Clinical Cockpit runs the operational spine of an endoscopy service: it ingests the hospital's own scheduling feeds, plans every procedure order against its clinical deadline, surfaces the conflicts a spreadsheet hides, and drafts the paperwork — with AI that is filtered, audited and switchable off.
Built in production at a university GI department, by a clinician. Not a product pitch — a working system with 1,100+ tests, deployed on hospital-controlled infrastructure.
01 · The planning spine
The cockpit does not replace the hospital's scheduling system — it reads it, checks it, and answers the question the feed cannot: will every patient be seen in time, and if not, who decides what gives?
Daily endoplanner exports are parsed, reconciled and never blindly trusted: a human-verified booking outranks a feed field that moves, and an order that silently vanishes from the feed is flagged, not forgotten.
Urgency 1/2/3 map to 14/30/90-day windows from the date the order was placed; surveillance orders carry their target date and are deliberately not pulled forward — an interval means something.
Bookable minutes come from the actual room lists; who is rostered that day sets the category ceiling — an advanced resection cannot land on a day the operator qualified for it is absent. The roster is the rule.
When no slot exists before a deadline, the engine says so and offers up to three swaps — each naming who moves, where they go, and the margin they keep. The physician decides; the audit log remembers.
the screen the demo ends onOne gate: nothing is sent to the scheduling team until breaches are resolved. Then confirmations are tracked patient-by-patient until each is booked.
Approval stays locked until the breach is resolved — accept the late slot, or execute a swap. Either way it is a human decision with a trace.
02 · The documentation slice
Around every procedure sits a stack of writing: the pre-clinic brief, the consultation note, the bilingual patient letter, the endoscopy-list preparation. The cockpit drafts each one from the record — and every draft dies or lives by a signature.
Before the patient sits down: one structured card built from the whole record — problem, history, medication signals, comorbidity score — with the source documents one click away.
A recorded consultation is merged with the brief into a structured note and a patient letter in English and Dutch, exported as PDF on hospital letterhead. Field-level editing, versioned drafts, explicit sign-off.
Each list entry gets its prep — indication, alerts, anticoagulation, scope choice — assembled from consultations, documents and linked referrals.
Mailed referrals are filed automatically, images and all. The hard rule: no language model ever touches a referral — endoscopy stills carry burned-in patient banners no text filter can scrub. Enforced by a test, not a policy memo.
Janssens, Marie, °08-03-1974, RRNr 74030812345. Colonoscopy for anaemia work-up; lesion 30 cm, scheduled for ESD.
[PATIENT], °[DATE_1], RRNr [RRNR]. Colonoscopy for anaemia work-up; lesion 30 cm, scheduled for ESD.
Brief for Janssens, Marie: anaemia work-up, 30 cm lesion, ESD planned — identifiers re-matched locally, never by the model.
The filter is pure, dependency-free code that runs before any outbound call — and the gate screen shows the actual payload, not a diagram of it.
03 · Built for a hospital's questions
Supervisor, fellow, read-only auditor, planner — enforced on every route. Sign-off is a permission, not a habit.
RBAC · per-requestEvery action, every actor, every timestamp — including every AI invocation and what it was allowed to see.
append-onlyProcedure names and indications are never machine-translated — in any UI language they render exactly as the source system wrote them. That boundary keeps the tool outside medical-device scope, and a test enforces it.
MDCG 2019-11 positioningDutch, English and French interface — each user picks their own; the deployment picks the default.
gettext · 900 stringsSkins are CSS variable sets on the identical codebase — the demo wears UZ Gent blue; one toggle shows the neutral theme.
no forked templatesDocker + PostgreSQL on hospital-controlled infrastructure, reachable only over a private network. The AI transport is switchable: subscription CLI, API — or fully offline replay, as this demo proves.
no vendor lock-inThe demonstration instance is the identical codebase, seeded with a generated world: ±500 orders, a congress that removes a week of capacity, and one patient whose deadline can only be kept by a swap. It refuses to boot on anything but synthetic rows, and no AI credentials exist on the server. Guided tour included.