AI
Turn EDFlow AI features on per site: the six layers that must all allow a feature, the governance gates G-AI-1 to G-AI-6, budgets, conversation retention, the kill switch, and where flagged conversations go.
AI features are off by default in production. Each one runs only when every layer below allows it; if any layer is unknown or off, the feature stays off and the normal screen works as usual.
The layers
| Layer | Who controls it | Effect |
|---|---|---|
| Hard switch on the deployment | Platform engineers | Every AI function refuses; entry points hidden |
| Platform kill switch | Platform administrators, audited | Entry points disappear within seconds; in-flight answers stop |
| Platform flags | Platform administrators, per environment and site | Per feature |
| Site settings (this page) | Managers with settings.manage, audited | Per feature, languages, budget, retention |
| Governance gates | See below | Patient- and family-facing features in production |
| Budget | Automatic | Features pause when the monthly budget is used up |
Site settings
| Paramètre | Par défaut | Valeurs permises | Effet |
|---|---|---|---|
ai.enabled | false | boolean | AI features at this site (F-35.3 layer 4). (Réduit la confidentialité) |
ai.features.patientAssistant | false | boolean | AI feature: patientAssistant. (Réduit la confidentialité) |
ai.features.familyHelper | false | boolean | AI feature: familyHelper. (Réduit la confidentialité) |
ai.features.familyCatchUp | false | boolean | AI feature: familyCatchUp. (Réduit la confidentialité) |
ai.features.testExplainers | false | boolean | AI feature: testExplainers. (Réduit la confidentialité) |
ai.features.machineTranslation | false | boolean | AI feature: machineTranslation. (Réduit la confidentialité) |
ai.features.voiceNative | false | boolean | AI feature: voiceNative. (Réduit la confidentialité) |
ai.features.voiceWeb | false | boolean | AI feature: voiceWeb. (Réduit la confidentialité) |
ai.features.requestDigest | false | boolean | AI feature: requestDigest. (Réduit la confidentialité) |
ai.features.quickReplies | false | boolean | AI feature: quickReplies. (Réduit la confidentialité) |
ai.features.handover | false | boolean | AI feature: handover. (Réduit la confidentialité) |
ai.features.patientMessageDrafts | false | boolean | AI feature: patientMessageDrafts. (Réduit la confidentialité) |
ai.features.askData | false | boolean | AI feature: askData. (Réduit la confidentialité) |
ai.features.insights | false | boolean | AI feature: insights. (Réduit la confidentialité) |
ai.features.weeklyReport | false | boolean | AI feature: weeklyReport. (Réduit la confidentialité) |
ai.features.anomalies | false | boolean | AI feature: anomalies. (Réduit la confidentialité) |
ai.features.mappingAssistant | false | boolean | AI feature: mappingAssistant. (Réduit la confidentialité) |
ai.features.catalogChecks | false | boolean | AI feature: catalogChecks. (Réduit la confidentialité) |
ai.features.contentAuthoring | false | boolean | AI feature: contentAuthoring. (Réduit la confidentialité) |
ai.features.feedbackThemes | false | boolean | AI feature: feedbackThemes. (Réduit la confidentialité) |
ai.features.commandAssistant | false | boolean | AI feature: commandAssistant. (Réduit la confidentialité) |
ai.features.auditExplainer | false | boolean | AI feature: auditExplainer. (Réduit la confidentialité) |
ai.patientLanguages | [] | array | Machine-translated patient languages (each enabled in aiLanguages). (Réduit la confidentialité) |
ai.monthlyBudgetUsd | 500 | 0–100000 usd | Site AI budget per month (AI_DEFAULT_SITE_BUDGET_USD). |
ai.conversationRetentionDays | 7 | 0–30 days | Days AI conversations are kept after the session ends. (Réduit la confidentialité) |
ai.safetyReviewSampleRate | 0 | 0–1 ratio | Random sampling of unflagged conversations; > 0 only with randomSampleApproval. (Réduit la confidentialité) |
ai.selfHarmAutoAlert | true | boolean | Self-harm sends a structured urgent alert; off only with selfHarmAlertWaiver (D-AI-03). (Réduit la confidentialité) |
