Healthcare · Platform Engine

HL7 FHIR R4 bundles. Conformant. Deterministic. Zero PHI.

Deterministic FHIR R4 bundles spanning eight resource types with 100% referential integrity by construction. Two-stage structural + datatype conformance gate via a Python-native FHIR validator— no Java runtime required. LOINC, RxNorm, and ICD-10-CM ship in-image under free licences. SNOMED stays BYO-licence. Every bundle carries a deterministic fingerprint and is sealed into the platform's multi-artefact evidence chain.

Start free — 25 credits/moDownload sealed contractTalk to sales →
Zero real PHI ever touchedHL7 FHIR R4 conformant (Python-native validator)100% RI by constructiondeterministic per seedmulti-artefact evidence on every run
Resource types
8
Diagnosis codes
Full US
Lab codes
Large
Medications
Broad

Quickstart

Ship a 100-patient bundle in five lines of Python.

The SDK call below produces a 100-patient Bundle with several hundred encounters and thousands of observations, plus associated conditions, medications, procedures, and immunizations — all referentially-consistent, all deterministic-fingerprinted, all R4-validator-clean.

from radmah_sdk import RadMahClient

client = RadMahClient(api_key="sl_live_...")
seal = client.fabricate_contract(
    description="100 FHIR R4 patients with typical US demographics",
)
job = client.jobs.create(
    seal_id=seal.id,
    kind="synthesize",
    engine="fhir_bundle",
    rows=100,       # the SDK maps rows → patient count for fhir_bundle
    seed=42,
).wait(timeout=60)

bundle = job.to_dataframe()       # pandas-flattened view (optional)
evidence = client.fetch_evidence(job.id)
print("BLAKE3 release seal:", evidence.seal_hash)

Same seed + same seal hash = byte-identical bundle on any machine, in any region, this year or next year. The evidence bundle returned is the same multi-artefact structure you can download from the /verify page — try it before signing up.

What you generate

Eight FHIR R4 resource types — per-field fidelity.

Every bundle is a valid FHIR R4 collection whose entry[] array carries resources in dependency order so cross-entry references resolve at parse time. Below: every field we populate, every code system we bind to, every cardinality we honour.

Patient

1 per Patient

US-Core-profile-compatible Patient with official name (family + given tokens), administrative gender, birthDate, deceased flag, and MRN identifier under a standards-compliant identifier system. PRF-seeded by (seed, patient_index) so every (seed, index) pair yields byte-identical demographics.

name.officialgenderbirthDateidentifier[MRN]deceased

Encounter

a few per Patient

AMB (ambulatory), IMP (inpatient), EMER (emergency), HH (home-health) class codes with US-realistic weights, Period.start + Period.end spanning 15 min – 30 days depending on class, subject reference to the Patient in-bundle. Encounter is the anchor for downstream Observation + Procedure records.

statusclass.codesubject.referenceperiod.{start,end}

Observation

several per Encounter

Vital signs + lab results coded against a large shipped LOINC subset. Values drawn from Gaussian priors anchored to published adult reference ranges. UCUM unit system + correct system URI (``http://unitsofmeasure.org``). valueQuantity / valueString / valueCodeableConcept selected from the LOINC property type.

code.coding[LOINC]valueQuantity.{value,unit,system}effectiveDateTimesubject.referenceencounter.reference

Condition

a few per Patient

ICD-10-CM diagnosis codes from the full US diagnosis catalogue (CMS public domain). clinicalStatus + verificationStatus tracked as CodeableConcept with required-binding terminology. Every Condition.subject resolves to a Patient in the same bundle — zero orphan rows by construction.

code.coding[ICD-10-CM]clinicalStatusverificationStatussubject.referencerecordedDate

MedicationRequest

a few per Patient

RxNorm-coded medication orders from a broad RxCUI set spanning ingredients, clinical drugs, and branded drugs (NLM public domain). intent=order, status=active|completed|stopped, authoredOn, dosageInstruction.timing, subject.reference to a Patient. No free-text drug names — every medication carries a real CodeableConcept with the NLM system URI.

medicationCodeableConcept[RxNorm]intentstatussubject.referenceauthoredOn

AllergyIntolerance

occasional per Patient

Category weighted by US population prevalence. clinicalStatus (active / resolved), verificationStatus, criticality (low / high). Patient-scoped; every record carries patient.reference to the in-bundle Patient.

