Sentinel is a dependency-free, pure-stdlib regex de-identifier that runs in front of every Ardia model and redacts a fixed list of delimited or label-anchored structured identifiers (dashed SSN, delimited phone, email, labelled MRN, member ID, US-format dates, context-gated ZIP); it has zero measured accuracy on any de-identification corpus, misses undelimited and ISO-formatted variants of several of those same identifiers, and does not detect personal names at all in the production path.
Platform / Governance - foundational, inherited by all five pillars (precision medicine; molecular and genomic diagnostics; the 2027 PAMA rate cliff; pulmonary and respiratory care; elder care) plus ToxIQ. Sentinel is not a pillar product; it is intended to become the privacy precondition for all of them. Today it does not reach that bar: because personal names survive, its output does not meet 45 CFR 164.514(b) Safe Harbor and remains PHI, so Sentinel cannot by itself make customer data lawfully processable. Ardia has 0 signed BAAs and 0 signed DUAs, so no lawful basis for real customer data exists by any route at present.
The code is shipped and a live probe of https://www.ardiahealthlabs.com/api/run returns a Sentinel block, so it is genuinely in the production request path. But its maturity as a compliance control is modelled target, not live demo: zero measured accuracy on any de-identification corpus - no precision, no recall, no F1, on i2b2/n2c2 or anything else - and a known, unfixed name-detection gap. Integration is a fact about wiring; maturity for a compliance control is set by measured performance, of which there is none. Any site page grading it "modelled target" is correct and should stand; only wording that says pipeline integration is "in progress" is out of date on the narrow question of wiring. The company reports a passing test suite (34/34, company-reported). That figure has NOT been independently verified here: no repository clone, no test execution, no commit hash and no CI run has been confirmed by this review, and test counts prove nothing about de-identification accuracy in any case.
Sentinel is not in the engine map at all - it is the pure-Python preprocessor that runs in front of all four engine paths before Gemini is called. Stated plainly, because it matters for every downstream claim: ENGINE_MODEL in studio.html is {molec:'molec', toxiq:'molec', pulmo:'tara', meridian:'tara', aria:'aria', lumen:'lumen'} - ten named models collapse to FOUR engine paths. ToxIQ runs MolecuIQ's prompt; PulmoIQ and Meridian both run TARA's. Those are framings over a shared engine, not separately trained models. Posting model:"pulmo" directly to the API returns {"error":"bad_model"}; the UI works only because it rewrites pulmo to tara before sending. One consequence is the strongest technical risk in the company: a single prompt regression, or one silent roll of an unpinned "-latest" alias, degrades three products at once, with no eval harness to detect it. Sentinel's own single-point-of-failure exposure therefore spans all four engine paths. There is also a second, internal sharing problem that must be stated as prominently: the Crucible de_identification OUTPUT gate calls the SAME deidentify() function used on the input. The output check is not independent verification - it is the same regex asked the same question twice, so anything the input pass cannot see the output gate is mathematically guaranteed not to see either. On probe, a prompt containing a plain personal name produced an answer containing that name while the gate returned passed with the reason "no PHI identifiers present". The platform's only PHI-egress check is structurally blind in exactly the dimension where it is weakest.
A US clinical lab, elder-care operator or physician group that wants an AI system anywhere near its data hits 45 CFR 164.502(a) before it ever evaluates the AI: a covered entity may not disclose PHI to a business associate without a signed BAA, and a BAA with an AI vendor pulls that vendor's model provider - here Google - in as a subcontractor needing its own BAA, behind a full Security Rule program. For a seed-stage vendor with no SOC 2, no HITRUST, 0 signed BAAs and $0 raised, that path means an enterprise security review a company of this size is poorly positioned to survive. Ardia has never been through one - 0 customers, 0 pilots - so no cycle-time figure should be asserted. The escape hatch is real and well-worn: data de-identified under 164.514(b) is no longer PHI and needs no BAA; one rung less strict, a Limited Data Set under 164.514(e) needs only a Data Use Agreement, which a Privacy Officer can sign without convening a security committee. Sentinel exists to be that hatch. The pain lands at three moments. (1) A molecular lab's compliance director is handed a vendor security questionnaire asking whether patient data leaves the four walls; if the honest answer is yes-to-Google, the project dies in committee. (2) A MolDX prior-authorization appeal for CPT 81479 or PLA 0016M must be assembled: the Z-code, ICD-10 and LCD citation are what the model needs; the name, DOB, MRN and member ID surrounding them are what it must never see. (3) An Aria elder-care transcript is spontaneous speech - "my daughter Karen is picking me up Tuesday" - with no structured field to strip. On inspection of what its rules actually match, Sentinel is best aimed at (2). It has no measured performance on that or any substrate, does not survive (1) if a skeptic reads the code, and does not address (3) at all.
