This week: an independent UK commission tells builders to expect public safety scorecards and disclosure to patients, a neurosurgeon ships an education platform built entirely on Claude Code, and six new names join the directory.
Top signal
A staged path into use, and a public record of what goes wrong. The National Commission into the Regulation of AI in Healthcare, an independent body the MHRA set up in September 2025 and co-chaired by Professor Alastair Denniston and Professor Henrietta Hughes, published its report on 10 September after gathering evidence from more than 12,000 people over a year, described as the largest engagement of its kind on healthcare technology regulation in the UK. Its central recommendation: new AI models should enter practice "under close supervision and tight guardrails, allowing them to demonstrate real-world safety and performance before being granted fuller authorisation", a staged path closer to how junior doctors earn independence than how software is certified today. Three more recommendations follow from it. Devices already in use "should be subject to continuous, real-world monitoring throughout their working life", not just at the point of clearance. The public should "be able to easily search for information about the safety of specific AI-enabled medical devices, including any adverse incidents", and the Commission is blunt about why: "patients have told the Commission that they want to know when AI is being used in their care." The MHRA itself would get "enhanced enforcement powers" to act when a system falls short. None of this is law yet; it is a blueprint for government to act on. For anyone shipping a clinical AI tool of their own, the direction is worth planning for: disclosure to the patient in front of you, a public safety record for your tool, and wider use earned in stages rather than granted on day one. GOV.UK
Shipped this week
- MD Academy: neurosurgeon John M. Abrahams, founder of New York Brain & Spine Surgery, built and launched MD Academy at academymd.health this week: an education platform for physicians, ten paid tracks including a Claude Code course. "I built an entire clinical platform on Claude Code," he posted on 4 September; the site itself describes the content as business and AI education, not clinical care. Live and taking enrolments; no user numbers published yet. X
- OpenBeat: MD Marija Trajkova built and open-sourced OpenBeat, an interactive cardiology teaching studio with synchronised conduction diagrams, ECG exploration and an eight-case atlas, in React, TypeScript and Vite. Pushed 6 September; no stars yet and no licence declared on the repo, so reuse terms are unclear until one is added. GitHub
- Human Atlas: radiology researcher Julio Min MD MPH (University of Florida) released Human Atlas, a free interactive cross-sectional anatomy tool: scroll real CT in three planes, or generate a synthetic radiograph from tissue attenuation and list every structure the beam crossed. Posted 9 September, CC BY 4.0, served from GitHub Pages; over 21,000 views and 377 likes by issue time, but no peer review or classroom usage data yet. X
- OncoPulse: oncologist Roupen Odabashian MD, founder of MeDucation AI, launched OncoPulse: a free AI agent that tracks FDA approvals, trial openings and treatment updates by topic and emails a daily digest, aimed at oncologists, haematologists, NPs, PAs, fellows and students. "No feed to scroll, no newsletter you never open," he posted on 5 September. Free at launch, with no pricing model disclosed for scale and no independent check yet on the digest's accuracy. X
- And in the workshop, orthopaedic surgeon Blaine Warkentine MD pushed the SolvingHealth SDK, an open TypeScript monorepo of billing-code lookups, FHIR and EHR connectors, HIPAA tooling, identity and PROMs he calls "free pipes for healthcare AI", the open half of what he describes as a live attestation stack. Pushed today; no stars yet, and the attestation stack itself is not public to check the claim against. GitHub
Build safely
- A residency for generative AI: on 18 August the FDA's Center for Devices and Radiological Health opened a discussion paper (docket FDA-2026-N-7874, comments due 19 October) proposing a competency-based path for generative AI devices, modelled on physician training: a knowledge assessment, then supervised practice with widening independence, then ongoing evaluation for as long as the device is in use. The FDA calls it non-binding, just 26 questions for manufacturers, clinicians and the public before any rule gets written. Christian Pean MD, an orthopaedic surgeon who builds his own clinical tools, calls it "one of the more thoughtful treatments I've read of both the risks and the promise of generative AI in clinical use", crediting it for taking seriously that a generative model's output is often good but inconsistent in a way a fixed algorithm's is not. If you are shipping an LLM in a clinical workflow, this is where your use case gets a vote before the rule is written around it. FDA
