Healthcare Compliance

The healthcare-compliance policy is an output-phase policy. It blocks configured medical phrases and prepends disclaimer text when the output looks like medical advice.

Configuration

pack:
  name: healthcare-compliance
  version: 1.0.0
  enabled: true

policies:
  chain:
    - healthcare-compliance

policy:
  healthcare-compliance:
    blocked_patterns:
      - diagnose you with
      - prescribe
      - stop taking
      - surgery is necessary
    required_disclaimers:
      - This is not medical advice.
      - Consult a licensed clinician for diagnosis or treatment decisions.
    fda_class: II

Fields

Field	Type	Description	Default
blocked_patterns	string[]	Case-insensitive substrings that cause an immediate block when found in the output.	[]
required_disclaimers	string[]	Disclaimer lines joined with newlines and prepended when the response looks like medical advice.	[]
fda_class	I | II | III	Used for policy details and for the built-in default disclaimer when required_disclaimers is empty.	II

Behavior notes

• blocked_patterns are plain substring checks, not regex evaluation.
• The built-in advice heuristic looks for terms such as diagnose, treat, prescribe, dosage, take 500 mg, start taking, stop taking, contraindication, and side effects.
• If required_disclaimers is empty, the policy uses one built-in disclaimer based on fda_class:
  • I → General health information only; not medical advice.
  • II → This is not medical advice. Consult a licensed clinician.
  • III → This is not medical advice and must not be used for diagnosis or treatment decisions. Consult a licensed clinician.
• fda_class does not add extra automatic blocking rules beyond your blocked_patterns and the built-in advice heuristic.

Use Cases

Block prescribing language

policy:
  healthcare-compliance:
    blocked_patterns:
      - prescribe
      - increase the dose
      - stop taking
    required_disclaimers:
      - This is not medical advice.

Use class-based default disclaimer

policy:
  healthcare-compliance:
    blocked_patterns:
      - diagnose you with
      - this is cancer
    fda_class: III

How It Works

1. After the upstream model returns a response, the policy lowercases the output text.
2. If any configured blocked_patterns substring is present, the response is blocked.
3. Otherwise, the gateway checks its built-in medical-advice heuristic.
4. If the response looks like medical advice and does not already start with the disclaimer text, the disclaimer is prepended.

Best Practices

• Write blocked_patterns as literal phrases that should never appear.
• Keep disclaimers short because they are inserted verbatim at the start of the output.
• Treat fda_class as a documentation and default-disclaimer setting, not as a substitute for maintaining a good block list.
• Pair with hipaa-phi-detector when patient data must also be redacted or blocked.

Next steps

• HIPAA PHI Detector — Protected health information controls
• Human Oversight — Review and escalation
• PII Detector — Personal-data protection
• Safety Filter — Additional safety controls