Governance Framework Alignment Audit¶

Audit date: 2026-05-20 Source framework: Curaway.AI — Unified Governance, Operating Framework, Architecture and Guardrail Model (Dr. Shrikanth Naidu + Praveen Bharadwaj, dated 2026-05-19) Platform commits audited: curaway_src@245e669, curaway-health-navigator@main Auditor: Engineering (read-only review of code + ADRs + tests against framework requirements)

Legend¶

A. Foundational positioning¶

B. Responsibility & Liability Boundary¶

C. Platform Architecture & Modules¶

C.1 Intake Module¶

C.2 Clinical Intelligence Layer (CIL)¶

C.3 AI Learning Governance¶

C.4 Provider Module¶

C.5 Concierge Module¶

C.6 Consent & Disclosure¶

C.7 Payment & Financial Liability¶

C.8 Rehab / Post-Op / Transition Care¶

C.9 Communication & Marketing Governance¶

D. Human-in-the-Loop Operating Model¶

E. AI Agent Behaviour Framework¶

F. Dynamic Estimate & Repricing¶

G. Provider Accountability¶

H. Telemedicine / Remote Consultation¶

I. Patient Autonomy¶

J. Emergency & Crisis Boundary¶

K. Data Privacy & Cybersecurity¶

L. Business Continuity & DR¶

M. Third-Party Vendor Governance¶

N. Data Lifecycle Governance¶

O. Audit Trail & Medico-Legal Defence¶

P. Adverse Event & Sentinel Governance¶

This is one of the largest gaps in platform vs framework.

Q. Decision Rights Matrix (Curaway / AI / Doctor / Patient)¶

The doc specifies who decides what across 13 decision areas. Spot-checked alignment:

R. Guardrail Library¶

S. Approved Language & Standard Disclaimers¶

T. Organizational / Process artifacts¶

Overall scorecard¶

Top 10 priority gaps — ranked by medico-legal exposure¶

1. ❌ Adverse Event & Sentinel Governance (Section P) — no module exists; mortality/ICU/data-breach events have no classification, RCA workflow, or provider-review trigger. Largest single defensibility gap.
2. ❌ HITL escalation workflows (D.3) — risk rules detect, escalation routing is Phase 3 stub. Without this, "Human-in-the-Loop" is documentation, not enforcement.
3. ❌ Rehab module — surgeon clearance, missed-session triggers, LAMA documentation, wearable disclaimers (C.8) — entirely unbuilt; ADR-0018 transport work touches edges.
4. ❌ Provider governance — license expiry monitoring, malpractice insurance field, suspension workflow (C.4) — manual today; framework expects automation.
5. ❌ Emergency keyword detection + routing in patient chat (J.2) — no classifier; emergency indicators today rely on coordinator manual flag.
6. ❌ Per-provider / surgical-specific consent capture (C.6) — single generic consent; framework requires hospital-specific high-risk surgical consent.
7. ⚠️ AI Output Label + Estimate Disclaimer + Rehab Disclaimer on FE (S) — approved language exists in doc; not surfaced to patient.
8. ❌ Retention schedules per data type / legal hold (N.1, N.3) — implicit "keep forever" model; framework requires jurisdiction-specific retention with secure-destruction verification.
9. ❌ Bulk patient data export (GDPR Article 20) (I.7, N.2) — erasure works; export does not.
10. ❌ Documented BCDR plan with RPO/RTO + recovery testing (L) — Railway-managed backups exist; no documented restore drill or SLA.

Top 10 priority gaps — ranked by ease of fix (quick wins)¶

1. ⚠→✅ Surface AI Output Label on FE cards ("AI-assisted decision support output. Not a final diagnosis.") — small FE change, large defensibility win.
2. ⚠→✅ First-turn platform role disclosure in conversation v6 (already partially in voice rules; needs explicit prompt rule).
3. ⚠→✅ Estimate disclaimer text in commerce module invoice template.
4. ❌→⚠ License-expiry automated alert — cron job querying doctors.license_expiry, Telegram alert at T-30 days.
5. ❌→⚠ Emergency-keyword regex pre-filter in conversation pipeline → route to coordinator alert (defense-in-depth before formal classifier).
6. ❌→⚠ Adverse-event taxonomy enum in code (Mortality / ICU_escalation / Surgical_complication / Implant_failure / Data_breach) + Telegram alert category.
7. ❌→⚠ Document operating doctrine (Section A.3) in docs/architecture/operating-doctrine.md.
8. ❌→📋 Charter the 6 governance committees — even informal meeting cadence + minutes folder beats zero.
9. ❌→⚠ Vendor inventory table in docs/reference/vendors.md with DPA-status column.
10. ❌→⚠ LAMA flag on Case model + audit event.

Net assessment¶

The platform is strongly aligned on the tech-stack layer (consent, audit, RBAC, encryption, voice rules, medical-advice enforcement, GDPR erasure, telemedicine recording-disabled, FHIR, feature flags, LLM observability, matching transparency). These are the layers most directly enforceable in code, and Curaway has invested heavily here.

The platform is weakly aligned on three governance dimensions:

1. Clinical operations layer — adverse events, HITL escalation, rehab, surgeon clearance, emergency routing. These are clinical workflows that need both code and a Medical Board to operate.
2. Provider operations layer — license monitoring, malpractice tracking, scorecards, suspension workflow. Mostly manual today.
3. Organizational governance layer — 6 committees not chartered, 28 policy documents not drafted. These don't need code, but they're the paper trail that makes the framework defensible in a regulatory or medico-legal review.

The biggest single risk is Adverse Event Governance — if a sentinel event happens today, there is no module to classify it, no RCA workflow to document it, and no automated provider-review trigger. Combined with the HITL escalation gap, this is the clearest concentration of medico-legal exposure relative to framework requirements.

Recommended sequencing¶

• Week 1-2 (small, high leverage): Quick-wins 1-3 (AI label, role disclosure, estimate disclaimer) + adverse-event taxonomy enum (#6) + LAMA flag (#10).
• Sprint (1 month): Build HITL escalation backbone (D.3) + per-provider/surgical consent (C.6) + license expiry job (G.4) + emergency keyword pre-filter (J.2).
• Quarter: Adverse Event module end-to-end (P) + rehab module foundation (C.8) + BCDR plan + 6 committees chartered + first 10 policy docs drafted.

Audit source code references valid as of commit 245e669. Re-audit recommended after each material module ship (escalation backbone, adverse-event module, rehab module).