A record that cannot be quietly edited
Each patient gets a chain of their own. When Scribe writes a summary, when the extraction engine structures the chart, or when the coding engine builds a claim, that output is committed to the chain and linked to the entry before it. Nothing is overwritten. Corrections append, and the earlier version stays visible.
- One hash-linked chain per patient, from the first entry forward
- Entries for AI-generated output and for physician attestation
- Every entry carries its author, the module that wrote it, and its timestamp
- Payloads are encrypted before they are stored, under keys issued to your practice alone
- Enabled per practice, so the keys that protect your chains are yours
Signed by the clinician, not the model
Nothing the AI produces is final until a clinician signs it. When you attest a note, Whadata captures what you changed against the AI draft, records the statement you signed under, and signs the result with a key issued to you and held in hardware. Your edits are part of the proof, not a silent overwrite of the draft.
- The difference between the AI draft and your final text is recorded
- Signed with a per-physician key held in a hardware security module
- Provider identity, including NPI, travels with the signature
- Signatures are verified server side before the entry is accepted
- If the signature cannot be recorded, the attestation fails rather than passing quietly
Proof you can hand to an auditor
Open the history on any patient and the chain is re-verified while you watch: every hash recomputed from the entry itself, every link walked back to the first entry, every signature re-checked. A clean chain says so. A chain where a single byte moved is flagged as tampered instead of being shown as clean.
- The chain is replayed from the newest entry back to the first
- Per-entry badges: verified, tamper detected, signature valid
- Scheduled checkpoints pin the chain in time, so a later edit cannot hide
- Verification reads the ledger and can never write to it
- A failed verification raises an alert to the security team, not just a message on screen
Questions worth an answer
What gets recorded in the ledger?
Every AI-assisted output and the physician signature that finalizes it. Each patient gets a chain of their own: when Scribe writes a summary, when the extraction engine structures the chart, or when the coding engine builds a claim, that output is committed and linked to the entry before it. Nothing is overwritten. Corrections append, and the earlier version stays visible.
Does AI ever finalize a chart on its own?
No. Nothing the AI produces is final until a clinician signs it. When you attest a note, Whadata captures what you changed against the AI draft, records the statement you signed under, and signs the result with a key issued to you and held in hardware. Your edits are part of the proof rather than a silent overwrite.
How do I know the record has not been altered?
Open the history on any patient and the chain is re-verified while you watch: every hash recomputed from the entry itself, every link walked back to the first entry, every signature re-checked. A clean chain says so, and a chain where a single byte moved is flagged as tampered instead of being shown as clean.
Which modules does this cover?
Every module that produces AI output, including Scribe, Insights, and Claims. The attestation layer is platform-level rather than a feature of one product.
What gets attested
Every module that puts an AI-assisted output in the chart commits it here first.
Trust, with the receipts
AI moves the work forward. The ledger proves who decided what, and when.