Sentinel has no economic buyer, and pretending otherwise is the fastest way to lose a diligence conversation. Nobody in US healthcare carries a line item for a de-identification kernel; it is a gate-clearer, not a purchase. The map that matters is who can kill a deal, not who signs a cheque. The cheque for what Sentinel enables is signed by the CFO or VP of Revenue Cycle Management at an independent molecular or toxicology lab (MolecuIQ, ToxIQ, Meridian), or the COO or VP of Clinical Operations at a senior-living or home-health operator (Aria, Cadence). The roles Sentinel is built for are legally mandated designations: the HIPAA Privacy Officer, whom a covered entity must designate under 45 CFR 164.530(a)(1), and the Security Official under 164.308(a)(2), joined by General Counsel and, in a CLIA lab, the Laboratory Director under 42 CFR 493.1441, who owns result integrity and will ask whether redaction can corrupt a reportable result. How those roles are staffed at a mid-sized lab, and how often a HECVAT, a Shared Assessments SIG Lite or a HITRUST e1/i1 request is the gating artifact, is founder hypothesis drawn from prior payer and provider experience (Cigna, Teladoc, ECFMG, UnitedHealth/Optum) - it has not been validated by customer discovery. Ardia has spoken to 0 customers and run 0 pilots. The end user of Sentinel is nobody: it is invisible middleware, and the humans in the loop are the billing analysts and appeals writers using the pillar products. The practical sales artifact is therefore not a demo but a completed security questionnaire. Sentinel's job is to let Ardia answer "no identifiers are transmitted to a third-party model." Today, because plain names pass through, Ardia cannot truthfully answer yes. That is the most commercially consequential fact here.
Sentinel has no clinical domain of its own; its domain is the document substrate of the five pillars, and the shape of that substrate decides whether it works. Molecular and genomic diagnostics: the requisition and NGS report - an 81479 unlisted molecular pathology claim, a PLA code such as 0016M, a MolDX DEX Z-code, an ICD-10-CM justification, the ordering physician's NPI. The clinical payload is codes and variant nomenclature (HGVS, ClinVar, ACMG-AMP tiers); the identifiers are name, DOB, MRN, member ID. A company-reported unit test asserts that a five-digit CPT code is not redacted as a ZIP; this review did not execute it, and sound design intent is not evidence of code-set preservation on real requisitions. Toxicology (ToxIQ): definitive urine drug testing reports (80305-80307, G0480-G0483), which carry 42 CFR Part 2's stricter-than-HIPAA consent regime for substance-use records - Sentinel has no Part 2 awareness whatsoever. Pulmonary (PulmoIQ): PFT and spirometry reports, GOLD grades and groups, GINA steps, free-text impressions carrying the pulmonologist's name. Required disclosure: pulmonary answers are grounded in retrieved PubMed literature - a live probe returned PMIDs 40050074 and 38032494 with working links - but a curated GOLD/GINA guideline corpus is not built. Elder care (Aria, Cadence): the hardest substrate in the portfolio, conversational speech where patient names, relatives' names, facilities and street addresses appear constantly with no delimiters and no labels. PAMA and Meridian: 837P claim data and 835 remittance, the most structured substrate Sentinel has. Required disclosure: deterministic CLFS/PAMA arithmetic exists in models/meridian/clfs.py and is mirrored by a client-side calculator, but it is not wired into the Studio answer path - a Meridian question in the Studio is answered by Gemini reasoning as TARA. The expected pattern, inferred from the regex set and not measured: Sentinel should degrade as text becomes less structured, since every rule it has is a delimiter pattern or a label anchor.
