This week: an international working group sets out what AI education in medicine should actually cover, a rheumatologist ships three tools that never send data off the device, and a preprint maps the first year of clinician vibe coding.
Top signal
Fragmented, narrowly technical, and disconnected from the ward. Twenty-four authors from institutions in Canada, the United States, the United Kingdom and Italy, coordinated through the University of Toronto's Temerty Centre for AI Research and Education in Medicine, published a framework for AI education in medicine in npj Digital Medicine on 9 September, and their diagnosis is blunt: AI education in medicine remains "fragmented, narrowly technical, and disconnected from healthcare realities". The framework spans seven domains and 24 learning objectives, built through international collaboration across the whole training continuum, and its central lesson is that effective AI education must be "clinically grounded, ethically integrated, and implementation-aware", taught the way clinical medicine is taught rather than as a standalone computing module. The authors, spanning Mayo, Stanford, Cambridge, Cleveland Clinic and Rome's Bambino Gesu among others, also publish the tensions they hit getting there, which is rare and useful. No regulator published anything this week; this is the field's educators saying out loud what the clinical-builders movement has been proving by shipping. If you are already building, you are ahead of most curricula, and this framework is a decent map of what to backfill. npj Digital Medicine
Shipped this week
- Shardul Dhande: the MBBS-trained doctor now studying machine learning at Georgia Tech shipped a live retrieval-augmented decision support tool for the PCI versus CABG call, grounded in the 2021 ACC/AHA guidelines: a Streamlit front end, PubMedBERT embeddings, a ChromaDB store and Gemini in the loop, deployed at decisionsupport.sharduldhande.com and pushed again on 15 September. No licence on the repo and no evaluation beyond his own testing yet, so read it as a working prototype, not a validated instrument. GitHub
- Dan Heslinga: the Hawaii-based physician implementer keeps shipping Kotlin Multiplatform plumbing for the WHO Open Health Stack: this fortnight brought a FHIR Questionnaire data-capture library, a conformance probe for the kotlin-fhir-knowledge stack, a reference application for the OHS components and a repo of findings from running WHO SMART Guidelines L3 content verbatim on the cqframework toolchain, pushed across 9 to 16 September. Deep in the infrastructure rather than at the bedside, which is exactly where someone has to be; zero stars so far, so adoption is early days. GitHub
- CardioAI-12Lead-ECG: physician and clinical AI researcher Youssef Ahmad, MD published a full Python pipeline for 12-lead ECG classification, reporting an AUROC of 0.9019 with a calibration analysis (reported expected calibration error 4.7 per cent) and a Grad-CAM explainability dashboard wrapped around what he calls a clinical decision support cockpit, created on 10 September. Self-reported performance with no external validation, no licence and no stars yet; treat the number as a claim until someone else reproduces it. GitHub
- And in the workshop, Bedirhan Keskin, MD, the Istanbul physician who won an Anthropic hackathon and spent four years at SignitApp, the last one leading its backend engineering team, announced on 4 September that he is leaving to build his own products in healthcare and education, starting with Medkit. "I turned from a doctor into an engineer", he posted. No new artefact to point at yet, but a doctor going full-time engineer on his own products is this directory's whole thesis in one career move. X
Build safely
- The sandbox trap, spelled out: HIPAA Vault, a vendor selling HIPAA-compliant hosting, posted a 13-minute walkthrough of what it calls the AI sandbox trap: prototyping platforms such as Lovable, Bubble and Base44 either will not sign a BAA or only on expensive premium tiers, so a vibe-coded prototype holding real patient data is a breach before you ever launch. Their advice: prototype with synthetic data only, keep the code portable enough to move it, and strip tracking pixels from any front end a patient will touch, because an analytics script that logs a patient's IP and name is a disclosure. Vendor content, and part one of a series, but the trap it names is the same one our BAA fact table keeps catching row by row. YouTube
- What the transcript knows, and what it costs: a urology team at Clinique Pasteur in Toulouse ran a transcript-centred audit of 124 consultations with ambient AI and found inter-physician variation and expert disagreement that chart review alone never surfaced, then spent half the paper on the limits: what a transcript cannot capture (the nonverbal and behavioural), the technical failure modes, and the regulatory exposure of recording patient conversations at all. Published 15 September in npj Digital Medicine, open access. If ambient scribes already draft your notes, this is an early, honest look at what the recording underneath could teach your department, and at what it would cost to turn it on. npj Digital Medicine
Tools & guides
- A map of the vibe-coding year: Pauline Huynh and Alexander Rivero posted a scoping review of vibe coding across healthcare on 7 September, now under review at Discover Artificial Intelligence: PubMed, Scopus, Web of Science, IEEE Xplore and the ACM Digital Library searched, peer-reviewed literature from January 2023 through December 2025 included. The finding that matters: the peer-reviewed literature only starts in mid-2025, and it already maps onto clinician-built training tools, decision support prototypes, interoperability plumbing and administrative automation, with code security vulnerabilities, regulatory compliance gaps and no standardised validation frameworks anywhere in sight. They propose a three-tier, risk-stratified governance framework to fill the gap. A preprint, not peer reviewed yet; read it as a census of the field you are personally populating. Research Square
Events
- 3 Oct (Antwerp): Care & Code Clinical Build Day: doctors, nurses, pharmacists and physiotherapists vibe-code a working AI care tool in one day, tickets on sale now. Disclosure: this is our own event. careandcode.be
- 29-30 Oct (Vienna): AIM Austria, Vienna's curated clinician-plus-engineer network, runs a two-day healthcare hackathon at IBM's Vienna headquarters: three tracks on real partner use cases (clinical adoption, diagnostic AI on de-identified case data, open case), over EUR 15,000 in cash and credits, and a follow-on venture track with mentors and investor introductions for standout teams. The next application batch closes 26 September. It is an official partner event of the European AI Innovation Month, with a remote community track for teams that cannot travel. healthcare-hackathon.eu
New in the directory
- Chris McMaster, MBBS (Australia): consultant rheumatologist at Austin Health in Melbourne and machine-learning PhD candidate at the University of Melbourne, who built RheumAI solo: three live browser-based tools, including a temporal artery biopsy report classifier designed so no report data ever leaves the device, a filterable lookup for PBS-listed rheumatology biologics with live item codes, and a weekly AI-generated digest of new rheumatology research. rheumai.com
- The directory now counts 55 clinician-builders with verified, evidence-graded ships: one joined this week, no removals, so the net is one more than last week. Browse it, forward this to a colleague who ships, and reply if you know someone who belongs in it. cliniciansthatcode.com
From us
- What data can you actually get out of the EHR?: a new guide, checked against Epic, Oracle Health and eClinicalWorks' own developer terms rather than their sales pages: the two real routes to clinical data (patient right-of-access versus a vendor developer program), a six-layer table of what has to be yes before a single record moves, and what the still-pending HTI-5 rule would and would not change. The premise is the part most guides skip: being a clinician does not entitle you to your institution's data, and a certified, FHIR-enabled EHR does not mean the app you built can reach it. cliniciansthatcode.com
- A badge for the directory: everyone in the directory now has an embeddable verified-builder badge, a small SVG that links back to their entry, so a clinician can show their ship is evidence-graded from their own site or profile. House item, no vendor label needed; the badge is free and the link is the point. cliniciansthatcode.com
