Imaging Intelligence

Executive summary

Imaging ingests radiographs and DICOM studies, renders them in a DICOM viewer, and supports manual measurement and annotation today. AI findings run through a governed control plane: a model can serve clinical users only as a signed, approved release, exposed first in shadow, then pilot, then clinical mode. No imaging model release is approved yet, so AI findings are not shown to clinicians; model development happens on a physically separate research plane.

Overview

ProductionSee · Imaging Intelligence
Bring images into the encounter with a viewer clinicians can trust, and put any imaging AI behind a release process strict enough for a medical device.

Pipeline

Studies are uploaded or arrive by integration; originals go to object storage and an outbox job is enqueued.
The imaging pre-processor decodes and validates DICOM, writes viewer derivatives, and records series and instances.
The viewer renders studies with Cornerstone; clinicians measure and annotate manually. Pixels are never altered.
An inference job runs only if an authorized model release is deployed for that capability and exposure mode; otherwise activation refuses with no_approved_release.
Findings land as review-required imaging artifacts; accepted findings may be promoted to facts and reconciled with the chart.

Clinical

Ingest
upload · integration
Pre-processor
DICOM decode · derivatives
Viewer
measure · annotate
Findings
review-required

Release

Signed model release
verify · approve · deploy
Inference
shadow · pilot · clinical

Research

Annotation app
blinded readers
Research database
datasets · adjudication
Training & evaluation
locked datasets

Connections (7)

Ingest ⇢ Pre-processor
Pre-processor → Viewer
Inference → Findings
Signed model release → Inference
Annotation app → Research database
Research database → Training & evaluation
Training & evaluation → Signed model release · signed package

Clinical and research planes are separate databases and separate applications. Models cross only as signed releases.

Data owned

Studies, series, instances, assets
Holds
The imaging record and its derivatives
Processing jobs and outbox events
Holds
Ingest, derivative and inference work
Model releases and deployments
Holds
Signed releases, their state and where each is deployed in which exposure mode
Model runs, findings, geometries, reviews
Holds
What a model produced and how the clinician decided
Manual annotations
Holds
Clinician measurements and marks
Research plane (separate database)
Holds
Datasets, agreements, cases, readers, assignments, annotations, adjudications, releases, experiments

Store	Holds
Studies, series, instances, assets	The imaging record and its derivatives
Processing jobs and outbox events	Ingest, derivative and inference work
Model releases and deployments	Signed releases, their state and where each is deployed in which exposure mode
Model runs, findings, geometries, reviews	What a model produced and how the clinician decided
Manual annotations	Clinician measurements and marks
Research plane (separate database)	Datasets, agreements, cases, readers, assignments, annotations, adjudications, releases, experiments

Models and engines

Radiograph analysis (candidate)
Model or engine
Gemini 3 Flash with a versioned prompt
Notes
Capabilities: caries, bone measurement, periapical lesions, marginal, fracture triage — inactive without an approved release
Detection and tooth segmentation (candidate)
Model or engine
Self-hosted GPU detector
Notes
Worker scaffolded; no model loaded
Region-of-interest verifier (candidate)
Model or engine
MedGemma 4B with a radiograph adapter (self-hosted)
Notes
Second reader on cropped regions

Step	Model or engine	Notes
Radiograph analysis (candidate)	Gemini 3 Flash with a versioned prompt	Capabilities: caries, bone measurement, periapical lesions, marginal, fracture triage — inactive without an approved release
Detection and tooth segmentation (candidate)	Self-hosted GPU detector	Worker scaffolded; no model loaded
Region-of-interest verifier (candidate)	MedGemma 4B with a radiograph adapter (self-hosted)	Second reader on cropped regions

Guardrails

Activation is a database action against a signed, verified release; there is no code path to enable a model by configuration alone.
Release states: draft → candidate → locked → validated → approved → retired (ADR 0006).
Exposure modes: shadow (no UI), pilot (named cohort), clinical. Significant changes reopen the release.
Clinical and research data are physically separated; research uses its own identity provider and origin (ADR 0005).
The viewer is read-only on pixels; AI never generates or alters image content.

Rollout and status

ProductionIngestion, DICOM derivatives, viewer, manual measurement
Enabled in the production configuration
ProductionModel release control plane
Verifier, deployment, retirement and change control are built
PlannedAI findings for clinicians
Refused until a release is approved; DPIA pending
Rolling outResearch plane and annotation app
Schema, application and protocols built
Rolling outSelf-hosted imaging models
GPU worker and MedGemma verifier in deployment

Interfaces

Consumes
What
Encounter binding
Consumes
What
Signed model releases from the research plane
Emits
What
Imaging finding artifacts
Emits
What
Accepted findings to facts and chart reconciliation

Direction	What
Consumes	Encounter binding
Consumes	Signed model releases from the research plane
Emits	Imaging finding artifacts
Emits	Accepted findings to facts and chart reconciliation

Invariants

Imaging clinical invariants (truth-state vocabulary, stop-the-line rule)
ADRs 0004–0008

Known limits

ADR 0008 (finding authority) is proposed; imaging QMS items are implemented but pending approval.

SOURCE OF TRUTH

server/services/imaging/
services/imaging-preprocessor/
services/imaging-inference/
apps/imaging-annotation/
server/research/
docs/adr/0006-imaging-model-release-boundary.md