categoryclinicalStatusverificationStatuscriticalitypatient.reference

Procedure

occasional per Encounter

Encounter-anchored procedure records with status=completed, performedPeriod aligned to the parent Encounter's period, subject + encounter references both resolved in-bundle. Every Procedure's encounter reference points to an Encounter that actually exists — RI enforced at generation time.

statusperformedPeriodsubject.referenceencounter.reference

Immunization

per clinical priors

CVX-coded vaccine administration covering the common US schedule (flu, COVID-19 mRNA, Tdap, MMR, HPV, pneumococcal, …). occurrenceDateTime drawn from a recent immunization window so timelines remain realistic against current immunization schedules. status=completed, primarySource=true.

vaccineCode.coding[CVX]statusoccurrenceDateTimepatient.referenceprimarySource

Terminology inventory

Every code system, every licence, shipped scope.

Synthetic-data vendors love to say “clinical vocabularies supported” without naming any. Here's the full list, with shipped scope and the licence posture for each.

SystemCodesWhat it coversLicenceShipped
LOINClargeTop-ordered laboratory + vital-sign codesRegenstrief (free, Section 10 attribution) in image
RxNormbroadIngredient, clinical-drug, and branded-drug RxCUIsNLM public domain in image
ICD-10-CMfullComplete US diagnosis catalogueCMS public domain in image
CVXstandardCommon US-schedule vaccine administration codes (flu, COVID-19 mRNA, Tdap, MMR, HPV, pneumococcal, …)CDC public domain in image
UCUMfullUnits of measure for Observation.valueQuantityRegenstrief (free) in image
SNOMED CTBYOOperator registers their own affiliate-licensed subset at startupIHTSDO affiliate (customer's own) BYO
WHO ICD-10roadmapInternational diagnosis coding — v1.2 via region=whoWHO (free) roadmap
NHS dm+droadmapUK medication dictionary — v1.2 via region=ukNHS England (free) roadmap

Why it matters

Six architectural commitments.

Separating RadMah AI FHIR from any script that strings JSON together: every commitment below is enforced in code at generation time, not asserted in marketing copy.

100% referential integrity by construction

Every Observation.subject, Condition.subject, Encounter.subject, MedicationRequest.subject, AllergyIntolerance.patient, Procedure.subject, Immunization.patient, and Procedure.encounter resolves to a resource in the same bundle. Cross-entry references are enforced at generation time, not patched at validation. A FHIR server that strict-validates references on ingest accepts every bundle we emit without parsing errors.

Two-stage validator gate, no Java runtime

Stage 1: in-house structural validator checks cardinality, required fields, and cross-entry resolution. Stage 2: every resource is round-tripped through a Python-native FHIR-R4 datatype validator derived from the official HL7 FHIR R4 profiles. A bundle failing either gate raises an explicit generator-time error — no mal-formed output ships. Zero dependency on the HL7 Java runtime stack.

Replay-deterministic fingerprint per bundle

Every bundle carries a deterministic fingerprint computed from (seed, resource counts). Two calls with the same rows and seed produce byte-identical bundles: same resource IDs, same birthDates, same lab values (UCUM-normalised), same medication lists, same immunisation dates. Re-running the same seed on a different cluster yields the same fingerprint — reproducibility is a property of the generator, not a claim we ship alongside it.

Free-to-redistribute terminology, shipped in-image

A large LOINC subset ships under the Regenstrief LOINC licence with Section 10 attribution carried verbatim in ``LOINC_short_license.txt``. A broad RxNorm set and the full US ICD-10-CM catalogue ship under NLM / CMS public domain. Every terminology file is SHA256-pinned at image build time so supply-chain integrity is auditable. Zero paid licences bundled; zero runtime phone-home.

SNOMED stays BYO-licence

RadMah AI never ships SNOMED CT content. Operators with a current UMLS account or SNOMED International affiliate licence register their codes at process startup through the SDK; the registry lives in tenant memory only, is re-loaded on every restart, and never persists to our storage. This keeps RadMah AI in compliance with SNOMED's IHTSDO affiliate licence terms in every jurisdiction.