End to end. (1) INPUT: a POST to /api/run carrying text, model, grounding tier and attachments. Text is capped at 6,000 characters (company-reported constant) - an input-size limit that bounds exposure, not an implementation of the 164.502(b) minimum-necessary standard, which concerns the scope and purpose of a disclosure rather than its length. An optional shared-secret gate exists; production returns gated:false, so the endpoint is open in front of a paid API key. (2) ATTACHMENTS: image, X-ray and MRI analysis does not work and is disabled in two independent places - the API returns {"error":"uploads_disabled"} for any attachment, and studio.html hardcodes attachments:[], so a chosen file is read to base64 and then discarded. The system explains imaging report text; it never analyses an image. Refusal is right, since Sentinel cannot redact pixels or DICOM metadata. (3) SENTINEL: ordered, most-specific-first regexes replace hits with category tags such as [REDACTED:ssn]; label-anchored patterns require a digit inside the captured token so ordinary words survive; ZIP is context-gated on a preceding state abbreviation or a "zip" label. A name roster parameter exists in the function signature, but no production caller supplies one, so the name branch never executes. (4) RETRIEVAL runs after de-identification, so outbound PubMed, ClinicalTrials and CMS queries carry redacted text only; a public-citation allowlist keeps cms.gov and PubMed links intact. That allowlist's behaviour against hostname-confusion inputs has not been independently tested here. (5) REASONING: redacted text plus a grounding block goes to Google Gemini - gemini-flash-lite-latest on the fast tier, gemini-flash-latest on Scholar. Not Claude. (6) GATES: six deterministic gates - non_diagnostic, safety_escalation, scope_of_practice, de_identification, honesty, human_in_the_loop - return with a reason on every call, and a failed gate withholds the answer entirely, verified on production; the answer is not returned in redacted form. Cite-or-abstain and policy-override are enforced in retrieval and answer-binding and are not counted as gates. (7) AUDIT: counts and categories only, plus a hash of already-redacted text.
What enters: free text up to 6,000 characters typed or pasted into the Studio. Attachments enter nothing - they are disabled at the API and discarded in the browser. What is verified to redact: structured identifiers. On a single synthetic probe sentence the endpoint returned a Sentinel block reporting a small number of removals across categories including ssn, mrn, phone_or_fax, email, date, geo_zip and age_over_89. Treat that as one observation on one crafted input, not a coverage profile: there is no rate, no denominator and no corpus behind it. What is verified not to redact, and therefore reaches Google Gemini in cleartext: plain personal names in any position. "John Smith" reached the model on probe. The miss list below is derived from inspection of the rule set and single examples rather than from evaluation, and should be read as such: ISO-8601 dates such as 2019-03-14, which is the format every LIS and FHIR payload actually uses; undelimited SSNs and undelimited ten-digit phone numbers; street addresses, despite 164.514(b)(2)(i)(B) naming street address explicitly while the category map only ever claims geo_zip; "medical record number" spelled out rather than abbreviated; bare "Age: 91"; lab accession numbers; NPI and TIN. What returns to the caller: the answer, a sentinel block with counts and categories, six gate verdicts, a crucible summary, and retrieved sources - a molecular probe returned CMS LCD L35025 with a working cms.gov link. What does not exist: any persistent record. The audit trail is an in-process bounded deque with no durable sink inside a cold-starting serverless function; it evaporates. One further observation, reported as a hypothesis rather than a finding: in a single instance the model's answer appeared to condition on the leaked name, inferring sex from it. That is anecdotal, unreproduced, and separately warrants review against the non-diagnostic guardrail.
The governing instrument is 45 CFR 164.514(b)(2)(i)(A)-(R), the Safe Harbor enumeration of 18 identifiers. The code reportedly contains an 18-key map of those categories, each tagged regex, roster or out-of-scope (company-reported; not verified here). That is a coverage taxonomy, not coverage. The name category is roster-dependent and the production caller passes no roster, so names are unhandled; street address is not implemented at all. The map should be read as a to-do list, not a scorecard, and never scored 18/18. Adjacent instruments: 164.514(b)(1) Expert Determination, requiring a qualified statistician's documented risk determination - Ardia has not pursued it; 164.514(e) Limited Data Set plus DUA, which permits dates and ZIP to remain and is strategically the right target; 164.312(a)/(b)/(d)/(e) technical safeguards; 164.308(b) BAAs; 164.400-414 breach notification. Beyond HIPAA: 42 CFR Part 2 for substance-use records, directly relevant to ToxIQ and entirely unimplemented; Texas HB 300 and Health & Safety Code Ch. 181; Texas SB 1188 data residency; TRAIGA (HB 149); GINA and state genetic-privacy statutes. Code sets Sentinel must preserve rather than redact: CPT/HCPCS, PLA codes, MolDX DEX Z-codes, ICD-10-CM, LOINC, SNOMED CT, NCD and LCD identifiers, NCCI/MUE edits, CARC/RARC denial codes, CLFS/PAMA rates, GOLD/GINA staging, NCCN and CPIC references. Company-reported unit tests cover a small number of these; the over-redaction rate across the full code-set surface is unmeasured, exactly as the under-redaction rate is. Transport standards where identifiers actually live and which Sentinel does not parse: X12 837P NM1IL and NM1QC, DMG, N3/N4, REF*EA; HL7 v2.5.1 PID-3/5/7/11/19; FHIR R4 US Core Patient; DICOM PS3.15 Annex E. The field's accepted yardstick, i2b2/UTHealth 2014 (n2c2), has not been run.
