High-Performance RAG, Clinical Notes Engine & Patient Compliance Reports

Three things separate a platform from a Claude-shell-with-prompts

Where AI is bounded out. How research enters the build. What the gate looks like that says no. Each item below maps to a published framework, not a vibe.

01 · AI bounded OUT of the crisis path OWASP LLM06 · NIST 600-1 G-9

MAIA classifies signals. A deterministic state machine with 7 PMHNP-curated templates generates every crisis response. No LLM ever writes the safety reply. Excessive-agency risk is closed at the architecture layer, not patched at the prompt layer.

02 · Promotion gate has already rejected models NIST AI RMF MS 2.1

A model can clear in-distribution accuracy and still fail real-world spot-check. That has happened here. Receipts live in the repo. Strong benchmark numbers do not ship to users until the human gate signs off.

03 · Research tiers gate every clinical claim ISO 42001 A.5 · A.7

Four-tier evidence hierarchy. Tier-1 (peer-reviewed) and Tier-2 (clinical guideline) are required to ground any shipped clinical or behavioral claim. Vendor blogs sit at Tier-4 and cannot back a production assertion. Research briefs carry an expires date and are re-reviewed on cadence.

04 · Three-layer prompt-injection defense, CI-enforced OWASP LLM01 · LLM08 · LLM10

Input sanitization, delimiter hardening, output validation. Tenant-leak harness in CI. PHI-aware logging redacts automatically when compliance.phi: true. Per-conversation cost tracking with automatic model swap at $0.15/conversation. Per-user and per-session token budgets with hard caps.

Every shipped control maps to a named, versioned framework

Reviewers and enterprise buyers do not have to take a vibe-check on credibility. Each control below ties to an external reference document and an evidence location in the repo.

Shipped Control	Framework + ID	Evidence Location
Deterministic crisis state machine (7 PMHNP templates)	OWASP LLM06 · NIST AI 600-1 G-9	/screening/state-machine/
MAIA classifier-before-LLM routing	OWASP LLM01 · NIST AI RMF MG 1.1	/maia/router/
Prompt injection three-layer defense	OWASP LLM01:2025	/middleware/prompt-guard/
Tenant isolation harness (CI-enforced)	OWASP LLM06 · LLM08 · CSA AISMM IAM	/tests/tenant-leak.spec.ts
PHI-aware structured logging	ISO 42001 A.7 · NIST AI 600-1 G-4 · HIPAA	/lib/log/redact.ts + manifest compliance.phi
Per-conversation cost tracking + auto-swap	OWASP LLM10 (Unbounded Consumption)	/cost/budget-guard/
Promotion gate (real-world spot-check)	NIST AI RMF MS 2.1 · MEASURE	/registry/active.json + /promotion-gate/
Research tier classification (T1-T4)	ISO 42001 A.5 · A.7	/docs/research/briefs/ with frontmatter source_quality
Versioned system prompts, PR-reviewed	OWASP LLM07 · NIST SSDF PW.4	/prompts/ with git history
SBOM + signed releases (Syft + cosign)	NIST SSDF PS · G7 SBOM-for-AI · SLSA L2	CI artifact store
AI model inventory + provider allowlist	NIST AI RMF GV 2.1 · MAP 4.1	/docs/ai-governance/model-inventory.yaml
Quarterly governance review checklist	CSA AISMM (target L3) · ISO 42001 A.6	/docs/ai-governance/quarterly-review.md
Threat models per AI feature	NIST AI RMF MAP · MITRE ATLAS	/docs/ai-governance/threat-models/
AI transparency disclosure (UI labels)	EU AI Act Art. 50 · ISO 42001 A.8	UI components + footer disclosure

High-Performance RAG: Cross-Context Intelligence Layer

What Changes — and Why It Matters

DWA's current RAG pipeline is correct in architecture (2,400+ embedded content chunks, cosine similarity retrieval, injected into coaching context). Adding high-performance retrieval upgrades this from a single-context lookup into a full-platform intelligence layer available to four distinct surfaces: the AI wellness coach, the onboarding intake flow, the provider portal session-prep brief, and the clinical notes-to-learning-path engine. The same corpus serves all four — with per-surface retrieval configuration and strict per-patient/per-practice PHI isolation.

Hybrid Search Architecture: Vector + BM25 + Reranking

High-performance production RAG in clinical settings requires three retrieval layers. Pure vector search captures semantic meaning but misses exact term matches — critical when a patient mentions "PHQ-9" or "GAD-7" or a specific diagnosis. Pure BM25 keyword search captures exact terms but misses paraphrase and concept-level matches. Hybrid search via Reciprocal Rank Fusion (RRF) combines both, then a cross-encoder reranker re-evaluates the top-N candidates against the original query to surface the single most relevant chunk.

