MedBeads: An AI-Native Clinical Context Graph Built from Immutable Beads and Reconstructable Clinical Links

AI summary

Overview

• Research area: Clinical data infrastructure for generative AI — specifically, how longitudinal patient records should be structured so that a large language model receives complete, current, authorized, and auditable context rather than a similarity-sampled set of text fragments.
• Technical level: Advanced. The paper is a systems and data-model design paper, drawing on content-addressable storage, Merkle directed acyclic graphs, FHIR interoperability, cryptographic signatures, and security clearance policy.
• Scope in one sentence: The paper proposes MedBeads, an AI-facing clinical record substrate that stores immutable content-addressed clinical objects ("Beads") in patient-scoped append-only files and derives reconstructable "clinical links" from signed, versioned knowledge rules, and it reports a reference implementation built from 1,135 synthetic Synthea FHIR patient bundles.

What This Paper Is About

Generative AI models carry broad medical knowledge, but their answer to a patient-specific question is limited by whatever context is handed to them at inference time; electronic health records and FHIR are built for documentation and interoperability, not for defining that context. Conventional similarity-based retrieval can find related text but cannot guarantee that clinically connected records were collected, nor make missing context visible to the model. MedBeads addresses this "clinical context mismatch" by assembling a declared, policy-bounded subgraph of a patient's record before generation, while explicitly separating immutable clinical facts from the interpretation layer that may change as medical knowledge is revised.

Key Contributions

1. A two-layer clinical data model. The paper defines immutable, content-addressed Beads (identified by the SHA-256 digest of their canonical JSON content, using the JSON Canonicalization Scheme) on one layer, and a reconstructable interpretation layer on the other, expressed as I_g = P(F, K_g, C_g, V_g) where F is the immutable fact set, K_g the closed knowledge set for generation g, C_g the projection configuration, and V_g the projector contract or code version.
2. Versioned clinical links as auditable, reconfigurable edges. Clinical links are typed, patient-scoped relationships derived by signed and versioned link_rule Beads, kept distinct from immutable structural parent edges so that a guideline revision changes the interpretation without rewriting the recorded facts.
3. A patient-local incremental projection model with prioritized rolling updates. New data trigger projection only for the affected patient, and knowledge revisions are rolled out by patient priority (new writes bypass the queue; then recent clinical activity using a configurable three-year threshold; then long-inactive records; then patients marked deceased for scheduling purposes only).
4. Separation of content identity, digital signature, trust, and security clearance, enabling a path from single-hospital to multi-institution operation, with FHIR positioned as the interoperability boundary and MedBeads as the AI-facing context layer.

The paper lists six contributions in total; the four above group them at the level of data model, edge semantics, update operation, and trust architecture. The remaining two concern FHIR source-preserving conversion semantics and the explicit separation of structural validation from the still-unproven clinical effect on LLM hallucination and reasoning.

Main Findings

• Reference implementation exists and is open source. A single Go executable contains the Pod store, SQLite projection index, projectors, retrieval engine, command-line tools, REST interface, and Model Context Protocol (MCP) interface.
• Synthetic corpus scale. File-based conversion of 1,135 synthetic Synthea FHIR patient bundles produced a corpus at approximately one-million-Bead scale. The paper states the current large synthetic corpus is approximately one thousand patients and one million Beads.
• What the experiments demonstrated. The conversion demonstrated reconstruction of the interpretation layer and deterministic clinical-link derivation.
• What the experiments did not demonstrate. The paper states explicitly that these experiments "do not establish a reduction in clinical hallucination or improved patient outcomes," and that structural validation is separate from clinical effect.
• Scaling figures are targets, not measurements. Patient-local append and projection, virtual generation queues, and short per-patient transactions are intended to support ordinary operation at 100,000 patients and a design horizon of approximately 1,000,000. The paper calls these architectural targets, not measured capacity claims.
• Storage design resolves a naming ambiguity. SHA-256 is the Bead ID, not necessarily the Bead filename: Beads are physically appended as framed records to a patient-scoped Pod file, so a Bead ID identifies a logical object rather than a separate file.
• Two causes of incompleteness are reported, not hidden. Retrieval responses distinguish policy truncation (graph depth or link limits stopped expansion) from token truncation (selected content could not fit the rendering budget), and enumerate affected references.
• Determinism requirements under caps. Because per-Bead caps can make a new event change which older links qualify, re-projecting identical facts under the same rule and projector contract should produce identical link IDs, not merely the same count.
• Safe escalation is enforced at storage time. Informational relationships may rest on co-occurrence, but warning-level or higher links must identify curated or guideline knowledge, name a concrete rule version, and cite supporting evidence Beads; unsupported escalation is rejected.
• Cross-patient contamination is not yet a demonstrated property. The paper discloses that the reference implementation currently resolves a Bead whose structural parents span multiple roots to the shared Pod, and that the SQLite clinical_links table does not yet have a cross-table trigger proving both endpoints belong to the row's declared patient root. It proposes a four-boundary hardening scheme (ingest, projection and storage, retrieval and audit, authorized federation).
• IPFS is not used. MedBeads shares content addressing and hash-linked Merkle DAG objects with IPFS, but neither requires nor currently implements IPFS networking, distributed hash tables, peer discovery, pinning, or CID-based block exchange.
• Cross-institution identity resolution is not implemented. The paper describes a proposed signed patient_identity_link Bead path but states that cross-institution identity resolution is not implemented in the present reference system.

