Attestation Layer for Regulatory and Compliance

When I started building Whadata about two years ago, one question kept nagging me. I wanted a platform that used AI to take on as much of the painful, time-consuming work in healthcare as possible. But every time I pictured a clinician relying on that AI, I ran into the same wall: compliance.

There is real doubt about what AI does with patient information, and about how clinicians interact with what it produces. If an AI drafts a note and a physician signs it, who wrote what? Can you prove it a year later, in an audit or a dispute?

The answer came to me one evening as I made my last git commit of the day. For those outside software: Git is the tool engineers use to track every change to a codebase, who made it and when. Each change gets a unique fingerprint that builds on the one before it, so history can't be quietly rewritten. What if medical records worked the same way?

That is how the Whadata Attestation Layer was born. Every time AI contributes to a record, and every time a clinician signs off on it, the Attestation Layer captures five things:

1. The input context given to the AI model
2. The steps the AI pipeline took to reach its output
3. The raw AI output
4. The clinician's delta: exactly what they changed
5. The final signed record

Three safeguards make that record trustworthy.

Encrypted. Every entry is encrypted with its own key, and that key is locked under a key that belongs to the clinic and lives in a hardware security module.

Signed. Each clinician gets a personal digital signing key at onboarding. When they attest a note, their key signs it, so the record proves who approved what. A signature can't be copied onto another patient's record.

Tamper-evident. Like Git, every entry is fingerprinted with SHA-256 and chained to the one before it. Change a single character anywhere in a patient's history and the chain breaks. Every night we also record a fingerprint of every chain in a separate append-only log, so history can't be rewritten without it showing.

Inside the chart, a clinician can open a visit's attestation history and see the whole timeline: what the AI generated, who signed it, and a badge confirming nothing has been altered.

Nothing the AI drafts is final until a clinician signs it. AI in the clinic no longer has to be a hope-for-the-best situation. Practices can show auditors and payers exactly how AI was used in patient care, and prove the record hasn't changed since. The system is designed so that everything before attestation is treated as administrative information. Everything downstream of attestation becomes an official part of the medical record.

Have you started using AI in your practice? How are you handling the compliance questions it raises?