HL7 FHIR R4 bundles. Conformant. Deterministic. Generated from no patient records.
Deterministic FHIR R4 patient bundles across eight resource types with 100% referential integrity by construction — every Observation, Condition, Encounter and MedicationRequest references a resource that actually exists in the same bundle, nothing patched after the fact. Two-stage validator: an in-house structural check plus full R4 datatype conformance through a Python-native validator, no Java runtime required.
A large LOINC subset, a broad RxNorm set, and the full US ICD-10-CM catalogue ship in-image under free licences. SNOMED CT stays bring-your-own-licence. Every bundle is sealed into the platform's evidence chain and re-runs byte-for-byte under the same seed.
- Zero real PHI ever touched
- HL7 FHIR R4 conformant
- 100% referential integrity
- Deterministic per seed
- Sealed evidence on every run
| clinicalStatus | icd10_code | icd10_display | id |
|---|---|---|---|
| active | I50.9 | Heart failure, unspecified | CP000000-000 |
| active | N39.0 | Urinary tract infection, site not specified | CP000000-001 |
| active | D64.9 | Anemia, unspecified | CP000001-000 |
| active | H52.4 | Presbyopia | CP000001-001 |
| active | E55.9 | Vitamin D deficiency, unspecified | CP000002-000 |
| active | Z00.00 | General adult medical exam without abnormal findings | CP000002-001 |
| active | G47.00 | Insomnia, unspecified | CP000005-000 |
| active | F41.1 | Generalized anxiety disorder | CP000005-001 |
| active | N39.0 | Urinary tract infection, site not specified | CP000005-002 |
| active | R07.9 | Chest pain, unspecified | CP000005-003 |
| active | E78.5 | Hyperlipidemia, unspecified | CP000005-004 |
Showing all 20 preview rows
- Resource types
- 8
- Diagnosis codes
- Full US
- Lab codes
- Large
- Medications
- Broad
| id | loinc_code | loinc_display |
|---|---|---|
| OP000000-EP000000-0000-000 | 2075-0 | Chloride [Moles/volume] in Serum or Plasma |
| OP000000-EP000000-0000-001 | 2571-8 | Triglyceride [Mass/volume] in Serum or Plasma |
| OP000000-EP000000-0000-002 | 2345-7 | Glucose [Mass/volume] in Serum or Plasma |
| OP000000-EP000000-0000-003 | 3094-0 | Urea nitrogen [Mass/volume] in Serum or Plasma |
| OP000000-EP000000-0000-004 | 777-3 | Platelets [#/volume] in Blood |
| OP000000-EP000000-0000-005 | 8302-2 | Body height |
| OP000000-EP000000-0001-000 | 2823-3 | Potassium [Moles/volume] in Serum or Plasma |
| OP000000-EP000000-0001-001 | 4544-3 | Hematocrit [Volume Fraction] of Blood |
| OP000000-EP000000-0001-002 | 787-2 | MCV [Entitic volume] |
| OP000000-EP000000-0001-003 | 718-7 | Hemoglobin [Mass/volume] in Blood |
| OP000000-EP000000-0001-004 | 13457-7 | LDL Cholesterol [Mass/volume] (calc) |
Showing all 20 preview rows
A bundle your EHR, your warehouse, and your validator all accept on first load.
Health-tech teams almost always tell us the same story: “We need realistic data, we can't use real PHI, and our last vendor shipped JSON our FHIR server rejected on ingest.” Ours don't get rejected — cross-entry references are enforced during generation, not patched afterwards.
- Every Observation.subject, Condition.subject, Encounter.subject and Procedure.encounter points at a resource that exists in the same bundle — a strict-validator FHIR server accepts it on first load.
- No real patient in any bundle — and no source records either: nothing is trained on or copied from real data. Every value is PRF-drawn from published-reference priors, so there is nothing to memorise, leak, or re-identify.
- Seeded, deterministic generation: the same seed + contract produces a byte-identical bundle next year. Regression tests stay green; your auditor can reproduce what you showed them.