Methodology in Plain English

The approach treats the problem as a data-structure problem rather than a model problem. Each clinical fact, narrative note, correction, signature attestation, or knowledge rule becomes a Bead: an object whose ID is the hash of its canonical content, so changing any hashed field changes its identity. Instead of writing millions of tiny files, the implementation packs Beads as framed records into one append-only Pod file per patient, with the Bead still individually addressable by its hash through an index.

Structural parent edges organize Beads into a patient-rooted Merkle DAG (technically a DAG rather than a tree, because a Bead may have multiple parents). Corrections happen by appending new objects that reference old ones: an "amends" edge revises a record, and a "retracts" edge withdraws it. Current-state projection applies a fixed precedence — a valid retraction dominates, an amendment becomes current only under the required clinical attestation, and competing amendments are resolved by recorded time with a deterministic identifier tie-break.

On top of that immutable spine, a separate interpretation layer is computed and can be thrown away and recomputed. Normalized tags, clinical links, current-status views, summaries, full-text indexes, and optional vector indexes all live here, tagged with a projection_run_id. Facts are recoverable from the Pods; interpretations are reproducible from facts plus a declared knowledge and software generation. When a new Bead arrives, only that patient is re-projected, and the patient's entire clinical-link set is replaced atomically rather than merely adding links incident to the new Bead.

Knowledge is versioned the same way: a link_rule Bead holds the matching namespaces and types, minimum shared evidence, frequency thresholds, per-Bead caps, temporal constraints, score weights, author, revision, applicability interval, and optional external evidence. A knowledge_release Bead declares a closed set of link_rule IDs and becomes eligible only after its required signatures validate; startup revalidates the active manifest so a revoked, expired, or tampered release fails closed. Signatures use Ed25519 on canonicalized statement Beads, with three distinct purposes kept apart: clinical_origin, fhir_import, and knowledge_release.

Retrieval starts from an anchor, resolves record status, walks structural edges and authorized clinical links, applies clearance to every candidate and to both endpoints of every edge, and renders the result under a token budget. Clinical-link traversal is patient-scoped and bounded; the implementation defaults to one clinical-link hop and a small maximum expansion, with hard upper limits.

The validation approach was to convert 1,135 synthetic Synthea FHIR patient bundles into Pods and SQLite projections, then check that the interpretation layer could be reconstructed and that clinical-link derivation was deterministic.

Why This Matters

For research, the paper reframes grounding as a data-structure problem rather than a retrieval-quality problem: the claim is that a model's input can have an explicit provenance, a declared completeness boundary, and enumerated omissions. It also proposes a testable concept of "bounded context completeness" — given an anchor, an active knowledge release, an authorization policy, and traversal limits, retrieval returns either the complete set of reachable, current, authorized Beads or explicitly reports why it did not.

Real-world applications the paper points toward:

• Point-of-care generative AI over longitudinal records, where a medication and the renal observation connected to it are delivered together with the relation type and rule version, rather than relying on text similarity.
• Institutional knowledge-update management, where a revised guideline is rolled out as a prioritized rolling projection across patients without rewriting any recorded clinical facts.
• Auditable retrospective reproduction, where an institution can reproduce exactly which relationships an AI was permitted to traverse at a past time, because the rules, approvals, and manifest remain addressable after supersession.
• Multi-institution health information exchange, where a byte-identical Bead may retain one SHA-256 ID after exchange while accumulating independent signature attestations, and where a federated view is constructed only after trust, consent, purpose-of-use, and clearance checks.