PHI Isolation in Multi-Tenant RAG

Multi-tenant RAG is a well-documented attack surface: a misconfigured retrieval query can surface one patient's clinical data to another. DWA's isolation model follows the metadata-filter pattern established in production PHI-safe RAG implementations: every embedded document is tagged at ingest with tenant_id (practice) and optionally patient_id. Every retrieval call filters on these metadata fields — pulled from the auth/session context on the backend, not from user input.

RAG Across the Four Surfaces

Surface	Query Source	Retrieval Config	Context Injected Into	PHI Scope
AI Wellness Coach	Patient message + WellnessProfile keywords	Hybrid + reranking, top-3 chunks	Coaching system prompt, per-turn	Patient-scoped
Onboarding Engine	Symptom intake answers + presenting concern	Hybrid, top-5 chunks (no reranking — latency priority)	Initial learning path draft, lesson recommendations	Patient-scoped
Provider Portal (Session Prep)	Patient's recent assessments + mood timeline	Hybrid + reranking, top-5 chunks	AI session-prep brief for the clinician	Practice-scoped (provider sees their patients only)
Clinical Notes Engine	Parsed clinical note themes (SOAP extraction)	Hybrid + reranking, top-8 chunks (learning path requires broader coverage)	Draft learning path generator prompt	Patient-scoped, provider-initiated

Content Corpus Maintenance

The content corpus is a living index. When new lessons are added to DWA's 922-lesson library — new therapeutic schools, updated evidence grades, new assessment instruments — they are embedded and indexed without any model retraining required. The chunk size strategy (approximately 300–400 tokens per chunk, with 20% overlap for boundary context preservation) is already in place. The addition of hybrid search and reranking is a retrieval-layer upgrade, not a re-embedding event.

Clinical Notes → Learning Path Engine

The Clinical Problem This Solves

A PMHNP completes a session with a patient presenting with generalized anxiety, sleep disruption, and avoidance behaviors. The provider now knows what the patient needs to work on between sessions. Without DWA, that knowledge lives in the session note and reaches the patient only if the clinician remembers to recommend specific resources at the end of the visit. With the clinical notes engine, the provider pastes or uploads the session note and DWA's engine does the following in under 60 seconds: extracts clinical themes, maps them to the lesson corpus via RAG, drafts a learning path, and surfaces a "Share with Patient" button.

Feature Specification: What the Provider Sees

The feature lives in the Provider Portal as a new panel titled "Learning Path Generator." It is accessible only to NPI-verified providers. The workflow has five distinct steps from the provider's perspective:

Privacy & HIPAA Architecture

The notes engine is the highest-PHI-risk feature in the platform, and its architecture is designed accordingly. Three distinct isolation principles apply:

• PHI never leaves the provider's practice context. The note text is processed entirely within the tenant's isolated pipeline. The de-identified clinical summary — not the original note — is what reaches the RAG engine and LLM.
• No original note is stored. After the learning path is generated, the original note text is discarded from working memory. What persists in the audit log is: provider NPI, timestamp, patient ID, and the generated learning path — not the input text.
• Manifest-level enforcement. The compliance.phi: true flag already gates logging redaction, retention enforcement, and encryption. The notes engine is tagged in the manifest as feature: clinical_notes_engine with phi_input: true, triggering the additional PHI-input-handling pipeline that performs the NER redaction step before any external API call.

Learning Path Schema

// Learning Path Object — stored in patient_context namespace
{
  "id": "lp_abc123",
  "patient_id": "pat_xyz",
  "created_by_npi": "1234567890",
  "created_at": "2026-05-20T15:30:00Z",
  "source": "clinical_notes_engine",
  "title": "Week of May 20 — Anxiety + Sleep Path",
  "clinical_themes": ["GAD", "sleep_disruption", "avoidance"],
  "lessons": [
    {
      "lesson_id": "L_042",
      "title": "Understanding the Anxiety Cycle",
      "evidence_grade": "NICE_2024_A",
      "rationale": "Aligned with presenting GAD and cognitive avoidance pattern",
      "sequence": 1,
      "est_minutes": 18
    }
    // ... 3–6 more lessons
  ],
  "optional_tools": [{ "type": "thought_record", "id": "TR_worry_log" }],
  "suggested_timeline_days": 14,
  "status": "active",
  "phi_input_stored": false
}

Competitive Positioning

Existing clinical AI note tools (Clinically AI, Upheal, Freed AI) focus on generating documentation from sessions — writing SOAP notes from recordings. DWA's engine runs in the opposite direction: taking existing notes and generating patient-facing educational content. This is a distinct feature class with no direct equivalent in the behavioral health EHR market. The closest analogue is Psych Hub's "shareable psychoeducation" feature, but that requires the provider to manually browse and assign resources. DWA automates the mapping from clinical theme to evidence-linked content via RAG.