Ship a 100-patient bundle in five lines of Python.
The SDK call produces a 100-patient Bundle with several hundred encounters and thousands of observations, plus associated conditions, medications, procedures and immunizations — all referentially-consistent, all deterministic-fingerprinted, all R4-validator-clean.
Same contract, same seed, same generator version = byte-identical generated resources. The evidence bundle returned is the same structure you can download from /platform/evidence — try it before signing up.
from radmah_sdk import RadMahClient
client = RadMahClient(api_key="sl_live_...")
job = client.jobs.create(
kind="synthesize",
engine="healthcare_fhir",
rows=100, # patient count
seed=42,
).wait(timeout=60)
evidence = client.get_evidence_data(job.id)
print("validator passed:", evidence["fhir_validator_passed"])
print("evidence hash:", evidence["evidence_content_hash"])Eight FHIR R4 resource types — per-field fidelity.
Every bundle is a valid FHIR R4 collection whose entry[] array carries resources in dependency order so cross-entry references resolve at parse time. Below: every field we populate, every code system we bind to, every cardinality we honour.
Patient
1 per PatientUS-Core-profile-compatible Patient with official name (family + given tokens), administrative gender, birthDate, deceased flag, and MRN identifier under a standards-compliant identifier system. PRF-seeded by (seed, patient_index) so every (seed, index) pair yields byte-identical demographics.
name.officialgenderbirthDateidentifier[MRN]deceasedEncounter
a few per PatientAMB (ambulatory), IMP (inpatient), EMER (emergency), HH (home-health) class codes with US-realistic weights, Period.start + Period.end spanning 15 min – 30 days depending on class, subject reference to the Patient in-bundle. Encounter is the anchor for downstream Observation + Procedure records.
statusclass.codesubject.referenceperiod.{start,end}Observation
several per EncounterVital signs + core lab results coded against the priors-backed LOINC panel (every code carries a published adult reference-range prior — a code without a numeric prior is refused, never faked). Values drawn from Gaussian priors, emitted as valueQuantity with the UCUM system URI (http://unitsofmeasure.org). effectiveDateTime always falls inside the parent encounter's period.
code.coding[LOINC]valueQuantity.{value,unit,system}effectiveDateTimesubject.referenceencounter.referenceCondition
a few per PatientICD-10-CM diagnosis codes from the full US diagnosis catalogue (CMS public domain). clinicalStatus + verificationStatus tracked as CodeableConcept with required-binding terminology. Every Condition.subject resolves to a Patient in the same bundle — zero orphan rows by construction.
code.coding[ICD-10-CM]clinicalStatusverificationStatussubject.referencerecordedDateMedicationRequest
a few per PatientRxNorm-coded medication orders drawn from the shipped Semantic Clinical Drug catalogue — 17k+ real dose-form products (NLM public domain) behind a frequency-weighted common-drug head. intent=order, status=active|completed|stopped, authoredOn within a bounded lookback, subject.reference to a Patient. No free-text drug names — every medication carries a real CodeableConcept with the NLM system URI.
medicationCodeableConcept[RxNorm]intentstatussubject.referenceauthoredOnAllergyIntolerance
occasional per PatientCategory weighted by US population prevalence. clinicalStatus=active, verificationStatus=confirmed, criticality (low / high). Patient-scoped; every record carries patient.reference to the in-bundle Patient.
categoryclinicalStatusverificationStatuscriticalitypatient.referenceProcedure
occasional per EncounterEncounter-anchored procedure records with status=completed, performedPeriod aligned to the parent Encounter's period, subject + encounter references both resolved in-bundle. Every Procedure's encounter reference points to an Encounter that actually exists — RI enforced at generation time.
statusperformedPeriodsubject.referenceencounter.referenceImmunization
per clinical priorsCVX-coded vaccine administration covering the common US schedule (flu, COVID-19 mRNA, Tdap, MMR, HPV, pneumococcal, …). occurrenceDateTime drawn from a recent immunization window so timelines remain realistic against current schedules. status=completed, primarySource=true.
vaccineCode.coding[CVX]statusoccurrenceDateTimepatient.referenceprimarySourceEvery code system, every licence, shipped scope.
