Clinical Data Fabric as an Auditability Layer
Holding
A clinical data fabric is not merely an integration layer. In medical AI and biotech development, it is the evidence layer that shows where data came from, what changed, who was permitted to use it, and whether the resulting computation can be defended.
Authority
HIPAA requires safeguards for electronic protected health information. EU medical device rules treat software intended for medical purposes as potentially regulated device software. FDA and ISO quality frameworks expect traceable design, validation, and production controls. These frameworks do not require one database technology. They require that regulated data and regulated decisions remain inspectable.
Issue
The practical failure mode is silent transformation. A pathology image is converted, a laboratory value is normalized, an EHR field is mapped, a cohort is filtered, and the final model receives a clean tensor. If the system cannot prove each transformation, the organization has a prediction without an audit trail.
Resolution
The fabric should store provenance as a first-class object: source system, extraction time, consent basis, transformation version, vocabulary mapping, quality checks, and downstream use. Access control should attach to datasets and derived artifacts. Validation should include not only model performance, but whether the data route that produced the model can be reproduced.
Evidence Package
The mature record includes lineage reports, consent maps, data quality exceptions, schema mapping records, feature construction versions, access logs, and validation datasets. Without these artifacts, a clinical AI claim is difficult to distinguish from an undocumented experiment.