This week: the evidence gap behind over 1,600 cleared AI devices, a Kenyan clinical officer's claims agent built in nine days, a spine surgeon's local DICOM viewer, a GP's data on the 8am rush, and an open-source scribe from Alberta.
Top signal
Over 1,600 AI devices, almost no outcome data A correspondent's report in JMIR on 11 November makes an uncomfortable point for anyone shipping clinical AI: the devices are multiplying faster than the evidence that they help patients. As of October 2026 the US Food and Drug Administration has greenlit 1,614 AI-enabled devices, Simon Spichak writes, and almost none have data on whether they improve patient outcomes. A study in PLOS One earlier this year, cited in the piece, found that only 3 of 1,357 authorised AI devices assessed any patient outcomes at all. Many tools clinicians already use, including some ambient scribes and medical chatbots, do not necessarily require regulatory approval. Maxim Topaz, a nurse and associate professor of nursing at Columbia University, puts the double standard plainly: "We were grilled on previous generations of this technology." Leo Anthony Celi, the MIT scientist who led the study, says clearance is the minimum: "It's the floor, it's not the ceiling." Read it as a checklist for your own work: name the outcome you move, measure it after deployment, and watch for discordance between what clinicians and patients count as a benefit. JMIR
Shipped this week
- Lipwad: Stella Oiro, a clinical officer in Kenya who also works as a software developer, built Lipwad, an AI agent that checks hospital claims before they leave for the Social Health Authority, in nine days for the Meta Global AI Developer Hackathon. Staff photograph the claim form and invoice or record a voice note; the agent reads both, verifies the practitioner and facility against the registry, cites where every value came from and flags conflicts rather than resolving them silently. Green, amber and red come from deterministic checks; a named clerk still confirms every field. Her design line is the honest one: "A claim value with no source is just a guess that looks official." The code is Apache 2.0 and the live demo runs on synthetic data, with 224 backend tests and a claim taking 22 to 37 seconds. Caveats: submissions go to a mock HIE, not the national system, the SHA rule IDs are still placeholders, and voice notes are English only for now. DEV Community
- FastDICOM: Valerio Caccavella, MD, an orthopaedic spine surgeon in Milan, open-sourced FastDICOM on 7 November: a local DICOM folder viewer for macOS, built in Rust with Rune, that keeps images on the machine with no database and no cloud uploads. His pitch is blunt: "a stupidly fast local dicom viewer built with rust + rune. because apparently waiting for medical images to load is still considered normal in 2026." A radiology stack that starts with the annoying part, opening a folder of images quickly without routing studies through a server, is a sensible default for anyone prototyping on a laptop. Caveats: the repo is days old, has a single star and, though he calls it open source, no licence file yet; the platform is macOS only, and there is no published evaluation of load times or image handling. GitHub
- A GP tests the 8am rush: Anne Marie Cunningham, a GP in Northern Ireland, has published an open dashboard that asks whether opening online consultation (OC) around the clock eases the 8am rush in English general practice. Her answer, from NHS data on practices with 300 or more OC submissions in September 2026: not really. Practices that opened OC overnight and at weekends saw no fall in the share of calls arriving between 8 and 10am (a change of 0.4 points, with a confidence interval that spans zero; 24 practices). Practices open 24/7 for clinical requests still get 28.9 per cent of weekday calls and submissions between 8 and 10am, against 30.9 per cent in core-hours practices. "The results fit the capacity explanation better than the opening-hours one," she writes: the morning peak reflects limited same-day clinical capacity, not opening times. The README credits Claude for assistance, lists her Python scripts in run order and adds: "The analysis and any errors are mine." Read the limits she lists first: practices choose their own hours, the 24/7 clinical group is small, and opening hours are inferred from when submissions arrive. GP online-consultation dashboard
Build safely
- A human in the loop is a design choice: Rebecca Grochow Mishuris, Sara Murray and Deepti Pandita, physicians at Mass General Brigham, Johns Hopkins Medicine and the University of California, Irvine, writing in JMIR on 10 November, take the finding that language models write more empathetic answers than doctors and ask what it leaves out. The meta-analysis they discuss, by Richter and colleagues, pooled ten studies: AI responses were rated more empathetic (standardised mean difference 1.02) and were also longer, clearer and often rated more useful, but there were no randomised trials, no direct measure of trust and substantial heterogeneity. The observation they weigh most: in one study, reviewers flagged some AI answers as potentially harmful, yet patients rated those same answers highly and could not tell them apart. "This is why 'human in the loop' cannot be a disclaimer; it has to be a design and governance choice," they write, because oversight works only if the clinician has "the knowledge, time, tooling, and incentive to catch what the patient cannot." If your product drafts patient-facing messages, that is the failure mode to design against: convincing text that is wrong. The commentary is not peer reviewed. JMIR
- Australia legislates after an AI agent got into a Medicare portal: Australia's Prime Minister announced on 10 November that mandatory safety and security obligations will go into Australia's AI Standards legislation, enforced by a new AI safety regulator able to impose significant penalties. The trigger was an OpenAI agent that, while researching public medical spending, accessed a Medicare statistics portal run by Services Australia and three other systems in June; OpenAI knew in August but told the government only in mid-September, the Guardian reports; DW reports that OpenAI's own review found no evidence patient records were accessed. Frontier AI companies will have to keep security controls throughout development and deployment, allow independent model evaluation, report incidents rapidly and publish safety frameworks. All 18 recommendations of the rapid review were accepted; its findings are not public yet. The obligations land on model makers, not on you, but the pattern is yours too: an agent sent to do research ended up inside a health system it was never meant to touch. Your version: give an agent the narrowest credentials and network reach its task needs, log every action, and decide before launch whom you notify, and how fast, when one misbehaves. Prime Minister of Australia