The architectural decision that determines whether Sentinel is a product or a liability: it must run inside the customer's trust boundary. If PHI has to travel to Ardia's cloud to be de-identified, the customer needed a BAA anyway and Sentinel has bought nothing. Today Sentinel runs in Ardia's serverless function, which is the wrong side of the line - defensible for a synthetic demo, indefensible for a pilot. The remedy is structurally available: Sentinel is a small pure-stdlib Python module with zero dependencies, which makes it shippable as a customer-side artifact - a pip-installable package, a distroless container in the lab's VPC, a function in the customer's own cloud account, or a sidecar in front of the interface engine. Zero dependencies is a genuine asset in that setting: no supply-chain review, no CVE surface, and a security team can read the whole thing quickly. Landing points in a real customer: LIS - Sunquest, Oracle Health PathNet, Epic Beaker, Orchard Harvest, LabWare, STARLIMS, Clinisys; lab RCM - Xifin RPM, Telcor; EHR - Epic, Oracle Health, Meditech, athenahealth, eClinicalWorks; clearinghouses - Availity, Optum, Waystar, Office Ally, Inovalon. Wire formats: X12 837P/837I, 835, 270/271, 278, 275; HL7 v2.5.1 ORU^R01 and ORM^O01 through Mirth, Rhapsody or Corepoint; FHIR R4 US Core with SMART on FHIR; and PGP-encrypted SFTP batch drops, still the most common lab integration in practice. The concrete gap: Sentinel is a free-text function. It has no X12 segment parser, no HL7 PID handler, no FHIR Patient stripper. For structured formats the right approach is not regex at all but schema-driven field suppression - blank NM1IL, DMG, N3/N4, REFEA; blank PID-3/5/7/11/19 - which is more reliable and easier to build than pattern matching. That path does not exist yet, and for the PAMA and molecular-billing pillars it is arguably the better first build.
Blunt version. Honest zeros, unchanged: 0 customers, 0 pilots, 0 signed BAAs or DUAs, $0 revenue, $0 raised, no real patient data ever processed, no clinical outcomes. Founded December 2025, Dallas-Fort Worth. For Sentinel specifically there is zero measured accuracy - no precision, no recall, no F1, on i2b2/n2c2 or any other corpus. Not a weak number; no number at all. What is company-reported and not independently verified here: the existence and contents of the repository, the Sentinel unit-test file, CI configuration, and the "34/34 tests passing" figure. This review did not clone the repository and did not execute any test, and no commit hash or CI run has been confirmed. Test counts prove nothing about de-identification accuracy in any case. What is verified by live probe: GET /api/run returns {"ok":true,"provider":"gemini","gated":false}, independently confirming the engine is Google Gemini and not Claude, and confirming the endpoint is ungated; a POST returns a sentinel block, so Sentinel is genuinely in the production request path; structured identifiers redact; a prompt containing a plain personal name reached the model while the de_identification gate returned passed with the reason "no PHI identifiers present". What is falsified: any site copy grading "no PHI in prompts or logs" as enforced. Across the platform only two things are measured, both company-reported and not independently reproduced: Cadence at 95.45% held-out macro-F1, subject-independent, on the public UCI HAR dataset - which is a human-activity classifier, not a fall detector, and unrelated to Sentinel - and Meridian's unit-tested CLFS arithmetic. The one-line evidentiary summary: Sentinel's tests, as reported, would show the code does what its author intended on examples its author chose. Nothing shows what it does on text the author did not anticipate.