Patient Compliance Report: Between-Session Evidence, Shareable

The Clinical and Administrative Need

Between-session engagement is the most clinically predictive variable in digital mental health outcomes — and currently the least documented. When a patient walks into a session having completed 4 of 5 assigned lessons, logged mood data for 6 of 7 days, and submitted 2 thought records, that evidence should be visible to the provider before the session begins. When insurance reviewers ask for documentation of patient engagement in a digital therapeutic program, that evidence should be exportable in a standardized format. The patient compliance report makes both possible.

What the Report Contains

The compliance report is generated on demand — by the patient, by the provider, or automatically on a configurable schedule (e.g., 48 hours before a scheduled session). It covers a selectable date range and compiles the following engagement data:

Sharing Architecture: Signed URL + PDF Download

The patient has two sharing options, both initiated from the patient dashboard under "My Progress Reports":

Consent and Control Design

The patient owns the compliance report. The provider sees the same data through the provider portal (patient timeline), but the shareable report is patient-initiated. This design respects the psychotherapist-patient privilege framework confirmed by the U.S. Supreme Court (Jaffe v. Redmond) and reinforced by HHS ASPE guidelines on mental health information sharing. The patient decides what to share, when, and with whom.

• Default export: engagement metrics only — no raw PHI content, no session transcripts, no assessment raw scores.
• Enhanced export: patient can optionally include assessment score trends (requires explicit opt-in at report generation time).
• Revocable: signed links can be revoked by the patient at any time; PDF watermarks include a revocation timestamp if the patient later flags the report as no longer valid.
• Audit trail: all report generation events are logged in the patient's audit record — when generated, by whom (always the patient), and when accessed via signed link.

Manifest Configuration

# dwa.manifest additions — compliance report feature
features:
  compliance_report:
    enabled: true
    patient_initiated: true
    provider_view: true           # provider portal timeline also shows report
    export_formats: ["signed_url", "pdf"]
    signed_url_ttl_hours: 72
    pdf_include_scores_default: false # patient opt-in required for raw scores
    auto_generate_pre_session: true  # generates 48h before a scheduled session
    auto_generate_hours_before: 48
    phi: true                           # inherits PHI pipeline
    audit_log_access: true

Manifest Updates and Deployment Notes

Updated RAG Configuration Block

# dwa.manifest — rag configuration update
rag:
  corpus: "dwa_content_corpus_v2"
  chunk_size_tokens: 350
  chunk_overlap_pct: 0.20
  retrieval:
    mode: "hybrid"                    # vector + BM25 via RRF
    vector_top_k: 20
    bm25_top_k: 20
    rrf_k: 60                          # standard RRF constant
    reranker: "bge-reranker-base"
    reranker_top_n: 10
    final_context_chunks: 4           # injected into prompt
  surfaces:
    coach:
      final_context_chunks: 3
      reranking: true
      phi_filter: "patient"
    onboarding:
      final_context_chunks: 5
      reranking: false              # latency priority at onboarding
      phi_filter: "patient"
    provider_session_prep:
      final_context_chunks: 5
      reranking: true
      phi_filter: "practice"
    clinical_notes_engine:
      final_context_chunks: 8
      reranking: true
      phi_filter: "patient"
      phi_input: true
      ner_redaction_before_api: true
  isolation:
    content_namespace: "content_corpus"   # shared, tenant-agnostic
    patient_namespace: "patient_context"   # patient-scoped, write-restricted
    metadata_filter_source: "auth_context" # never from user input

MAIA Interaction with New Surfaces

MAIA distress classification runs on every AI coaching message — this does not change. The new surfaces (clinical notes engine, compliance report generation) are non-real-time, provider-initiated, or patient-administrative flows. MAIA is not applied to these surfaces because they do not involve real-time patient emotional expression to the AI. The provider notes engine has its own safety constraint: if a note fragment contains language suggesting active crisis (e.g., suicide mention in the clinical assessment), a flag is appended to the generated learning path prompting the provider to confirm crisis protocol is active.

