Predictive Mapping · Not "AI‑powered"
Harmonize EHR (Epic, Cerner), HL7 v2, FHIR R4, DICOM, and LOINC/SNOMED at the mapping layer. Our Semantic Match Engine proposes candidate mappings; named SMEs approve them with electronic signature; every decision lands in a SHA‑256 hash‑chained ledger. Built for HIPAA §164.312(b), 21 CFR Part 11, ONC HTI‑1, and FDA GMLP.
The Four Pillars
Each pillar is a property of the data structure — not a process the application has to remember to follow.
21 CFR Part 11 §11.10(e)
Every ledger entry stores a SHA‑256 hash of the previous entry's content. Tampering with any historical row invalidates every hash from that row forward. A verifier walks the chain in O(n) — proof that the ledger has not been silently rewritten.
Primary key = chronological order
Every row is keyed by a ULID, not a UUID. The first 48 bits are a millisecond timestamp, so the primary key itself is the order. Range‑scanning to a moment in time becomes a primary‑key lookup — and there is no separate timestamp index to keep honest.
HIPAA §164.312(b)
Each ledger entry records the actor's role at the moment of action — not just the role they hold today. If a contributor is later promoted to approver, last quarter's ledger still shows them acting as a contributor. The role split is preserved retroactively, not just enforced going forward.
21 CFR Part 11 §11.200
Production releases require a Contributor's draft signature plus an Approver's release signature — and the two signers must be distinct identities. Quarterly attestations require a Compliance Officer signature satisfying §11.10(j). Both signatures are themselves ledger entries.
Live Demo
Four sample ledger entries, hashed with SHA‑256 in the Web Crypto API. Toggle a row to tamper with its content and watch every downstream hash fail.
Hashes computed with crypto.subtle.digest("SHA-256") · chain link = SHA‑256(ulid|ts|actor|role|action|prevHash)
Clinical data prep for AI models
Typical time to assemble a regulator‑defensible clinical dataset for downstream AI model training, before vs. after Magellan. EHR extraction (Epic, Cerner), HL7 v2 → FHIR R4 conversion, terminology binding (LOINC, SNOMED), DICOM pairing, and audit evidence collapse into one versioned artifact — proposed by the Semantic Match Engine, approved by named SMEs, and chain‑verified for 21 CFR Part 11 §11.10(e).
The Vocabulary Choice That Matters
Why CMIOs, compliance officers, and ONC reviewers respond to one of these phrases — and recoil from the other.
Engineering Brief — propose → score → review → sign → append, in 96 seconds.
| Dimension | "AI‑powered" | "Predictive mapping" |
|---|---|---|
| Specificity | Generic — applies to any product | Names the technique: candidate prediction over schemas |
| Executive fatigue | Triggers buzzword filtering in CMIO/CIO meetings | Reads as engineering vocabulary, not marketing |
| Audit posture | Suggests autonomous decisions | Implies proposals reviewed and signed by humans |
| Regulator‑safe | Triggers ONC HTI‑1 transparency questions | Aligns with ONC HTI‑1 predicate‑logic framing |
| Liability framing | Vendor implied accountable for the output | Named SME signs each mapping; accountability is explicit |
| FDA GMLP fit | Implies model‑driven clinical decision support | Frames AI as an upstream data‑prep accelerator |
Specificity
"AI‑powered": Generic — applies to any product
"Predictive mapping": Names the technique: candidate prediction over schemas
Executive fatigue
"AI‑powered": Triggers buzzword filtering in CMIO/CIO meetings
"Predictive mapping": Reads as engineering vocabulary, not marketing
Audit posture
"AI‑powered": Suggests autonomous decisions
"Predictive mapping": Implies proposals reviewed and signed by humans
Regulator‑safe
"AI‑powered": Triggers ONC HTI‑1 transparency questions
"Predictive mapping": Aligns with ONC HTI‑1 predicate‑logic framing
Liability framing
"AI‑powered": Vendor implied accountable for the output
"Predictive mapping": Named SME signs each mapping; accountability is explicit
FDA GMLP fit
"AI‑powered": Implies model‑driven clinical decision support
"Predictive mapping": Frames AI as an upstream data‑prep accelerator
Magellan is a predictive mapping platform — the Semantic Match Engine proposes; named SMEs approve; the SHA‑256 ledger proves it.
Regulator Crosswalk
The shortest defense of any audit system: the evidence already exists in the form the auditor needs it.
| Requirement | Source clause | How Magellan satisfies it |
|---|---|---|
| Audit controls operated independently of audited actors | HIPAA §164.312(b) | Role‑at‑time‑of‑action + RBAC split (Auditor cannot edit mappings) |
| Designated Security Official, distinct from technical admin | HIPAA §164.308(a)(2) | Security Officer role, distinct from Administrator |
| Audit trails "shall not obscure previously recorded information" | 21 CFR Part 11 §11.10(e) | Append‑only ULID ledger + SHA‑256 hash chain |
| Independent review of records | 21 CFR Part 11 §11.10(j) | Compliance Officer attestation entries (signed ledger ranges) |
| Two‑component electronic signatures for release | 21 CFR Part 11 §11.200 | Contributor draft signature + distinct Approver release signature |
HIPAA §164.312(b)
Audit controls operated independently of audited actors
Role‑at‑time‑of‑action + RBAC split (Auditor cannot edit mappings)
HIPAA §164.308(a)(2)
Designated Security Official, distinct from technical admin
Security Officer role, distinct from Administrator
21 CFR Part 11 §11.10(e)
Audit trails "shall not obscure previously recorded information"
Append‑only ULID ledger + SHA‑256 hash chain
21 CFR Part 11 §11.10(j)
Independent review of records
Compliance Officer attestation entries (signed ledger ranges)
21 CFR Part 11 §11.200
Two‑component electronic signatures for release
Contributor draft signature + distinct Approver release signature
Not in healthcare? The same primitives produce evidence for SOX §404, EU GMP Annex 11, GDPR Art. 30, FedRAMP / NIST SP 800‑53, and ISO/IEC 27001.
The Auditor's View
Three of the questions an auditor asks first — and the queries that answer them.
01
Filter by mapping ULID and date range. Result is in chronological order because the primary key is the order — no separate timestamp column to second‑guess.
02
Export the ledger range with its SHA‑256 hash chain. Re‑walk the chain. A single altered character would break every downstream hash.
03
The release row carries both the Contributor's draft signature and the Approver's release signature, and RBAC enforces that the two identities differ.
The Audit Cluster
Four posts that walk the architecture from primary key to attestation.
Why the primary key choice is the foundation of a defensible ledger.
Read postThe four moving parts and what each one defends against.
Read postThe seven‑role model that keeps mapping editors and ledger readers separate.
Read postWhat the verification script does and why a single altered byte fails the chain.
Read postThe Compliance Officer's quarterly workflow under §11.10(j).
Read postThe four structural splits that make co‑location defensible to a security reviewer.
Read postThe questions in the order they get asked, and the queries that answer them.
Read postFor sister teams outside healthcare
The HIPAA controls on this page also satisfy SOX, GxP, GDPR, FedRAMP, and ISO 27001. Hand the matching one‑pager to Finance, Quality, Privacy, FedRAMP PMO, or InfoSec.
We'll walk through the ledger, the role split, and the hash‑chain verification on a sample mapping you bring.