Synthetic-data vendors love to say “clinical vocabularies supported” without naming any. Here's the full list, with shipped scope and the licence posture for each.
| System | Codes | What it covers | Licence | Shipped |
|---|---|---|---|---|
| LOINC | large | Top-ordered laboratory + vital-sign codes | Regenstrief (free, Section 10 attribution) | in image |
| RxNorm | broad | Ingredient, clinical-drug, and branded-drug RxCUIs | NLM public domain | in image |
| ICD-10-CM | full | Complete US diagnosis catalogue | CMS public domain | in image |
| CVX | standard | Common US-schedule vaccine codes (flu, COVID-19 mRNA, Tdap, MMR, HPV, pneumococcal, …) | CDC public domain | in image |
| UCUM | full | Units of measure for Observation.valueQuantity | Regenstrief (free) | in image |
| SNOMED CT | BYO | Operator registers their own affiliate-licensed subset at startup | IHTSDO affiliate (customer's own) | BYO |
| WHO ICD-10 | roadmap | International diagnosis coding — v1.2 via region=who | WHO (free) | roadmap |
| NHS dm+d | roadmap | UK medication dictionary — v1.2 via region=uk | NHS England (free) | roadmap |
Six architectural commitments.
Separating RadMah AI FHIR from any script that strings JSON together: every commitment below is enforced in code at generation time, not asserted in marketing copy.
100% referential integrity by construction
Every Observation.subject, Condition.subject, Encounter.subject, MedicationRequest.subject, AllergyIntolerance.patient, Procedure.subject, Immunization.patient, and Procedure.encounter resolves to a resource in the same bundle. Cross-entry references are enforced at generation time, not patched at validation. A FHIR server that strict-validates references on ingest accepts every bundle we emit without parsing errors.
Two-stage validator gate, no Java runtime
Stage 1: an in-house structural validator checks cardinality, required fields, and cross-entry resolution. Stage 2: every resource is round-tripped through a Python-native FHIR-R4 datatype validator derived from the official HL7 FHIR R4 profiles. A bundle failing either gate raises an explicit generator-time error — no mal-formed output ships. Zero dependency on the HL7 Java runtime stack.
Replay-deterministic fingerprint per bundle
Every bundle carries a deterministic fingerprint computed from (seed, anchor date, resource counts, generator version). Two calls with the same rows and seed produce byte-identical bundles: same resource IDs, same birthDates, same lab values (UCUM-normalised), same medication lists, same immunisation dates. Re-running the same seed on a different cluster yields the same fingerprint — reproducibility is a property of the generator, not a claim shipped alongside it.
Free-to-redistribute terminology, shipped in-image
A large LOINC subset ships under the Regenstrief LOINC licence with Section 10 attribution carried verbatim in LOINC_short_license.txt. A broad RxNorm set and the full US ICD-10-CM catalogue ship under NLM / CMS public domain. Every terminology file is hash-pinned at image build time so supply-chain integrity is auditable. Zero paid licences bundled; zero runtime phone-home.
SNOMED stays BYO-licence
RadMah AI never ships SNOMED CT content. Operators with a current UMLS account or SNOMED International affiliate licence register their codes at process startup through the SDK; the registry lives in tenant memory only, is re-loaded on every restart, and never persists to our storage. This keeps RadMah AI in compliance with SNOMED's IHTSDO affiliate licence terms in every jurisdiction.
Global code systems on the v1.2 roadmap
WHO ICD-10, WHO ATC, NHS dm+d, and ICD-O-3 land behind a region selector in v1.2 (us | uk | eu | who). Today's ship is US FHIR R4 — the scope advertised in the platform documentation. When the region selector lands, existing bundles stay byte-stable; the selector only affects new generations.
