped writing about that and connected it. Three vendors, live records, a running service. This issue is about what came back, because almost none of it is what I expected, and the part that surprised me most turns out to be the best argument I have ever had for the thing I have been arguing for.
Getting in costs three completely different things
Start with the part nobody publishes. I now have measured numbers for what it actually takes a third party to reach a patient record at three vendors, and they are not remotely alike.
Oracle Health’s open sandbox costs nothing. No account, no key, no agreement, no click-through. An unauthenticated GET returns patient data. I was reading records inside an hour. [3]
Epic costs a registration. You create a developer account, publish a public key, sign a short-lived assertion with the private half, and exchange it for a token. It is real cryptography and it is also completely self-service. No human is involved and I was authenticated the same day. [4]
MEDITECH costs a relationship. You submit a form, then a member of their Greenfield support team emails you a welcome packet, then you execute an end user license agreement, then you supply a Google identity, and only then do you receive an OAuth client ID and secret. [5] I registered this week. I am waiting on the email.
None of that is a criticism. Every one of those three postures is defensible and I can construct the argument for each. I am reporting it because in twenty years of hearing people say the electronic health record vendors will not let you in, I have never once seen anybody publish the actual price of admission, side by side, measured. It ranges from nothing to a signed contract, and the difference is not technical.
Three vendors, one record shape, one engine. The reader per vendor is the only part that differs. From the AI MedAgent EHR integration datasheet. [6]
What the documentation says, and what the server does
Here is where it got interesting, because this is a finding and not a complaint.
Epic granted my application five read scopes. One of them was system/Condition.read, which is permission to read the problem list. I asked for the problem list. Epic answered with HTTP 403 and a body of zero bytes.
Zero bytes. No error object, no OperationOutcome, no message. From a developer’s chair that is indistinguishable from a broken endpoint, and I spent a while assuming I had configured something wrong, because the permission was sitting right there in the token I had just been issued.
It took four separate probes to work out what was happening, and the answer arrived in an error string on a completely different endpoint. Combination of parameters is not valid for any authorized sub-resource. Epic authorizes below the scope. The OAuth scope is not the last gate; there is another one underneath it, at sub-resource level, and the token tells you nothing about it.
The same silent 403 came back for AllergyIntolerance, for DocumentReference, for Procedure and for Immunization. So the practical position, for anybody building a medication safety tool, is this. Epic proves the connection immediately and then declines the three things a medication screen most needs: the problem list, the allergy list, and the notes.
I could not find that documented anywhere. I found it by measurement. Anyone planning a build against Epic should know it in week one rather than in month nine, which is the only reason I am writing it down.
Oracle, meanwhile, handed over allergies and clinical documents to a request carrying no credentials whatsoever, 124 and 199 of them, and answers for the problem list too, which I confirmed by probe before deciding not to pull it in bulk. Same standard, same resources, opposite posture. That is worth sitting with for a moment.
And then I read what came back
I had been braced for the wrong problem. I expected the fight to be access. Access turned out to be the easy half.
The Oracle record I pulled contains 345 laboratory results, 124 recorded allergens, 563 procedures, and at least 1,000 vital sign observations and 500 active medication orders. I write at least because those two are where my loader stopped paging rather than how many exist, and I am not going to print a truncation point as a total in an issue about numbers that lie. That is a rich record, far richer than Epic’s sandbox, and I was pleased with it for about ten minutes.
Then the integrity screen ran, which in my design happens before any clinical reasoning at all, and it returned forty nine impossible values. A pulse of 1 beat per minute. A blood pressure of 1 over 1, on the same date. An oral temperature of 47.5 degrees Celsius. One temperature stamped the seventh of July, 2099.
The weights were the ones that told me what I was actually looking at. Twenty six of them inside fifty one minutes, ranging from 45.359 to 88.904 kilograms. And when I checked the intervals rather than the values, that hour contains not one impossible second but three: a fall of 37.6 kilograms, a rise of 27.7, and a fall of 11.8, each between two readings one second apart. Then I checked the whole record and found that sixty three percent of the recorded weights are an exact whole number of pounds, to within a thousandth, and the remainder are round kilograms. 45.359 is exactly 100 pounds. 49.895 is exactly 110. No scale on earth reads 64.000 kilograms.
