A proposal for a permanent national institution that would train and certify the clinical AI competence
of Kenya’s entire health workforce — doctors, clinical officers, nurses, pharmacists and
laboratory staff alike.
The argument in one line: the variable that decides whether clinical AI helps or harms a patient is not
the model, it is the training of the clinician in front of it. A 2025 randomised trial found that
physicians who had already completed twenty hours of AI-literacy training still deferred to deliberately
erroneous model output — so the obvious curriculum is the wrong curriculum.
Five professional tracks, five gated levels, assessment by simulation and workplace observation rather
than attendance, and outcomes published whether or not they flatter us. The blueprint, competency
standards, five-year financial model and evaluation design are published in full.
Read the proposal →
AI & Medicine
Advanced — technical and clinical readers
⏱ 70 min
2026-10-12
The Institute has written at length about how it would teach and examine clinicians at every level. It has not yet said how it would examine the model those clinicians will consult. In the last essay I argued that the weights can be vouched for only by their behaviour, like a drug. That is half right. A model does not behave like a drug; it behaves like a candidate — it takes a history, reasons, advises, and can be wrong in all the ways a junior clinician can be wrong, plus several that no human can. This essay sets out the examination I would require before the Institute lets a model near a clinician, and the revalidation I would require afterwards. It examines the model through three windows. From the outside: a secure Kenyan item bank, standards set before any model is scored, a station battery borrowed from the OSCE, metamorphic tests borrowed from software engineering, reliability measured over repeated attempts rather than one, and graders whose own error is corrected statistically. From the inside, which is the one thing no examiner can do to a human candidate: linear probes, sparse dictionaries, attribution graphs and model diffing, used to ask whether the model knows it is being examined, whether its expressed confidence matches its internal state, whether its citations are load-bearing, and what a fine-tune or a quantisation actually changed. And around it: Syft and Grype for the software bill of materials and vulnerability scanning the Pharmacy and Poisons Board now expects, and a self-hosted Langfuse as the record of practice. It is also explicit about what interpretability cannot yet certify, which is most things.
Read article
On 2 July I argued that the sharp pullback in memory and storage stocks was an entry point, not an exit, and walked through nine companies across the AI hardware stack. Three months later the fundamentals I was relying on came in even stronger than I expected — SanDisk's revenue rose 372% in a single quarter at an 85% gross margin, Micron printed a $54 billion quarter — and the stocks I was most enthusiastic about are among the worst performers in the group. An equal-weighted basket of the nine is down 5.6% while the semiconductor ETF is up 1.9%; the two names I was coolest on, NVIDIA and Apple, are the two best. This is the honest scorecard: what happened company by company, why record earnings met falling share prices, which parts of the bear case I wrote and then underweighted turned out to be the story, and what I am now watching.
⏱ 22 min
Read article
AI & Medicine
Advanced — technical and clinical readers
local LLMopen-weight models
2026-09-28
Commercial chatbots hedge when asked for medical advice, and the obvious conclusion is that the Kenya Institute for Clinical AI should run its own model so that its clinicians get straight answers. I think the conclusion is right and the reason is wrong. Refusal is the weakest argument for local inference; the strong ones are that an API call carrying patient data is a cross-border transfer under section 47 of the Digital Health Act, that a hosted model can change underneath a validation study without notice, and that the Pharmacy and Poisons Board's 2026 guideline on medical device software now expects change control, rollback and traceability that only an owner of the artefact can provide. This essay sets out what running the Institute's own model actually involves: which open-weight models are serious candidates and what each is built from, what 'controlling the source code' can and cannot mean when the thing that matters is a trillion numbers nobody can read, the hardware in three tiers with landed Kenyan costs, the power and backup design for a grid that went dark nationwide on 29 July, the full software stack, the team, a five-year cost of ownership, whether DeepSeek V4 is an answer, and — at length — what none of this does.
⏱ 55 min
Read article
AI & Medicine
All readers — no technical background assumed
quantum computingShor's algorithm
2026-09-22
Every conference I go to lately, somebody wants to talk to me about whether AI is about to take over the world. Nobody has ever once asked me whether the same era of computing might quietly read every patient record I have spent this year designing MedLattice to protect. It should be the other way around. AI takeover is speculative — disputed timelines, disputed probabilities, no working example. Shor's algorithm is not speculative. It has existed, proven, since 1994; the only open question is how many years of engineering stand between now and a machine large enough to run it. This post is the explanation I wish existed before I had to go and build cryptography around the problem myself: what encryption actually is and how a record like MedLattice's gets locked in the first place, why a classical computer cannot pick that lock no matter how large it gets, what a quantum computer is actually doing differently — with superposition explained properly, not just named and left — Euclid's algorithm worked by hand because it turns out to be the quiet backbone of the whole attack, Shor's algorithm itself walked through on numbers small enough to check on paper, and exactly how a quantum computer would derive a private key from a public one. It closes with why AES-256 is not the part that's actually in danger, and why the lattice mathematics behind ML-KEM resists this attack in a structurally different way than RSA or elliptic curves ever could.
