// AI & Medicine
A Model We Can Answer For: Running the Institute's Own Clinical Language Model
Commercial chatbots hedge when asked for medical advice, and the obvious conclusion is that the Kenya Institute for Clinical AI should run its own model so that its clinicians get straight answers. I think the conclusion is right and the reason is wrong. Refusal is the weakest argument for local inference; the strong ones are that an API call carrying patient data is a cross-border transfer under section 47 of the Digital Health Act, that a hosted model can change underneath a validation study without notice, and that the Pharmacy and Poisons Board's 2026 guideline on medical device software now expects change control, rollback and traceability that only an owner of the artefact can provide. This essay sets out what running the Institute's own model actually involves: which open-weight models are serious candidates and what each is built from, what 'controlling the source code' can and cannot mean when the thing that matters is a trillion numbers nobody can read, the hardware in three tiers with landed Kenyan costs, the power and backup design for a grid that went dark nationwide on 29 July, the full software stack, the team, a five-year cost of ownership, whether DeepSeek V4 is an answer, and — at length — what none of this does.
Read article →The Spinning Coin and the Stolen Key: What Shor's Algorithm Actually Threatens
Every conference I go to lately, somebody wants to talk to me about whether AI is about to take over the world. Nobody has ever once asked me whether the same era of computing might quietly read every patient record I have spent this year designing MedLattice to protect. It should be the other way around. AI takeover is speculative — disputed timelines, disputed probabilities, no working example. Shor's algorithm is not speculative. It has existed, proven, since 1994; the only open question is how many years of engineering stand between now and a machine large enough to run it. This post is the explanation I wish existed before I had to go and build cryptography around the problem myself: what encryption actually is and how a record like MedLattice's gets locked in the first place, why a classical computer cannot pick that lock no matter how large it gets, what a quantum computer is actually doing differently — with superposition explained properly, not just named and left — Euclid's algorithm worked by hand because it turns out to be the quiet backbone of the whole attack, Shor's algorithm itself walked through on numbers small enough to check on paper, and exactly how a quantum computer would derive a private key from a public one. It closes with why AES-256 is not the part that's actually in danger, and why the lattice mathematics behind ML-KEM resists this attack in a structurally different way than RSA or elliptic curves ever could.
Read article →Twenty Generals, One Ledger: Why MedLattice Runs on Hyperledger Besu and QBFT
MedLattice's own specification states its topology in one line — 'permissioned EVM consortium (Besu/QBFT)' — and moves on. This post is the argument behind that line, built from the ground up: what a blockchain is actually doing underneath the word, why a permissioned chain and not a public one, what the Byzantine Generals Problem is and why every consensus protocol in use today is answering a question posed in 1982, how Practical Byzantine Fault Tolerance became Istanbul BFT became QBFT, why Besu specifically rather than Fabric or Corda, and how MedLattice's own three contracts — IdentityRegistry, ConsentCapabilityManager, RecordAnchorRegistry — sit on top of all of it. It closes with what the choice does not solve.
Read article →What I'm Building Next: A Bitcoin Rail for the Clinical AI Institute
This is a working note, not a finished piece — a look at the payment system I have started drafting for the Institute, currently called Malipo Rail, while it is still wet. The blueprint sets out a five-year, USD 17.38 million funding model and never specifies how any of that money actually moves: how a donor's gift becomes a disbursement, how a member hospital pays its dues, how a patient pays a bill. I have been sketching an answer built on Bitcoin and the Lightning Network rather than an Institute-issued coin or a public Ethereum system, sitting beside MedLattice rather than inside it, because the record I built on the premise that clinical data should never touch a public market or a token is not a record I want to now bolt a cryptocurrency onto. I say here why bitcoin over the alternatives, why Kenya's regulatory position and its bitcoin-using population make this plausible rather than exotic, and where the draft is still thin. A full, proper write-up follows once more of it has been argued with — this post will be replaced when it does.
Read article →The Resented Reflex: Training Doubt When AI Literacy Has Already Failed
Commitment two of the Institute's ten is nine words long: scepticism is trained explicitly, and it is assessed. It is the commitment the founding evidence directly implicates, and the one I have never properly defended. This is the fifth companion to the blueprint. It reads the randomised trial the whole argument rests on closely enough to say what it does and does not establish — including that it enrolled 44 physicians. It assembles the convergent evidence from mammography, dermatology, pathology, colonoscopy and thirty years of aviation human factors, including the study whose average effect was zero while concealing help for the weakest readers and harm to the strongest on exactly the hardest cases. Then it confronts the literature nobody designing an AI curriculum wants to cite: taught debiasing does not transfer, and a controlled trial in 191 senior medical students found cognitive forcing strategies made no difference at all. What survives that is a design rather than a syllabus — the independent-impression rule as a structural constraint, a seeded-error bank with a deliberately unstable base rate, and scoring by signal detection rather than catch rate, because a candidate who rejects every AI output is not discerning, they are useless in a different direction. Ends with what would refute the whole thing.
Read article →Not Shown Is Not Locked: The Patient Record I Am Building
In almost every hospital system in the world, 'the receptionist cannot see your diagnosis' means the software declines to draw it on her screen. The diagnosis is sitting in the same database, behind the same login, protected by a rule rather than a lock. A misconfiguration, an injection flaw or a disgruntled administrator turns 'cannot' into 'can'. MedLattice is the electronic patient record I have been building on the opposite premise: that every part of a record should be separately locked, that people should be handed only the keys they actually need, and that the encryption should be chosen for the length of a human life rather than the length of a procurement cycle. This is the whole design in plain English — the drawers and the envelopes, the key tree that makes fine-grained sharing cryptographic instead of cosmetic, the shared logbook that no single hospital can quietly edit, what the patient controls, what happens at three in the morning when there is no time for any of it, how a record gets erased when the logbook cannot forget, and — at length, because every security document should have one — what this does not do.