The goal is one honest number, published whatever it says. GOLD SET: the i2b2/UTHealth 2014 de-identification corpus (n2c2), 1,304 clinical records with gold-standard surrogate PHI annotations, obtainable under a click-through DUA from the Harvard DBMI portal. It is externally labelled, which removes the founder as labeller - the biggest credibility problem with any internally scored evaluation. A second, Ardia-built set is needed for the opposite error: 500 synthetic requisition and denial-letter narratives seeded with CPT, HCPCS, PLA, Z-codes, ICD-10, LOINC and LCD identifiers that must survive. Those must be double-labelled - Manasa Jampani adjudicating billing text, Dr Sireesha Mamillapalli the clinical text - with inter-rater disagreement reported, not silently resolved. DENOMINATOR: PHI token instances, per category, not documents. Roughly 456 name instances gives a 95% confidence half-width of about two points at a recall near 0.95; i2b2 2014 is over-powered for that. COMPARATOR: Microsoft Presidio in its default configuration, run on the identical corpus by the same script on the same machine. Presidio is free, so it is the only honest baseline - beating nothing is not a result. PRE-REGISTERED PRIMARY METRIC, fixed before the first run: token-level recall on personal names. Secondary: recall on the full structured-identifier set, and over-redaction rate on the code-set corpus, where any redacted CPT, Z-code or LCD identifier counts as a failure. KILL CRITERIA, stated in advance. First: if Sentinel with name detection cannot reach 0.95 name recall and 0.98 structured-identifier recall while over-redacting under 1% of code-set tokens, and Presidio out-of-the-box beats it on the same corpus, then Sentinel does not work as a de-identification engine and should be retired to a thin healthcare-policy wrapper around a third-party detector. Second, for the gate: on a red-team set the independent output detector must catch at least one leak the input pass missed. If it catches zero because it is the same function, it is not a gate and must not be described as one.
Everything below is reproducible by a skeptic in under fifteen minutes, using synthetic identifiers only. (1) The engine is Gemini, not Claude: GET https://www.ardiahealthlabs.com/api/run returns {"ok":true,"provider":"gemini","gated":false}, which also proves the endpoint is currently ungated. The fast tier reports model_id gemini-flash-lite-latest in about three seconds; the Scholar tier reports gemini-flash-latest in about fifty-four. Neither id is pinned - both resolve "-latest" aliases, so the served model can roll forward silently. (2) Sentinel is really in the production path: POST a synthetic note and read the returned sentinel block of counts and categories. (3) The name gap and the circular gate, in one request: POST a synthetic note containing a plain name alongside a dashed SSN, a labelled MRN, a delimited phone number, an email, a US-format date and a state-plus-ZIP, and observe three things at once - the structured identifiers are stripped, the plain name appears verbatim in the returned text, and the crucible summary reads six of six passed with the de_identification gate's reason field saying no PHI identifiers present. (4) Ten named models are four engine paths: read ENGINE_MODEL in studio.html - molec and toxiq both map to molec, pulmo and meridian both map to tara. POST model:"pulmo" directly to the API and it returns {"error":"bad_model"}; the UI works only because it rewrites pulmo to tara first. (5) Imaging does not work: attach any file and the API returns {"error":"uploads_disabled"}, and studio.html hardcodes attachments:[] regardless. (6) Retrieval is real: a molecular query returns CMS Local Coverage Determinations such as L35025 and L38045 with working cms.gov links; a pulmonary GOLD/COPD query returns PubMed citations including PMIDs 40050074 and 38032494. What that proves is PubMed literature retrieval, not a curated GOLD/GINA corpus. (7) Read the HIPAA controls matrix: fifteen controls, two self-graded enforced. It is the most honest artifact the company has.