⏱ 38 min
Read article
AI & Medicine
All readers — no technical background assumed
HyperledgerBesu
2026-09-18
MedLattice's own specification states its topology in one line — 'permissioned EVM consortium (Besu/QBFT)' — and moves on. This post is the argument behind that line, built from the ground up: what a blockchain is actually doing underneath the word, why a permissioned chain and not a public one, what the Byzantine Generals Problem is and why every consensus protocol in use today is answering a question posed in 1982, how Practical Byzantine Fault Tolerance became Istanbul BFT became QBFT, why Besu specifically rather than Fabric or Corda, and how MedLattice's own three contracts — IdentityRegistry, ConsentCapabilityManager, RecordAnchorRegistry — sit on top of all of it. It closes with what the choice does not solve.
⏱ 25 min
Read article
AI & Medicine
All readers — no technical background assumed
bitcoinlightning network
2026-09-10
This is a working note, not a finished piece — a look at the payment system I have started drafting for the Institute, currently called Malipo Rail, while it is still wet. The blueprint sets out a five-year, USD 17.38 million funding model and never specifies how any of that money actually moves: how a donor's gift becomes a disbursement, how a member hospital pays its dues, how a patient pays a bill. I have been sketching an answer built on Bitcoin and the Lightning Network rather than an Institute-issued coin or a public Ethereum system, sitting beside MedLattice rather than inside it, because the record I built on the premise that clinical data should never touch a public market or a token is not a record I want to now bolt a cryptocurrency onto. I say here why bitcoin over the alternatives, why Kenya's regulatory position and its bitcoin-using population make this plausible rather than exotic, and where the draft is still thin. A full, proper write-up follows once more of it has been argued with — this post will be replaced when it does.
⏱ 9 min
Read article
AI & Medicine
All readers — no technical background assumed
automation biasdiscernment
2026-09-02
Commitment two of the Institute's ten is nine words long: scepticism is trained explicitly, and it is assessed. It is the commitment the founding evidence directly implicates, and the one I have never properly defended. This is the fifth companion to the blueprint. It reads the randomised trial the whole argument rests on closely enough to say what it does and does not establish — including that it enrolled 44 physicians. It assembles the convergent evidence from mammography, dermatology, pathology, colonoscopy and thirty years of aviation human factors, including the study whose average effect was zero while concealing help for the weakest readers and harm to the strongest on exactly the hardest cases. Then it confronts the literature nobody designing an AI curriculum wants to cite: taught debiasing does not transfer, and a controlled trial in 191 senior medical students found cognitive forcing strategies made no difference at all. What survives that is a design rather than a syllabus — the independent-impression rule as a structural constraint, a seeded-error bank with a deliberately unstable base rate, and scoring by signal detection rather than catch rate, because a candidate who rejects every AI output is not discerning, they are useless in a different direction. Ends with what would refute the whole thing.
⏱ 41 min
Read article
AI & Medicine
All readers — no technical background assumed
electronic health recordsMedLattice
2026-08-25
In almost every hospital system in the world, 'the receptionist cannot see your diagnosis' means the software declines to draw it on her screen. The diagnosis is sitting in the same database, behind the same login, protected by a rule rather than a lock. A misconfiguration, an injection flaw or a disgruntled administrator turns 'cannot' into 'can'. MedLattice is the electronic patient record I have been building on the opposite premise: that every part of a record should be separately locked, that people should be handed only the keys they actually need, and that the encryption should be chosen for the length of a human life rather than the length of a procurement cycle. This is the whole design in plain English — the drawers and the envelopes, the key tree that makes fine-grained sharing cryptographic instead of cosmetic, the shared logbook that no single hospital can quietly edit, what the patient controls, what happens at three in the morning when there is no time for any of it, how a record gets erased when the logbook cannot forget, and — at length, because every security document should have one — what this does not do.
⏱ 26 min
Read article
SBAR is four letters that most clinicians can recite and rather fewer can actually use under pressure. This post traces it properly: what the framework does to a sentence, the worked clinical call, where it really came from — US Navy nuclear submarines by way of a retired Navy captain at Kaiser Permanente in 2002, with the historical caveat that the popular account overstates — its spread into aeromedical evacuation and the wider high-reliability world, and then the part most SBAR teaching skips: what the trial and systematic-review evidence actually shows, including a randomised controlled trial in which SBAR did not significantly improve the content of a referral, and a 2021 review finding that fidelity collapses the moment you leave the classroom. Ends with the variants worth adopting and the four places SBAR stops working.
⏱ 17 min
Read article