Those are not measurements. They are numbers somebody typed into a test form, and the hour in question is several developers writing into a shared scratchpad at the same time. Which is entirely reasonable, because that is what a sandbox is for.
The potassium is the one I keep thinking about. Two hundred and twenty four observations, all coded LOINC 2823-3, which is Potassium, moles per volume, in serum or plasma. All of them carrying the unit g/dL, which is a mass per volume. The code and the unit contradict each other. Eight of the values are negative, running from minus 1.1 to minus 0.2. There is no such thing as a negative concentration in any unit anyone has invented. And seven more observations, carrying the identical LOINC code, are stored correctly in mmol/L. The same analyte, in the same record, held two incompatible ways.
Epic’s sandbox fails the exact opposite way, and it is almost funnier. Its busiest hour holds thirty two observations which are the same four values filed seven times in eight minutes: temperature 37, pulse 72, height 175 centimeters, weight 72.5 kilograms. Textbook normal, identical every time, height re-measured every forty five seconds. That is an integration test running on a loop. There is no variance in it at all, and a system that reasons about change has nothing whatever to reason about.
The same LOINC code, in the same record, producing two clusters that cannot both be potassium. Every figure in this issue is reproducible from the saved records; the full method and the counts are in the EHR integration datasheet. [6]
The part that matters
Take the thirty seven kilogram second and ask what would have caught it.
A reference range would not. 87.543 kilograms is a perfectly ordinary adult weight. So is 49.895. Both sit comfortably inside any plausibility band you would ever write, and a check that looks at one value at a time has no basis on which to object to either of them.
A threshold alarm would not, for the same reason, and this is the whole architecture of clinical decision support as it is practised today. A rule fires when a value crosses a line. Every value here is on the correct side of every line.
The temperature of 47.5 would trip a bound. Fine. But the thirty seven kilogram second, the negative potassium hiding behind a mismatched unit, and Epic’s seven identical readings all sail straight through, because none of them is about a value. They are about a relationship between values. A rate of change that no body can produce. A sign that no concentration can have. A variance of exactly zero where physiology guarantees some.
I have been making this argument for two years in the abstract and I have been making it badly. The proactive versus reactive distinction sounds, when you say it out loud, like a preference. Continuous is nicer than periodic, trajectory is nicer than threshold, and reasonable people can shrug.
It is not a preference. It is a difference in what is detectable at all. A system that examines one value at a time is structurally incapable of seeing an entire class of defect, and that class includes the ones that matter most, because a wrong number that looks normal is far more dangerous than a wrong number that looks wrong. The first one gets averaged into a trend line and handed to a clinician as a fact. The second one gets caught by 1970s technology.
I did not construct that argument. I went looking for something else entirely and a certified interface handed it to me.
What the machine says about itself
There is a second half to this, and it is the part I am most attached to.
When my engine screened that Oracle patient, it managed two of the eight standard medication safety screening classes. Not eight. Two. And it says so, in the card it returns, every single time it is called, whether it finds anything or not. [7]
One of those two produced 775 allergy matches, because with 124 recorded allergens and 500 active orders, matching text against text produces a combinatorial mess. The engine printed none of them. What it printed instead was the count, and a sentence saying that a screen returning this many alerts has stopped being a screen, and that the number is evidence about the method rather than about the patient.
Every clinical decision support product I have ever seen is silent when it finds nothing, and every clinician I have ever met has learned to read that silence as checked, fine. It is not. It is checked whatever I happen to check, which you have never been told. I spent most of a book on how clinicians learn to stop trusting the tools we hand them, and this is the mechanism. Not one dramatic failure. A thousand silences, every one of them read as reassurance. An engine that reports its own blind spots can be argued with. One that does not is a brochure.
This is also the honest answer to the obvious objection about putting a language model anywhere near a medication order. Yes, they can be confidently wrong. That is precisely why the reasoning pass in my system is handed the coverage statement before it reasons, and is told which of the eight classes did not run. A model reasoning without knowing its own blind spots writes fluent prose over a hole. That is not a hypothetical failure mode. It is the one I was most afraid of, so I built the architecture around preventing it.
Could I have found any of this in synthetic data
This is the question I get asked most, and now I can answer it with numbers instead of an opinion. The answer is half yes, and the half that is no is the important half.