Stated plainly: Sentinel is a short list of ordered regular expressions with a HIPAA-shaped label on it. That is the whole artifact. (1) Names are not redacted at all in production - not imperfectly; the roster branch requires a caller-supplied list and no production caller supplies one, so every patient name typed into the Studio reaches Google. Verified. (2) The de_identification output gate calls the same function as the input pass, so it provides zero independent assurance: anything the input misses, the output gate is mathematically guaranteed to miss. On probe it returned passed with "no PHI identifiers present" on an answer containing a plain name. A guardrail that certifies leaked PHI as clean is worse than none: it manufactures documented false assurance. (3) Inspection-level gaps beyond names: ISO-8601 dates untouched, which makes the date rule near-useless on machine-generated text; undelimited SSNs and phone numbers; street addresses; bare ages; accession numbers, NPIs and TINs. (4) A Safe Harbor ZIP defect: the three-digit prefix is always retained, but 164.514(b)(2)(i)(B) requires zeroing it for the roughly 17 restricted ZIP3 areas. (5) Over-redaction runs the opposite way: dates are destroyed including the year, so turnaround time, age at diagnosis and PAMA period math become uncomputable. (6) No pseudonymisation, so longitudinal linkage is impossible - close to disqualifying for lab analytics and exactly what Datavant built a company on. (7) No X12, HL7, FHIR or DICOM support. (8) The audit trail is in-memory and evaporates on cold start; 164.312(b) is not satisfied by memory that vanishes. (9) The production endpoint is ungated in front of a paid key. (10) Residual re-identification risk persists even at perfect compliance: rare-disease and occupational context identifies with no listed identifier present. (11) Bus factor of one: the sole engineer owns the privacy kernel all five pillars inherit, and Ardia has named no internal Privacy or Security Official. (12) Zero measured accuracy, which subsumes the rest.
Ardia's position, consistent with its platform-wide non-diagnostic posture, is that Sentinel makes no clinical claim and is not a device: it removes character sequences from text. It does not reach the four-part non-device CDS analysis under FD&C Act 520(o)(1)(E) and FDA's September 2022 Clinical Decision Support guidance, because it analyses nothing clinical. No FDA determination has been sought and no outside regulatory counsel opinion is cited; this is the company's stated position, not a legal conclusion. The real regulatory exposure runs the other way, toward HHS OCR rather than FDA. Under 164.514(b)(2), Safe Harbor is achieved only if all 18 identifier categories are removed and the entity has no actual knowledge that residual information could identify the individual. A process that leaves names intact does not partially achieve Safe Harbor; it achieves nothing. The output remains PHI. This is binary. The honest posture is therefore that Sentinel is a risk-reduction tool that does not meet the standard it is named after, and any internal controls matrix grading 164.514(b)(2) "enforced" is not supportable and should read "partial" until names are handled. Credit where due: that controls matrix is self-graded 2 of 15 enforced, with encryption-at-rest and BAAs marked baa_required and access control, authentication, incident procedures and contingency planning marked planned. CLIA (42 CFR 493) does not reach Sentinel, though a Laboratory Director will still ask whether redaction can corrupt a reportable result; the answer is that Sentinel touches only the copy sent for reasoning. Texas HB 300 imposes stricter-than-HIPAA duties with state AG enforcement. Texas SB 1188 imposes US data-residency obligations: the hosting region of the Gemini endpoint and the serverless functions in use has not been verified, and with 0 signed BAAs and no data-processing addendum specifying region, residency is neither confirmed technically nor guaranteed contractually. It is an open obligation. TRAIGA attaches to the AI system Sentinel guards.
"Non-diagnostic" does not dissolve liability; it moves it from FDA to CMS, OIG and contract law, which for a lab billing product is the harder surface. Trace the pathway. Sentinel sits upstream of appeal drafting. All six gates can pass and the output still be wrong: a mis-scoped LCD, a citation that exists but does not support the assertion, or an argument built on a date the redactor destroyed. That draft becomes a CMS redetermination request signed by a human who attests the information is true and complete. The attestation is the transfer of liability. If the resulting claim is not supportable, exposure runs to the False Claims Act at 31 USC 3729, whose knowledge standard reaches reckless disregard rather than requiring intent - and definitive urine drug testing, ToxIQ's substrate, is a named OIG enforcement priority. Payers have begun flagging AI-drafted appeals, converting an efficiency story into an adverse-inference story. Ask the practical question: can a compliance officer running a seven-element program, whose auditing element requires documented effectiveness, permit an unvalidated AI tool into the appeal workflow at all? With zero measured accuracy, the defensible answer is no. Sentinel adds a second, distinct exposure that is its own: shipping a control named after Safe Harbor that does not meet Safe Harbor. Because names survive, the output remains PHI, and the circular output gate produces a written record asserting the data was clean. Under 45 CFR 160.404 that documented false assurance argues toward the wilful-neglect tier rather than away from it, and it is discoverable in the company's own repository. Where does indemnification sit? Nowhere. Ardia has 0 signed BAAs, 0 DUAs and no customer contract of any kind, so no limitation of liability, no indemnity, no insurance requirement and no breach-notification allocation has ever been negotiated. The first contract Ardia signs sets all of it, and should be drafted before a pilot, not during one.
