Tenant & Platform Operations

Better handling of Telugu/English code-switched dictation and unit-bearing dose phrases. Cannot reach a single tenant until all six synthetic suites pass — the suites run on generated cases, never on a hospital's records, so evaluation never pulls PHI into the control plane (ADR #3).

A real line, unredacted

That is enough to diagnose the incident and not enough to identify a person. rec is an opaque id — turning it into a patient requires a query inside hos_krishna_multispeciality, which requires a break-glass grant with a reason, an expiry and an entry in the hospital's own audit log.

Three controls keep it that way: the structured logger takes fields, never an interpolated string; a CI test fails the build on any log call with template syntax in it; and a PHI-shaped scanner (name, phone, ABHA, ICD patterns) runs on the ingest pipeline and quarantines rather than stores. An error log is the easiest place in this whole architecture to lose the isolation guarantee, so it is the place with the most machinery.

The one breach, and what changed because of it

TCK-4486 · Vasavi Nursing Home. The owner emailed at 02:50 AM after an automated backup-failure notice. On-call had no cover between 01:00 and 06:00 IST, so first response was 1h 48m against a 30-minute S2 target. The backup itself had already retried successfully at 02:58 — the customer spent an hour worried about data that was never at risk.

Preventive control: infrastructure alerts now page on-call directly and the owner-facing notice is delayed until after the first retry, so a hospital is never told about a failure we have already fixed. With four people covering 24×7 across 12 hospitals, the fix has to be in the alerting, not in asking someone to wake up.

The month’s second miss was an S4 request that sat over a long holiday weekend — same coverage gap, lower stakes. Two misses out of 34 is the 94% at the top of this screen; both were gaps in when we were awake, not in how we responded.

82.9% of Indian doctors have never taken any formal AI course (research/06). So 41% of this queue being education is not a support failure — it is the market. What matters is that those 14 tickets did not reach engineering as bugs, because a roadmap that absorbs training questions stops shipping.

Each one produces an artefact rather than just a reply: an in-app guidance step, a Training Sandbox scenario, or a line in the local-language onboarding script. Three of this month's 14 were the same question about approving an AI draft — that is now a first-run tooltip, and the same question should not appear a fourth time.