Global code systems on the v1.2 roadmap

WHO ICD-10, WHO ATC, NHS dm+d, and ICD-O-3 land behind a ``region`` selector in v1.2 (``us`` | ``uk`` | ``eu`` | ``who``). Today's ship is US FHIR R4 — the scope advertised in the platform documentation. When the region selector lands, existing bundles stay byte-stable; the selector only affects new generations.

Compliance posture

The questions auditors actually ask.

HIPAA posture — zero PHI by construction

Every Patient resource is PRF-generated from a seed, never derived from real patient records. Names, MRNs, birthDates, addresses — all synthetic. No training set of real PHI ever touches the generator. HIPAA §164.514 Safe Harbor de-identification is a property of the generator input, not a post-hoc scrub. The bundle is Limited Data Set on arrival.

Audit trail via multi-artefact BLAKE3 evidence bundle

Every generation run produces a cryptographically-sealed multi-artefact evidence bundle: the sealed contract input, the engine manifest, the determinism proof, the per-resource artefact index with cryptographic hashes, a constraint report, a privacy report, a utility report, run telemetry, and a release seal that hashes the other artefacts together. Download a real example from /verify. Auditors verify the bundle offline with the shipped evidence verifier.

GDPR posture — Article 4(1) does not apply

Synthetic data that cannot be re-identified to a natural person falls outside GDPR Article 4(1) “personal data”. The RadMah AI FHIR generator's output is provably not re-identifiable because it was never derived from a real person — there is no re-identification attack surface. DPIAs are simplified; DPAs remain in place for the SaaS control plane metadata.

21 CFR Part 11 — pharmaceutical audit readiness

The BLAKE3-sealed evidence bundle carries the determinism proof + signed engine manifest + timestamp chain required for Part 11 §11.10(c) record integrity. Validation packages (IQ / OQ / PQ) are available to Enterprise customers under NDA; the deterministic-reproducibility property is the core of the OQ test plan.

Use cases

Who buys synthetic FHIR, and why.

  • research

    Healthcare ML training sets

    Train readmission-risk / sepsis-onset / medication-adherence models on millions of synthetic patient timelines without a single IRB submission or BAA. The generator's PRF seeding means your experiment notebook is reproducible across institutions — collaborators rerun the same seed and see the same bundle byte-for-byte.

  • qa

    FHIR server load + conformance testing

    Drive millions of known-conformant bundles against your FHIR server to stress-test ingest, search, and query paths. Every bundle passes the R4 validator, so failures are unambiguously server-side. Reproducible input stream means regression tests are diffable.

  • engineering

    EHR integration CI fixtures

    Ship deterministic test bundles with your integration: every replay produces the same Patient IDs, same Observation values, same Condition timelines. Your CI becomes diffable because the input side is frozen by the contract hash.

  • compliance

    Regulatory submissions + audit datasets

    Give auditors the exact data your pipeline processed, with zero PHI exposure. The multi-artefact evidence bundle carries the BLAKE3 hash chain, the LOINC Section 10 attribution, and the engine manifest — the audit trail is self-contained and verifiable offline.

  • research

    Clinical-trial data-sharing packages

    Ship synthetic cohorts to collaborators with zero re-identification risk, bundled with the sealed contract that produced them. Reviewing collaborators re-generate bit-identical bundles locally via the SDK — no network transfer of synthetic data required once the contract travels.

  • devices

    Medical-device software validation (IEC 62304)

    Deterministic test vectors for medical-device software classes A / B / C. The replay-deterministic fingerprint is the anchor for your V&V traceability matrix — the same bundle flows through the test harness, the regression suite, and the FDA submission package without drift.

See a real bundle before you write a line of code.

A real 10-patient FHIR generation run's multi-artefact BLAKE3-sealed evidence bundle is published as a downloadable at /verify. Release seal 049a97c9… is reproducible offline. No account required.

See the proof

Ship a FHIR bundle in the time it takes to read this page.

Every job carries the same multi-artefact cryptographic evidence bundle as every other RadMah AI engine. No Java runtime, no SNOMED licence trap, no PHI ever touches the pipeline. Free tier starts at 25 credits / month — enough for 25 million FHIR resources on the tabular rate card.

Start for free Talk to sales

Operating entities: ITLOX Ltd. (United Kingdom, Companies House registered) and ITLOX Inc. (Delaware, United States). Enterprise “Data Never Leaves” package runs the full RadMah AI stack inside the customer's own network — Docker / Helm image signed with an RSA-PSS enterprise licence.