The strategic move is to stop chasing Safe Harbor and chase the Limited Data Set. Under 164.514(e) an LDS may retain all dates and city, state and ZIP; it must strip names, street address, phone, email, SSN, MRN, health-plan number, account, licence, vehicle, device, URL, IP and biometrics. That is strictly easier than Safe Harbor, it preserves the date fields PAMA and Meridian analytics need, and it requires only a DUA rather than a BAA. Sentinel is currently mis-aimed for that target: it over-redacts dates, which an LDS permits retaining, while not redacting names, which an LDS absolutely requires. Re-aiming the date rules is genuinely small. Adding name detection is not: it is the hardest part of de-identification, it is why the field uses statistical NER rather than regex, and it would introduce the platform's first probabilistic element into its only deterministic control. No effort estimate should be offered until the approach is chosen. To validate, in ascending cost: (1) The i2b2/UTHealth 2014 corpus from the Harvard DBMI n2c2 portal - 1,304 clinical records with gold-standard surrogate PHI annotations, obtainable under a click-through data use agreement. The expectation is that a retrospective evaluation on an already-surrogate-substituted corpus is not human-subjects research, but that determination belongs to counsel or an IRB of record and has not been obtained. Ardia has 0 signed DUAs today, so this is a planned step, not an available one. It would produce the company's first real de-identification number at effectively zero marginal cost; whether it outranks other uses of scarce founder time has not been analysed, and the company has raised $0. (2) Partner-lab validation under an LDS or DUA would be the next step if a partner existed. None does - 0 customers, 0 pilots, no real patient data ever processed - so any corpus size quoted is a design target for a hypothetical engagement. (3) Only then, real PHI under a signed BAA.
Start with the uncomfortable truth: de-identification is not a market, it is a feature, and the standalone opportunity is small because hyperscalers meter it near cost. Sizing, with the reasoning shown rather than an analyst number invented: there are roughly 260,000 CLIA-certified laboratories in the US, but only on the order of 1,500-2,500 independent clinical and molecular labs large enough to buy software; add roughly 6,100 hospitals, roughly 30,000 senior-living communities and roughly 11,000 home-health agencies. If a de-identification capability were sold standalone at $15,000-$40,000 per year to the ~5,000 US healthcare organisations sophisticated enough to want one, at 10% penetration that is about 500 x $25,000, roughly $12.5M. These are order-of-magnitude estimates from public establishment counts, not a sourced bottom-up model, and they are why no venture-scale company sells de-identification alone. The category's real revenue sits with Datavant and IQVIA Privacy Analytics, who monetise Expert Determination as a services engagement and tokenisation for record linkage, which is defensible precisely because linkage survives de-identification. So Sentinel must be priced at zero and valued as a deal-unblocker; its return runs on the buyer's calendar rather than the buyer's budget, because a DUA on a Limited Data Set needs one Privacy Officer signature while a BAA needs a security committee. Ardia has never run either cycle, so no duration is claimed. The downside arithmetic is the number to put in front of a Privacy Officer: HIPAA civil monetary penalties under 45 CFR 160.404 run from roughly $141 per violation at the did-not-know tier to roughly $71,000 per violation for wilful neglect, with annual caps around $2.1M per identical-provision tier - HHS inflation-adjusts these annually, so treat them as approximate and verify the current year. A control believed to keep identifiers out of a third-party model but documented in the vendor's own repository as unable to detect names is worse than none, because it pushes an incident toward the wilful-neglect tier.
Sentinel's own price is $0, stated publicly, and that is a position rather than a concession: it has no economic buyer and every credible alternative is free or metered at fractions of a cent. It should be open-sourced and shipped customer-side. The commercial question is what the pillar product it gates costs. MECHANIC: one per-lab subscription of $2,500 per month - $30,000 per year - for a single pillar module (MolecuIQ, Meridian or ToxIQ), unlimited users, capped at 10,000 model calls per month, Sentinel bundled free. Flat and capped, not per-appeal, because a per-appeal price makes the buyer count AI-drafted appeals - the exact number an OIG auditor would later ask for. COGS: Sentinel itself is regex, so its marginal inference cost is zero. The cost is the Gemini call it fronts. A 6,000-character prompt is roughly 1,500 tokens; with grounding and sources, call it 6,000 input and 800 output. At gemini-flash-lite list pricing near $0.10 per million input and $0.40 per million output tokens, that is roughly $0.0009 - under a tenth of a cent. The Scholar tier on gemini-flash-latest, near $0.30 and $2.50 per million, lands around $0.004. Worst case: 10,000 calls at $0.004 is $40 per month, plus roughly $200 of hosting and retrieval overhead. Gross margin is ($2,500 - $240) / $2,500, about 90%, before support - and support, not inference, is the real cost line. Pricing risk: the model id is not pinned, so a silent roll to a costlier alias moves COGS without a deploy. BUYER ROI: 400 MolDX appeal packets a month at roughly 45 minutes each of a fully loaded $55-per-hour coder is about 300 hours, roughly $16,500 monthly. A 30% time reduction is about $5,000 against a $2,500 fee - 2:1 before any recovered-revenue effect. That fraction is the unmeasured input; measuring it is the job of the first pilot, and no overturn-rate claim should be made until one exists.