For industry, the paper's relevance sits in the architecture of the boundary between EHR systems and AI applications: FHIR remains the exchange contract, and MedBeads is positioned as the AI-facing context layer beneath retrieval techniques such as vector RAG and GraphRAG. The maintenance argument may matter commercially — a new record triggers exact re-projection for one patient rather than re-embedding or re-clustering an entire corpus. The paper also stresses that the content hash proves only that canonical content is unchanged; it does not prove truth, authorship, or clinical validity, and identity, authenticity, authorization, and clinical validity are four separate things.

Future Directions

• Controlled comparative studies. The paper states that the hypothesis — that an explicit context contract makes generative output more reproducible and reduces errors from missing or stale record context — remains to be tested against conventional FHIR serialization, vector RAG, and graph-based retrieval in controlled LLM studies.
• Closing the contamination gap. Complete cross-patient contamination resistance is described as a production invariant and evaluation target, not a demonstrated property. The proposed four-boundary enforcement (ingest binding to a root, SQLite INSERT and UPDATE triggers, retrieval rejection of out-of-bundle endpoints, and federation only via approved patient_identity_link) needs implementation and verification.
• Validation at larger scale. The paper says validation at larger patient counts must include write contention, Pod growth, index size, restart recovery, key-management latency, rolling-generation lag, and authorization cost, since the 100,000-patient operation and 1,000,000-patient horizon are targets rather than measurements.
• Cross-institution machinery. Patient identity linking, consent and purpose-of-use authorization, organizational trust anchors and key lifecycle policy, distinguishing duplicate or conflicting clinical statements, and tenant isolation are all named as required mechanisms outside the Bead hash; the reference system does not implement cross-institution identity resolution.
• FHIR connector robustness. The paper notes that server capabilities vary and that a robust connector must preserve deletes as retraction events, distinguish source provenance from importer attestation, and advance a checkpoint only after an entire page has been ingested successfully.

Target Audience

This paper is most useful to clinical informatics architects and health-system engineers designing the layer between EHR/FHIR systems and generative AI applications; to researchers working on retrieval-augmented generation, GraphRAG, and grounding evaluation who want a concrete alternative substrate to compare against; to health IT standards and interoperability specialists interested in how FHIR R4 history, Provenance, Patient.identifier, Patient.link, and Person.link might feed an AI-facing graph; and to security, privacy, and governance teams concerned with provenance, signature trust, security clearance, and multi-institution patient identity. Readers looking for measured clinical outcomes, hallucination-rate comparisons, or production capacity benchmarks will not find them here — the paper reports implementation feasibility and reproducibility from a synthetic corpus and explicitly defers clinical benefit to future controlled studies.

Authors’ abstract

Generative AI can encode substantial medical knowledge, but patient-specific answers remain constrained by the context supplied at inference time. Electronic health records and FHIR support documentation and interoperability, but they do not by themselves define the complete, current, and auditable context a model should receive. Similarity-based retrieval can find related text, but it neither guarantees collection of clinically connected records nor makes omissions explicit. We introduce MedBeads, an AI-facing clinical record substrate that assembles a declared closure of longitudinal patient information before generation. A Bead is an immutable clinical or knowledge object identified by SHA-256 over canonical content and stored as an append-only frame in a patient-scoped Pod. Structural parent edges form a patient-rooted Merkle DAG. Typed clinical links occupy a separate, reconstructable interpretation layer derived from signed, versioned knowledge rules; they can be recomputed when knowledge changes without rewriting clinical facts. Retrieval follows authorized structural and clinical edges, resolves amendments and retractions, and reports policy or token truncation. An open-source Go implementation uses append-only Pods and reconstructable SQLite projections. File-based conversion of 1,135 synthetic Synthea FHIR bundles produced approximately one million Beads and demonstrated deterministic clinical-link derivation and interpretation-layer reconstruction. These engineering results establish feasibility and reproducibility, not reduced hallucination or improved clinical outcomes. MedBeads reframes grounding as a data-structure problem by delivering a policy-bounded, provenance-bearing clinical subgraph rather than an opaque list of similar fragments.