Read article →Measuring What Actually Matters: Kirkpatrick 3 and 4 for Student-Clinicians
The tenth of the Institute's ten pedagogical commitments is one sentence long: we measure at Kirkpatrick 3 and 4, or we admit we do not know. This is the fourth companion to the blueprint, and it unpacks that sentence completely — starting from zero, for a reader who has never planned a course in their life. What the four levels are and why almost every training programme stops at the second one. What 'behaviour' means when the behaviour in question is a habit of mind. How you would actually observe, audit and log a student-clinician at three and twelve months without fooling yourself. Why the independent-impression rule is my candidate for the fastest-decaying thing we teach, and what would refute that. What a stepped-wedge design buys you, what it costs, and what to do when you cannot run one. And a working catalogue of the other pedagogical instruments — Miller, entrustment, programmatic assessment, Angoff, retrospective pre-post, logic models, audit and feedback — with notes on how each would be used here.
Read article →The Angoff Panel for Testing Clinicians
One line on one slide of my Level 1 deck reads: Standard set by modified Angoff panel (No arbitrary 50% pass rate). It is the least glamorous sentence in the whole curriculum and possibly the most consequential. This post unpacks it completely — what a cut score actually is, why 50% is indefensible and norm-referencing is worse, who the borderline candidate is and how you build one, the mechanism step by step with a full worked panel whose arithmetic you can check, what 'modified' really means (the usual story is wrong), what the 2025 meta-analysis of 91 studies says about which variant to choose, and precisely where Angoff stops working.
Read article →One Hidden Error: What an OSCE Is, and What an AI-OSCE Would Be
The blueprint I published last week rests on an examination that does not yet exist. This post explains the machinery it borrows: what an OSCE is, the problem Harden was solving in Dundee when he built the first one, why a written paper can never certify a clinical skill, and what changes when the thing being examined is a doctor's judgement about a machine. Along the way: what conjunctive failure means and why some errors cannot be compensated, why a standardised patient is a trained professional and not a volunteer, and why the pass mark is never 50%.
Read article →Borrowed From an Art School: Where the Clinical AI Framework Actually Came From
The competency framework underneath my clinical AI blueprint was not built for medicine. It came out of an art school in Sarasota and a business school in Cork, developed by a novelist-turned-AI-coordinator and an information systems professor. That provenance is not a curiosity — it is the reason the framework transfers to clinical work at all. A framework built for medicine would have hard-coded medicine into it. This is what Dakan and Feller built, what I kept, what I reframed, and the one thing I had to add because creative work does not kill anyone.
Read article →Another Arrow in the Quiver: The Clinical AI Institute Kenya Should Build
AI arrived in Kenyan clinical practice ahead of any plan for teaching clinicians how to use it. A 2025 randomised trial found that physicians who had already completed twenty hours of AI-literacy training still deferred to deliberately erroneous model output — which means the obvious curriculum is the wrong curriculum. This is my blueprint for a permanent national institution that would train and certify the clinical AI competence of an entire country's health workforce: five professional tracks, five gated levels, assessment by simulation and workplace observation rather than attendance, seventy-one core posts specified by qualification, and outcomes published whether or not they flatter us. No such institution exists anywhere in the world.
Read article →The Law Is Part of the Architecture: Building Medical Software for Kenyan Facilities
A third of my care-home specification did not survive one question: under which country's law does this run? Kenya now has a health-specific digital statute, a certification regime for the software itself, and a 72-hour breach clock. This is the work I do — building clinical software for Kenyan care homes and small hospitals that is lawful to deploy, capable of certification, and still standing after contact with the night shift.
Read article →AI Walks Into the Clinic: ChatGPT's Health Launch and the Speed of What's Coming
Two signals landed in the same week: OpenAI wired personal health records into ChatGPT, and a short film — 'AI Doctor 2027' — laid out where this goes. Together they confirm what I have been saying for months: AI is not approaching medicine, it has walked in. My take on both, why the video is worth watching (the graphics alone are remarkable), and what 'augment, not replace' really means once 300 million people bring their chart to a chatbot.
Read article →From Point Solution to Plumbing: Inside Medtech's 2026 AI Integration and Robotics Arms Race
Two structural shifts in medtech, examined against the primary sources: AI is moving from standalone pilot tools into the clinical and device fabric itself, and surgical robotics is scaling from a one-company category into a genuinely contested, multi-platform market. What the FDA filings, earnings calls, and funding rounds actually show.
Read article →AI Just Beat Doctors 4-to-1 on Diagnosis. Here Are 7 Things That Actually Means
A Microsoft diagnostic AI just scored 85.5% on hard NEJM cases against a 20% average for physicians. Seven takeaways from inside the compressed medical century — what's real, what's overstated, and what it means if you're the one holding the scalpel.
Read article →The Compressed Career: What AI Means for Physicians and Surgeons
What happens to me — the physician, the surgeon, the person who has spent forty years inside the system — while AI compresses a century of medical progress into a decade? A terrain map, in the spirit of Dario Amodei's 'Machines of Loving Grace' and drawing on the DeepMind documentary 'The Thinking Game.
Read article →