Tools & guides
- Berta, an open-source AI scribe from Alberta: Samridhi Vaid, J Ross Mitchell and colleagues at the University of Alberta and Alberta Health Services, writing in JMIR Medical Informatics on 10 November, release Berta, an open-source, modular AI scribe built to run entirely inside a health system's own infrastructure: a Next.js front end, a FastAPI back end and swappable speech-recognition and language-model parts. Four emergency physicians sat on the co-design team, and core development took about 13 person-months of engineering. A closed-source implementation built in parallel ran within Alberta Health Services: over nine months, 197 emergency physicians at 105 urban and rural facilities ran 21,548 sessions and more than 2,700 hours of audio, rising from 675 sessions a month in November 2024 to 5,463 by July 2025. Operating cost averaged under US$30 per physician per month, against commercial scribes listed at US$99 to more than US$600. Caveats: the usage figures come from that sibling, not from the open-source release; the cost excludes staff time for development and maintenance; and users rated documentation quality lowest. JMIR Medical Informatics
- Training a test reader on synthetic images: Elliott Rogers, Valérian Turbé and colleagues at University College London and the Africa Health Research Institute in Durban, writing in npj Digital Medicine on 10 November, present SynSight, a machine-learning pipeline that segments and reads rapid diagnostic tests after training only on synthetic images. Machine learning can improve how these cheap tests are read, but it has usually depended on large, proprietary and costly libraries of real photographs; SynSight needs no real-world training images, which the authors say lets training keep pace with new tests as they appear. Validated on HIV tests it reached 98 per cent sensitivity and 99 per cent specificity, and on COVID-19 tests up to 99 per cent accuracy. For a small team the point is the method: generated data can stand in where no large image library exists. Caveats: the validation covers HIV and COVID-19 tests only, and a reader trained on generated images still has to be checked against the photographs your own setting produces. npj Digital Medicine
Events
- 15 Nov (Stockholm, waitlist only): Build Your EHR is a free afternoon buildathon at SQUARE, from 12:00 to 16:00, for clinicians and other healthcare staff who want to prototype the part of their record system they would change. It is run by Leyr, a Stockholm company that sells one API for connecting to electronic health records, with Lovable, the AI app builder. No coding is needed and participants get free Lovable credits. It opens with a fireside chat with people who have built EHRs, and the prototypes are presented at a virtual demo day on 17 November. The room is full, so places now come only through the waitlist. Leyr Health on Luma
- 3 to 4 Dec (Toulouse): the Hackathon IA en Santé gives teams of five two days at the Clinique Pasteur in Toulouse to prototype an AI solution to one of two challenges taken from care professionals' unmet needs: communicating fall risk more clearly, and preventing aggression and other risky interactions. Teams are formed on the day from individual sign-ups, so clinicians work next to developers, AI students and researchers, with health professionals and mentors on hand and a jury at the end. It is free and capped at 40 places, run by La Mêlée with Toulouse Santé Numérique, a France 2030 test site set up by the CHU de Toulouse, the Clinique Pasteur and the ASEI. The page is in French. La Mêlée
- More healthtech hackathons: we found both events above on Hackathon Hub, the European hackathon platform, whose healthtech filter lists upcoming health and care hackathons across Europe. We check each one against its organiser's own page before it appears here. Disclosure: Bart Collet, who edits this briefing, is Hackathon Hub's Healthtech ambassador. Hackathon Hub
New in the directory
- The directory now counts 104 clinician-builders with verified, evidence-graded ships, 5 more than last week: Anne Marie Cunningham (GP, Northern Ireland; the online-consultation dashboard above), Gurtej "Sunny" Bamrah (PharmD, BCPS, a board-certified clinical pharmacist in Illinois who builds cited pharmacy reference tools), Klaus Schumacher (MD, a neuroradiologist at Hospital Israelita Albert Einstein in Sao Paulo, who built OMNIA, a browser-based DICOM to NIfTI converter), Sven van Egmond (MD, PhD, a dermatology resident at Erasmus MC; featured in Issue 13 for CatchUpRad), and Zack Gabbard (CNP, an ICU acute care nurse practitioner in Dayton, Ohio). Browse it, forward this to a colleague who ships, and reply if you know someone who belongs in it. cliniciansthatcode.com
From us
- A voice layer for the BAA table: our guide to which platforms sign a BAA grew a voice and telephony layer on 11 November, four rows covering the services that carry the audio in a voice-first care app. Twilio (Programmable Voice) and Vapi sign a BAA on a paid tier or paid add-on; ElevenLabs and Deepgram sign only for Enterprise customers. The pattern holds from the rest of the table: the AI app-builders still never sign, and the infrastructure underneath does. Twilio's entry is the instructive one, because eligibility comes with conditions: a BAA needs its Security Edition or Enterprise Edition, bought through sales, and many Voice features (call recordings and storage, transcription, media streams, the SIP interface) are HIPAA-eligible only when used as Twilio's own HIPAA guide describes. Twilio states outright that signing a BAA does not make an application compliant, which is the line worth pinning above your voice stack. The guide is now 24 dated rows, each checked against the vendor's own pages. Clinicians That Code