I run the same engine against Synthea, the open synthetic patient generator from MITRE. [8] My reference synthetic patient carries 7,766 laboratory results, 273 problems, 1,113 medication orders and a genuinely coherent decade of chronic kidney disease. His eGFR is 5.54. He is on metformin, warfarin and lisinopril. For reasoning about a chart, that is a better test case than either real sandbox, by a distance.
It also contains zero impossible values and zero negative results across all 7,766 labs, because a generator does not fat-finger a decimal point. An empty finding there is a fact about the source, not a clean bill of health.
And here is where it stops. That synthetic record holds exactly one set of vital signs per day, for 268 days spread across ten years. One per day. There is no intra-day resolution in it at all, and there never will be, because the generator models a life and not an hour.
So synthetic data can validate reasoning over a chart. It cannot validate reasoning over a trajectory, because it contains no trajectory. And reasoning over the trajectory between the moments a human is scheduled to look is the actual claim, the thing the provisional patents describe, and the only part of this that is genuinely new. [9]
The sandboxes cannot supply it either, and now I know why in detail rather than in principle. The densest hour in the thousand Oracle observations I read holds 143 distinct timestamps, which looks exactly like a bedside stream until you notice the patient is losing thirty seven kilograms inside it. The densest hour in Epic’s holds eleven, and they are the same four numbers. Density without coherence, or repetition without variance. Neither is a patient.
I have spent a career on the boundary where this actually lives, and the answer is not surprising once it is written down. The chart tells you who the patient is. It does not tell you what is happening to them right now. That comes off the devices, through a gateway, and the standards in that space still do not carry what a reasoning layer needs. The infusion event profile defines three delivery milestones and has no rate change event, no secondary to primary switchover, and no transition to keep vein open. Those three are precisely the states you must have to interpret an infusion. [10]
So where does this go
The measurements settled something for me, and it was not what I set out to settle.
The electronic health record half is finished as a research question. It works, it is a published standard, it costs almost nothing, and its limits are now documented rather than assumed. I will connect MEDITECH when the email arrives, and then I will stop, because a fourth vendor will tell me almost nothing the third did not.
What is blocking the actual claim is that nobody has yet given me a real physiologic stream. Everything else is built.
The nearest door is one I should have walked through earlier. MIMIC-IV, from the Beth Israel Deaconess Medical Center and MIT, is real de-identified intensive care data, and the full database is available to any credentialed researcher who completes human subjects training and signs a data use agreement. There is also a hundred patient demonstration subset that is completely open, with no credentialing at all, and a FHIR representation of the whole thing that would load into the reader I have already written. [11] Real patients, real intensive care, and the corpus that reviewers in this field already trust. That is the next measurement, and the first thing to check is the one number that killed Synthea: how many observations are actually in the densest hour.
The second door is a drug knowledge base. Seven of my eight screening classes have no source behind them, which is why an allergy screen degenerates into 775 substring matches. The socket for a commercial knowledge base is built and deliberately empty, and calling it throws an error in public, on purpose, because I would rather show the hole than paper over it.
The third door is a device manufacturer, because a company running connected infusion pumps already holds channel level state in its own cloud. Publishing a read-only interface over it would create the thing the standard has not defined, with a real device behind it instead of a specification.
None of those three is a technology problem. All three are somebody deciding to open a door.
What I actually learned this summer
I went looking for whether I could reach the chart. I can, more easily than I expected at one vendor and less easily than I expected at another, and the price of admission has nothing to do with the standard and everything to do with each company’s posture.
What I found instead was that the interesting problem had moved. It is not getting the data. It is that the data arrives with defects that the entire installed base of clinical decision support is structurally unable to see, because that installed base examines values and these defects live in the relationships between them.
I have been arguing for continuous reasoning for two years on the grounds that it would be better. I now think that was the weak version of the argument. The strong version is that there is a whole category of error that periodic, value-by-value checking cannot detect at any frequency, and I did not have to construct a scenario to demonstrate it. I asked a certified interface for a patient record and it sent me one.