The questions auditors actually ask.
Generated from no patient records
The from-scratch FHIR path accepts no dataset at all — there is no input for patient data to arrive through. Every Patient resource is derived from a seed, a requested patient count and demographic parameters you choose. Names, medical record numbers, birth dates and addresses are minted by the generator, and MRNs are issued on a RadMah-owned identifier system that cannot collide with a real assigning authority. Whether the output falls inside or outside a particular privacy regime is your determination to make, with your counsel — we describe what the generator does, not how a regulator will classify it.
Audit trail via the sealed evidence bundle
Every generation run produces a cryptographically-sealed multi-artefact evidence bundle: the sealed contract input, the evidence record, the determinism proof, the per-resource artefact index with hashes, a constraint report, a privacy report, a utility report, run telemetry, and a seal that hashes the other artefacts together. Download a real example from /platform/evidence. Auditors verify the bundle offline with the shipped verifier.
What we can tell your privacy team
Two facts, both checkable in the product: the from-scratch generator reads no source records, and every run ships an evidence bundle recording the contract, the seed, the validator results and the artifact hashes. That is the input to your DPIA, not a substitute for it. A DPA remains in place for the control-plane metadata RadMah processes as your processor. Learned synthesis from your own healthcare data is a different path with a different analysis — see Synthesize.
Evidence a validated system can consume
Each run emits a determinism report, an artifact index with per-artifact hashes, and a seal binding them together — an integrity record your validated system can reference and re-check offline. Deterministic regeneration makes a stable anchor for a test plan. Qualifying RadMah inside your validated environment remains your process; we supply the evidence, not the qualification.
Who buys synthetic FHIR, and why.
Healthcare ML training sets
Train readmission-risk, sepsis-onset and medication-adherence models on synthetic patient timelines generated without source patient records. Seeded generation means the experiment notebook is reproducible across institutions — a collaborator reruns the same contract, seed and generator version and gets byte-identical resources. What review your institution requires remains its call.
FHIR server load + conformance testing
Drive millions of known-conformant bundles against your FHIR server to stress-test ingest, search, and query paths. Every bundle passes the R4 validator, so failures are unambiguously server-side. A reproducible input stream means regression tests are diffable.
EHR integration CI fixtures
Ship deterministic test bundles with your integration: every replay produces the same Patient IDs, same Observation values, same Condition timelines. Your CI becomes diffable because the input side is frozen by the contract hash.
Regulatory submissions + audit datasets
Give auditors the exact data your pipeline processed, generated without source patient records. The evidence bundle carries the hash chain, the LOINC Section 10 attribution, and the evidence record — the audit trail is self-contained and verifiable offline.
Clinical-trial data-sharing packages
Ship synthetic cohorts to collaborators with the sealed contract that produced them. A collaborator regenerates byte-identical data locally from the same contract, seed and engine version via the SDK, so the contract can travel instead of the dataset.
Medical-device software validation (IEC 62304)
Deterministic test vectors for medical-device software classes A / B / C. The replay-deterministic fingerprint is the anchor for your V&V traceability matrix — the same bundle flows through the test harness, the regression suite, and the FDA submission package without drift.
See how evidence works before you write a line of code.
Every FHIR bundle is emitted with the same sealed evidence record as every other engine on the platform. Walk through an example on /platform/evidence — contract, per-step proof packets, quality gate, sealed hash — or install rady and verify a sample bundle from your terminal in under a minute.
Ship a FHIR bundle in the time it takes to read this page.
Every job carries the same multi-artefact evidence bundle as every other RadMah AI engine. No Java runtime, no SNOMED licence trap, no PHI ever touches the pipeline. Free tier starts at 25 credits / month — enough for 25 million FHIR resources on the tabular rate card.
RadMah, Inc. is a Delaware corporation and a wholly owned subsidiary of ITLOX, Inc. The Enterprise self-hosted package runs the full RadMah stack inside the customer's own network — a Docker / Helm image signed with an RSA-PSS enterprise licence.