As we officially transition from the Alpha phase of our Capstone into Beta development, the focus for MedReachAI is shifting from core functionality to real-world usability and enterprise-grade security.
Over the last few weeks, Collin and I successfully built a backend data intelligence pipeline capable of processing healthcare provider data, identifying statistical anomalies using machine learning, and verifying regulatory compliance against federal databases. But as we map out our next two-week sprint, we are preparing to tackle two massive hurdles: making our AI explainable to human stakeholders, and locking down the system architecture.
The Problem: The "Black Box" of AI
In our latest milestone review, we received fantastic feedback: the underlying architecture works, and the pipeline correctly flags bad data. However, there was a critical piece missing. Stakeholders don't just want to know that a record was flagged; they need to know why.
When an unsupervised machine learning model (like our IsolationForest) outputs a -1 to indicate an anomaly, it creates a "black box" scenario. For a healthcare data steward tasked with managing critical provider directories, seeing a mathematical variance score isn't actionable. If users don’t understand the AI’s decision-making process, they won't trust the platform.
The Solution: "Day in the Life" Walkthrough & Explainable AI
To solve this ambiguity, we are dedicating the first week of this sprint to building an interactive visualization that demystifies the AI pipeline. We plan to engineer a "Plain-Language Anomaly Explanation Generator." Instead of just returning a variance score, our goal is for the backend to dynamically translate the mathematical anomaly into human-readable context (e.g., "Flagged because billing volume is 5x the Cardiology average").
To build and test this feature, I will be writing a Python script to generate a highly curated synthetic dataset. We intend to intentionally inject four distinct "bad data" personas into this batch to test every layer of our pipeline:
The Statistical Anomaly: A provider with massive prescription volumes to test the machine learning model and trigger the future plain-text generator.
The NPI Failure: A deactivated National Provider Identifier to ensure our CMS validation flag catches it.
The Financial Conflict: A provider exceeding the $100 Sunshine Act limit to trigger our local SQLite compliance database.
The Duplicate: An identical record to trigger our Pandas soft-delete flag.
Once this dataset is generating properly, Collin will build out a "Record Detail" UI in React. This will allow us to step through these exact records and visually demonstrate the pipeline's logic to our stakeholders in real-time.
The Problem: Securing Healthcare Infrastructure
The second major hurdle for our Beta release is security. Up to this point, our local environment allowed open communication between our React frontend and FastAPI backend. In a production healthcare environment, leaving endpoints unauthenticated is an absolute non-starter. We need strict access controls to ensure that only authorized personnel can view or manipulate data, and that data from one organization cannot bleed into another.
The Solution: JWT Middleware and RBAC
For the second half of this sprint, my focus will shift entirely to Phase C architecture: Security and Authentication.
I plan to implement a robust Firebase Auth JSON Web Token (JWT) Middleware layer on the FastAPI backend. Every single API request will require a verified token before the server even looks at the data. Once the perimeter is secure, we will roll out Role-Based Access Control (RBAC).
Admins will have full access to team management and data scrubbing.
Editors can review and flag data.
Viewers will be strictly read-only.
Coupled with upcoming multi-tenant Firestore security rules, this will ensure our platform is isolated, secure, and ready for a true Beta deployment.
Moving Forward
This two-week hybrid sprint is designed to perfectly bridge the gap between demonstrating immediate value to our stakeholders and building the invisible, architectural security foundation required for a production-ready application. I am looking forward to seeing this "Day in the Life" walkthrough come to life and reporting back on how the plain-language generator handles the synthetic data next week.
Top comments (0)