Sentinel's competitive position on de-identification quality is weak, and this dossier is worthless if it says otherwise. Free and better today: Microsoft Presidio, MIT-licensed, combining regex recognisers with spaCy or transformer NER, which does what Sentinel does plus names and is pip-installable in one command. NLM-Scrubber, free from the National Library of Medicine, purpose-built for clinical text. Philter from UCSF, published in JAMA Network Open with high reported recall on its own corpus. MIT deid and CliniDeID. Hyperscaler, BAA-covered and metered: AWS Comprehend Medical PHId, HIPAA-eligible under an existing AWS BAA and billed per 100-character unit at fractions of a cent; Google Cloud Healthcare API de-identification with Cloud DLP, which handles text, FHIR and DICOM - the last of which Sentinel refuses outright; Azure Health Data Services de-identification. Commercial specialists: Datavant, IQVIA Privacy Analytics, Tonic Textual, Private AI, Skyflow, Nightfall, John Snow Labs. Several of these publish i2b2/n2c2 precision and recall figures; those are vendor- or literature-reported and not verified here, but the asymmetry is what matters - they have numbers and Sentinel has none, and all of them detect names. The honest question a diligence reader will ask is "why not just use Presidio", and the honest answer is that today there is no accuracy-based reason not to. What Sentinel has that none of them has is co-location with a domain-specific policy engine: it knows 81420 is a CPT code and not a ZIP, it knows a cms.gov URL is a citation rather than an identifier, and it sits in the same pipeline as MolDX and LCD retrieval and the six Crucible gates. Presidio has no opinion about NCD 90.2. That is a real integration advantage and a poor moat. The strategy follows: adopt a published-benchmark detector for entities, keep Sentinel as the healthcare-aware policy, allowlist and orchestration layer, and stop presenting a regex file as a competitive de-identification engine.
Sequenced and deliberately front-loaded with what costs nothing. Week 1 - stop the overclaim. Downgrade every site and controls-matrix grade that reads "enforced" for PHI handling to "partial" until a benchmark exists. This costs nothing and is the highest-integrity move available: diligence that finds the company already self-corrected reads very differently from diligence that finds the discrepancy first. In parallel, plug a name detector into the roster parameter that already exists in the signature, and fix the inspection-level misses - ISO-8601 dates, undelimited SSN and phone, bare ages - and zero the restricted ZIP3 prefixes. Weeks 2-4 - break the circularity. The output gate must not be the input regex. Use a genuinely different detector on egress so a leak requires two independent failures, and state the independence property explicitly. Month 2 - get the number. Request the i2b2/UTHealth 2014 corpus under its data use agreement, run Sentinel against it, and publish precision, recall and F1 per identifier category, including bad results. A published name recall of 0.62 with a credible plan is worth more in diligence than an unmeasured claim of completeness, because it proves the company measures things. Months 2-3 - ship Sentinel across the trust boundary as a pip package and a distroless container, so a lab de-identifies in its own VPC and Ardia never receives PHI. That is what converts Sentinel from liability into the thing that makes a DUA sufficient. Months 3-4 - keyed-HMAC pseudonymous surrogates to restore linkage, and schema-driven suppression for X12 837/835 and HL7 PID. Months 4-6 - a durable append-only audit sink, re-target the control at Limited Data Set under 164.514(e), then SOC 2 Type II readiness. Owner for every item above is the founder, sole engineer; Manasa Jampani can own the payer-side adjudication of billing text, and Dr Sireesha Mamillapalli the clinical review. There is no second engineer, and the schedule should be read with that in mind.