Deployment Phasing

Capability	Dependency	Phase	Blocking?
Hybrid RAG (BM25 + Vector)	BM25 index build on existing 2,400+ chunks	Phase 1	No — parallel to existing vector pipeline
Cross-encoder reranking	Phase 1 complete	Phase 1	No — additive retrieval step
RAG surface routing (4 surfaces)	Phase 1 complete	Phase 1b	No — configuration change in manifest
PHI isolation metadata filtering	Vector store metadata schema update	Phase 1b	Must precede clinical notes engine
Clinical notes engine (NER + RAG + LP gen)	Phase 1b complete; NER pipeline deploy	Phase 2	Requires PHI isolation gate
Patient compliance report (signed URL)	Engagement data model (already exists)	Phase 2	No — data already collected
Patient compliance report (PDF)	PDF generation service	Phase 2b	No — can use headless HTML-to-PDF
Auto-generate pre-session reports	Phase 2 complete; session scheduling integration	Phase 3	Requires scheduling hook

Evidence Base and Updated Outcome Claims

How These Capabilities Strengthen the Evidence Claims

Evidence Claim	New Capability That Strengthens It	Mechanism
AI coach delivers evidence-based guidance	High-performance RAG	Coach now retrieves from DWA's own evidence-linked corpus, not general LLM training data. Hybrid + reranking eliminates the <40% accuracy problem documented in the Mayo Clinic benchmark
Between-session engagement predicts outcomes	Compliance report	Engagement is now measurable, documentable, and shareable — converting the evidence claim from theoretical to operational
Clinician augmentation (67% attendance uplift)	Clinical notes engine + compliance report	The notes engine reduces the provider's session prep burden; the compliance report surfaces patient engagement data the provider previously had no visibility into
MBC outcome prediction (87%+ accuracy)	Compliance report with assessment completion data	The compliance report ensures assessments are completed and visible; the provider can see completion patterns and intervene when assessments are skipped
MAIA flywheel — intelligence compounds	RAG corpus as a second flywheel	Every patient query that retrieves content refines retrieval relevance signal; every new lesson added to the corpus extends the intelligence without model retraining
Platform vs. point tool	All three capabilities	A point tool delivers either a chatbot or a notes generator or a progress dashboard. DWA delivers all three as one integrated, PHI-safe, clinician-facing + patient-facing platform from a single manifest

Key Research Citations Supporting These Capabilities

• RAG accuracy in healthcare (HealthTech Magazine, 2025): RAG "allows organizations to curate more diverse, representative knowledge bases" and trace responses to source — critical for clinical defensibility. Mayo Clinic: general LLMs under 40% accuracy without RAG augmentation.
• Clinical RAG resource efficiency (arXiv 2025): A RAG framework using only the most relevant text segments matches full-context performance — validating the top-3 to top-5 chunk injection architecture.
• Hybrid search in production RAG (Towards Data Science, 2026): "Hybrid search and re-ranking" is now the production standard, combining BM25 keyword scores and dense vector similarity. Documents missed by pure vector search are recovered by BM25, and vice versa.
• MedPlan two-stage RAG (arXiv 2025): Two-stage SOAP-aligned RAG pipeline for personalized treatment plan generation significantly outperforms prior LLM-only methods. Trained on 350,000+ SOAP notes.
• Multi-tenant RAG isolation (LinkedIn Engineering, 2025): Metadata-filter isolation at the retrieval layer gives "95% of the security with much more flexibility" compared to per-tenant indexes — validating the shared corpus + metadata filter architecture.
• CBT homework compliance mobile features (JMIR, 2017): 6 essential features of optimal CBT homework apps include compliance reporting to therapists — directly validating the compliance report feature design.
• Technology-based compliance solutions (PMC, 2024): Technology solutions directly address barriers to homework implementation in mental health treatment — and compliance reporting strengthens therapist-patient collaboration.
• Text-based compliance reporting in CBT (ProQuest, 2024): Text message-based reporting shapes adherence and creates a feedback loop strengthening therapeutic alliance.
• HIPAA-compliant RAG for medical records (Kiteworks, 2026): Healthcare RAG must implement zero-trust security, PHI-isolated pipelines, and audit trails — all reflected in the architecture spec above.
• Therapy adherence and clinical outcomes (PMC, 2025): Review confirms "profound influence of adherence on clinical outcomes, healthcare costs, and patient quality of life" — making compliance measurement and reporting a direct outcome lever.