ai.distressAutoAlertSeconds | 60 | 30–120 seconds | Red-flag distress alert delay (D-AI-03). |
ai.showAssistantByDefault | true | boolean | Show the assistant entry point by default. |
ai.crossSitePeerRanges | false | boolean | Cross-site peer ranges (AI-15, Q-AI-06). (Réduit la confidentialité) |
ai.governance.privacyApproval | — | object | Governance gate record: privacyApproval. (Réduit la confidentialité) |
ai.governance.regulatoryMemo | — | object | Governance gate record: regulatoryMemo. (Réduit la confidentialité) |
ai.governance.evalSignoff | — | object | Governance gate record: evalSignoff. (Réduit la confidentialité) |
ai.governance.piaTra | — | object | Governance gate record: piaTra. (Réduit la confidentialité) |
ai.governance.hazardLog | — | object | Governance gate record: hazardLog. (Réduit la confidentialité) |
ai.governance.staffBriefing | — | object | Governance gate record: staffBriefing. (Réduit la confidentialité) |
ai.governance.mappingAssistantPrivacyApproval | — | object | Governance gate record: mappingAssistantPrivacyApproval. (Réduit la confidentialité) |
ai.governance.randomSampleApproval | — | object | Governance gate record: randomSampleApproval. (Réduit la confidentialité) |
ai.governance.selfHarmAlertWaiver | — | object | Governance gate record: selfHarmAlertWaiver. (Réduit la confidentialité) |
ai.governance.safetyReviewers | [] | array | The designated AI safety review group (§2.4 footnote 8). (Réduit la confidentialité) |
- Features are switched one by one: patient assistant, family helper, test explainers, machine translation, voice, request digest, handover summary, message drafts, Ask your data, insights, weekly report, anomaly alerts, mapping assistant, catalogue checks, content authoring, and more.
- Patient languages for the assistant: each must be reviewed first.
- Monthly budget in US dollars.
- Conversation retention: 0 to 30 days after the session ends (default 7).
- Self-harm auto-alert is on by default and can be turned off only with the ED clinical lead's recorded waiver.
Governance gates
A patient- or family-facing feature can't be turned on in production until every gate is recorded:
| Gate | Evidence | Recorded by |
|---|---|---|
| G-AI-1 | Privacy office approval of the data flows, including processing outside Canada with zero data retention | Privacy officer |
| G-AI-2 | Regulatory memo confirming the non-device intended use | Site manager records receipt of the signed memo |
| G-AI-3 | Clinical lead sign-off of the current evaluation report | A clinical approver |
| G-AI-4 | PIA addendum and TRA update | Privacy officer |
| G-AI-5 | Hazard log reviewed for this release | Clinical lead |
| G-AI-6 | Staff briefing done | Site manager |
Staff-only and aggregate features (digest, handover, drafts for staff, Ask your data, insights, reports, mapping, catalogue checks) need G-AI-1 and G-AI-4 only. The mapping assistant with real hospital feed samples also needs G-AI-1.
Flagged conversations
Conversations where the safety layer flagged distress, self-harm or misuse go to a small safety review group outside the care team. Privacy officers see how that works in AI review. Random sampling of unflagged conversations is off unless the privacy office approves it.
The kill switch
If something looks wrong, ask the platform team to use the kill switch: every AI entry point disappears within seconds across all sites. Your site-level switches stay as they were.
Related
- AI governance for reviewers
- AI assistance and Ask the assistant
Dernière mise à jour le
Cette page vous a-t-elle été utile?
Reports and exports
De-identified exports from EDFlow (visit facts, test turnaround, request facts, feedback, code log), how they are de-identified, the export log, single-use downloads and scheduled reports.
Pilot playbook
Run a EDFlow pilot in your emergency department: baseline measurement, staff briefing and training mode, posters and QR signage, the first week, the weekly review and the success metrics.