- The illusion of competence: Sander De Bruyne and colleagues at Jessa Hospital and Ghent University, writing in Clinical Chemistry and Laboratory Medicine on 7 September, warn that laboratory specialists vibe-coding their own clinical software face a specific trap: AI-generated code that is syntactically correct and looks professional is exactly the kind that people with the least software-engineering background most overestimate. "Code that runs" and "code that is safe for clinical use" are different claims, and current device regulation (risk management, validation, documentation, quality assurance) cannot be met by code nobody reviewed. Their fix is not to stop building: prototype with generative AI in a sandbox, then hand the concept to a qualified software developer and regulatory expert before it goes anywhere near a specimen. Open access. Clinical Chemistry and Laboratory Medicine
Tools & guides
- Thirteen hours, not a procurement cycle: a Memorial Sloan Kettering medical physics team led by Tonghe Wang PhD replaced an obsolete MATLAB radioactive-seed inventory system with a new desktop application built by a physicist with no web-development background, using Claude Code under a structured Plan-Review-Execute-Verify-Feedback process. Build time: about 13 hours and 115 natural-language prompts for all eight required features. Usability score: a median System Usability Scale of 95, against 32.5 for the legacy tool. Three colleagues with minimal coding experience each fixed a bug or added a feature in one or two prompts, under ten minutes, without the original builder's help. Open access in the Journal of Applied Clinical Medical Physics; one caveat, this is a single-site technical note, not a validated deployment standard, and it does not say who is accountable when a change breaks in production. Journal of Applied Clinical Medical Physics
- A checklist before you ship: HIPAA Vault, a vendor selling HIPAA-compliant hosting and compliance services, published an eight-step checklist for moving a vibe-coded prototype toward compliant production: vendor BAA coverage, prompt hygiene so PHI never reaches a model without a BAA behind it, secrets management, access control, audit logging and third-party routing. Vendor content, but the questions are the right ones to put to your own stack, whichever vendor ends up answering them. HIPAA Vault
Events
- 3 Oct (Antwerp): Care & Code Clinical Build Day: doctors, nurses, pharmacists and physiotherapists vibe-code a working AI care tool in one day, tickets on sale now. Disclosure: this is our own event. careandcode.be
New in the directory
- Bell Eapen, MD (United States): assistant professor of information systems at the University of Illinois Springfield, dermatologist by training, who maintains pyomop, fhiry, dhti and other OHDSI and FHIR Python packages under his own GitHub account. GitHub
- Josh Mandel, MD (United States): physician informaticist, chief architect for Microsoft Healthcare and SMART Health IT, lecturer at Harvard Medical School's Department of Biomedical Informatics. Featured in Issue 5 for mychart-takeout; now a verified entry. GitHub
- Mark Wardle, MD (United Kingdom): consultant neurologist who built Hermes, a SNOMED CT library and microservice with cross-maps, inference, fast full-text search, autocompletion and expression constraint language support. Featured in Issue 4; now a verified entry. wardle.org
- Matt Stammers, MBBS MRCP (United Kingdom): consultant gastroenterologist at University Hospital Southampton NHS Foundation Trust, self-described computational gastroenterologist who maintains open-source data-science and training repositories alongside clinical practice. GitHub
- Matthew Behrens, MD (United States): emergency medicine physician who built and launched Moonlighter, a community salary-transparency platform where EM physicians anonymously compare pay; over 600 verified submissions so far. moonlighterjobs.com
- Vishnu Ravi, MD (United States): clinical assistant professor at Stanford School of Medicine and technology architect at Stanford Biodesign, co-founder of Stanford Spezi, an open-source digital health framework, who also personally builds tools such as a hospital-capacity tracker. vishnu.io
- The directory now counts 54 clinician-builders with verified, evidence-graded ships: six joined this week, no removals, so the net is six more than last week. Browse it, forward this to a colleague who ships, and reply if you know someone who belongs in it. cliniciansthatcode.com
From us
- Where Mistral's BAA actually reaches: the BAA fact table gained an eighteenth row this week: Mistral AI. Its trust centre says a HIPAA BAA is available "for qualifying services"; the document behind that line, dated 17 August, covers exactly two of them, OCR 3/4 and Voxtral Mini Transcribe 2, on an Enterprise committed plan, through the US endpoint, with zero data retention switched on. Chat completions, agents and Vibe (formerly Le Chat) sit outside it, and self-serve customers may not process PHI at all. One more thing the table caught: Mistral's own help centre says zero data retention is only available on pay-as-you-go plans, the one tier the BAA document excludes entirely, a contradiction in the vendor's own pages, not ours. The narrowest BAA of any model API on the table, from the one European lab on it. cliniciansthatcode.com