Everything on this page is reproducible. The engine is public, the sandboxes are public, and the datasheet carries every figure with the method that produced it. [6]
About Me
Daniel Pettus is the founder of Inside the Loop and the inventor of AI MedAgent, a proof of concept for continuous, AI driven medication oversight, free and public at aimedagent.net. He spent forty years in medical device and health IT leadership at Alaris, CareFusion, and BD, was a member of the founding team at iMetrikus in 1999, and contributed to IHE Patient Care Device interoperability standards. He holds two issued patents and has filed three provisional patents on the continuous reasoning method behind AI MedAgent.
His book, The Technology Was Never the Problem, is out now at pettusbook.com. Forty years of carrying good clinical technology into hospitals and watching most of it fail to reach a patient, and what all of those failures turned out to have in common. It was never the technology.
He is available to industry, acute care organizations, and investors in an advisory capacity, as a subject matter expert in applying AI to proactive clinical care and medical device integration.
References
[1] 45 CFR 170.315(g)(10), the standardized API certification criterion under the ONC Health IT Certification Program, required certified developers to expose a standards-based FHIR application programming interface, with a compliance deadline of 31 December 2022. 45 CFR 170.404 further requires that the documentation for those APIs be published via a publicly accessible hyperlink without preconditions. https://www.ecfr.gov/current/title-45/section-170.315 and https://www.law.cornell.edu/cfr/text/45/170.404
[2] Pettus D. The Data Was Public. The Reasoning Wasn’t. Inside the Loop, Issue 08, 2026. https://insidetheloopdp.substack.com
[3] Oracle Health Millennium R4 open sandbox, base https://fhir-open.cerner.com. Read unauthenticated on 22 August 2026. Figures in this issue are from patient 12724066 in that sandbox. https://fhir.cerner.com/
[4] Epic on FHIR R4 sandbox, SMART on FHIR Backend Services with an RS384 signed client assertion. Authenticated and read on 21 August 2026. https://fhir.epic.com/
[5] MEDITECH Greenfield Workspace. Access steps, the End-User License Agreement requirement and the Google identity requirement are quoted from MEDITECH’s own published pages, read 23 August 2026. https://ehr.meditech.com/ehr-solutions/greenfield-workspace and https://ehr.meditech.com/ehr-solutions/how-to-work-in-the-greenfield-workspace
[6] AI MedAgent EHR Integration Datasheet, v0.2, 23 August 2026. Carries every count in this issue together with the method that produced it, and the evidence page reruns the screens live. https://aimedagent.net/ehr-datasheet.html and https://aimedagent.net/ehr.html
[7] The eight screening classes are named against the published module list of Wolters Kluwer’s Medi-Span clinical screening APIs, so that the coverage figure is measured against a vendor’s own taxonomy rather than one invented for this project. The service is a CDS Hooks endpoint on the order-select hook, a published HL7 standard, live at https://aimedagent.net/cds-services. CDS Hooks specification: https://cds-hooks.hl7.org/
[8] Synthea, the open source synthetic patient generator from MITRE. Records are generated from population statistics and describe no real person. https://synthetichealth.github.io/synthea/
[9] Three United States provisional patent applications filed in 2026 covering large language model reasoning applied to medication management, including trajectory-based reasoning between clinical decision points.
[10] IHE Devices Technical Framework, Revision 10.0, Final Text, 4 November 2024. The Infusion Pump Event Communication profile defines Delivery Start, Delivery Stop and Delivery Complete, and no rate change, secondary-to-primary switchover or keep-vein-open transition event. The domain was renamed from Patient Care Device, which is why transaction identifiers retain the PCD prefix. https://www.ihe.net/resources/technical_frameworks/
[11] Johnson A, Bulgarelli L, Pollard T, Horng S, Celi LA, Mark R. MIMIC-IV, a freely accessible electronic health record dataset, PhysioNet. The full database requires credentialed access, completion of human subjects research training and a signed data use agreement. The MIMIC-IV Clinical Database Demo v2.2 is a 100 patient subset available openly under the Open Data Commons Open Database License v1.0 with no credentialing. MIMIC-IV on FHIR v2.1 provides the same data as FHIR profiles aligned to US Core R4. https://physionet.org/content/mimiciv/ , https://physionet.org/content/mimic-iv-demo/2.2/ and https://physionet.org/content/mimic-iv-fhir/2.1/