Technical Summary: MedLog – A Global Log for Medical AI

Problem Statement

Modern medical AI deployment is occurring rapidly and in a fragmented manner, yet it lacks a standardized mechanism for recording how models are used in practice. While electronic health record (EHR) audit logs track clinical activity, they do not capture the specific inputs, outputs, or decision contexts of AI model invocations. Existing reporting frameworks (e.g., TRIPOD+AI, CONSORT-AI) focus on model development and controlled evaluation rather than continuous, event-level monitoring of deployed systems. Consequently, health systems cannot systematically measure real-world performance, detect adverse events, identify bias or dataset drift, or understand the interaction between model outputs and clinician behavior. This gap hinders the governance, safety, and iterative improvement of medical AI at scale.

Methodology

The authors introduce MedLog, a protocol for event-level logging of medical AI interactions. MedLog is designed to be transport-agnostic (implemented via HTTP REST in the pilots) and interoperable with existing healthcare standards (e.g., FHIR, OpenTelemetry, W3C PROV).

The MedLog Schema

Each MedLog record corresponds to a single model invocation and is assembled incrementally from event-level messages. A complete record contains nine core fields:

1. Header: Provenance, execution context, timestamps, and stable event identifiers (including run_id for linking multi-stage workflows).
2. Model Instance: Stable identifiers for the model and version, referencing model cards/data sheets, and noting any test-time edits or retrieval-augmented generation (RAG) databases.
3. User Identity: The invoking process or human user (identified by NPI or MRN), supporting attribution in both human-in-the-loop and automated agent workflows.
4. Target Identity: The entity the model acts upon (e.g., patient ID, claim ID).
5. Inputs: Structured features, prompts, or instructions. Large data (e.g., images) are represented by stable identifiers for retrospective retrieval.
6. Internal Artifacts: Optional technical traces including reasoning paths (Chain-of-Thought, Tree-of-Thought), context retrieved during RAG, agent interaction traces, uncertainty estimates, and interpretability maps.
7. Outputs: Human-facing predictions, generative text, or recommendations, including triage levels.
8. Outcomes: Linked clinical actions or patient outcomes (e.g., therapy administration, lab results), recorded when feasible via temporal proximity or provider attestation.
9. User Feedback: Structured ratings or free-text comments from clinicians or patients.

Implementation Strategies

To address storage and privacy constraints, MedLog employs:

• Risk-based sampling and lifecycle-aware retention: Full tracing during pilots or updates, with sampling or tiered retention during steady-state deployment.
• Write-behind caching: Allows local storage in low-resource or intermittent connectivity settings, synchronizing when available.
• Privacy safeguards: Storing references to clinical data rather than raw content where possible, and supporting de-identified aggregation for cross-site analysis.

Key Results from Four Clinical Deployments

The authors evaluated MedLog across four distinct deployments in the US, Switzerland, and Vietnam, generating over 3.1 million records.

1. ICU Deterioration Prediction (Bern, Switzerland)

• Context: Monitoring the BEACON AI model for circulatory and respiratory failure in an ICU.
• Findings:
  • Workflow Patterns: 16.5% of alarms occurred within the first hour of admission, a period of high physiological instability. This led to the implementation of a suppression policy for the first hour.
  • Failure Mode Detection: The model's risk predictions dropped significantly (95% relative decrease) as the time since the last lactate measurement increased, indicating the model used data recency as a proxy for clinical concern rather than true physiological improvement. This "stale data" bias was not detected in offline evaluation.
  • Clinician Interaction: Alerts triggered a 1.84-fold increase in subsequent lactate testing, demonstrating a measurable association between model output and clinician action.
  • Fairness: Stratified analysis revealed lower AUROC for female patients and older adults, with transient disparities detected via CUSUM monitoring.

2. Wearable Tetanus Monitoring (Ho Chi Minh City, Vietnam)

• Context: Predicting tetanus progression from PPG waveforms in a resource-constrained ICU.
• Findings:
  • Context-Dependent Performance: Alert confidence was significantly higher at night and on weekdays, suggesting daytime clinical interventions introduce physiological variability that reduces model certainty.
  • Training Data Bias: The model struggled to detect patient recovery, likely due to the underrepresentation of recovery-phase waveforms in the training data.
  • Alert Fatigue: In severe disease stages (Ablett Grade 4), clinicians were more likely to ignore alerts, potentially due to perceived redundancy or alert fatigue.
  • Physiological Signatures: Analysis of waveforms associated with "dismissed" but retrospectively validated alerts revealed specific morphological signatures (e.g., shallow dicrotic notch) preceding clinical recognition of deterioration.

3. Sepsis Quality Reporting (San Diego, California)

• Context: Automated abstraction of the SEP-1 sepsis quality measure using a Large Language Model (LLM).
• Findings:
  • Model Coherence: The system achieved 95.4% average pairwise agreement across repeated inferences. Consistency was highest for extracting categorical values (e.g., pregnancy status) and lower for interpreting free-text notes (e.g., infection events).
  • Workflow Integration: MedLog successfully tracked the multi-step abstraction process, linking multiple LLM calls to a single patient record and capturing human analyst feedback.

4. Patient Attendance Prediction (New York, USA)

• Context: Monitoring an Epic Systems model predicting patient no-shows across 791,319 patients.
• Findings:
  • Dataset Shift: The model was miscalibrated for evening appointments (under-predicting no-shows by 26.8 percentage points) and for appointments modified after scheduling.
  • Environmental Impact: Severe weather events (heat waves, storms) caused a 5.46 percentage point increase in no-show rates and a 13.0% degradation in model AUROC, demonstrating performance collapse under conditions not well-represented in training data.

Significance and Claims

The paper claims that MedLog provides the necessary infrastructure to transform medical AI deployment from an "unobserved process" into a source of evidence for safety and improvement. Key contributions include:

1. Visibility into Real-World Behavior: MedLog reveals failure modes (e.g., stale data bias, environmental degradation) and workflow-dependent performance variations that offline evaluation misses.
2. Continuous Surveillance: It enables real-time detection of dataset shifts, bias, and anomalous behavior, supporting regulatory compliance and proactive intervention.
3. Scalability and Inclusivity: The protocol is designed to function in high-resource settings with massive data volumes and in low-resource settings with intermittent connectivity, addressing the global disparity in medical AI research.
4. Foundation for Improvement: By linking inputs, outputs, and outcomes, MedLog creates a feedback loop for targeted model retraining, bias mitigation, and the creation of benchmarks grounded in real-world use rather than held-out training data.

The authors emphasize that MedLog does not require a new software stack but rather integrates with existing tools (FHIR, OpenTelemetry) to standardize how health systems record AI use, thereby enabling the "digital epidemiology" of medical AI.