Documentation & FAQ
Full docs (in the repository)
- Intended use
- Permissions and data - every network call, secret, and written file
- Configuration - guard modes, audit mode, API keys
- Recipes - rounding, admission, discharge, evidence chains
- Regulatory checklist - per-tool non-device CDS self-mapping
- Troubleshooting
- Security policy
Frequently asked
Is this HIPAA compliant?
Different question: MedSeek is source code you deploy inside your own dsh instance. It never receives PHI, so there is nothing for the project to certify. Obligations sit with the deploying organization. What we can tell you is exactly what the code enforces (egress guard, nine-host allowlist, digest-only audit receipts) and what it never does (telemetry, EHR access, identifiers in lookup requests). See permissions-and-data.
Why not just use a free clinician chatbot?
Use both where policy allows - they compose. MedSeek covers the rest: it runs locally on your model endpoint, has no verification wall, enforces structure instead of suggesting it, and de-identifies before anything happens. If your institution bans pasting notes into cloud tools, this workflow still works.
Isn't regex de-identification weak?
In the dangerous direction, yes - which is why the output says assist-not-certify, lists low-confidence spans for review, publishes its corpus and CI floors, and sits behind an independent egress guard. The numbers page scopes every figure to that corpus.
A scribe writes my notes already.
Keep it. Scribes capture the room; MedSeek structures text that exists, gates discharge on pending results, scores instruction readability, and produces de-identified copies for teaching and consults. Feed it scribe transcripts as input.
Is this a medical device?
No. It reorganizes information clinicians supply and cites public reference sources; every artifact is a draft requiring named-clinician review. The per-tool mapping to FDA's non-device CDS criteria is maintained in the regulatory checklist document.
Who maintains this? What if you disappear?
A solo maintainer today, Apache-2.0, with pinned upstream dependencies and documented risks. Fork-and-audit is a designed-for path; the eval corpus lets any fork prove its own numbers.
Does it connect to Epic?
No. There is no EHR read or write anywhere in the bundle. Everything arrives as pasted text the operator chose. Integration would arrive only as partnership work clinics ask for.
Where does my data go?
Nowhere automatically. Local tools make zero network calls. Lookups send terms and codes to nine allowlisted hosts after guard screening. Model traffic goes wherever your dsh points - which is why the operator, not the plugin, owns that decision.