# SCRIMED Agent Workspace Governance Workflow Packs Status: customer-governance-workflow-packs-ready Boundary: SCRIMED governance workflow packs are customer-tailored synthetic pilot operating templates. They are not legal advice, privacy advice, security certification, HIPAA certification, SOC 2 certification, FDA clearance, payer approval, reimbursement assurance, breach determination, or production authorization. ## CI Secret Contract - Bearer token secret: SCRIMED_BEARER_TOKEN - Base URL variable: SCRIMED_BASE_URL - Workspace slug variable: SCRIMED_WORKSPACE_SLUG - Required authenticated flag: SCRIMED_REQUIRE_AUTHENTICATED_SMOKE=1 ## Provider Operations Retention Review Pack - Slug: provider-operations-retention-review - Status: pilot-ready - Buyer segment: Hospitals, clinics, physician groups, and care operations leaders - Customer archetype: Provider organization evaluating synthetic workflow automation before PHI access. - Scope: Retention schedule, reviewer authority, proof packet handling, and release controls for synthetic care operations work orders. - Pricing use: Included in protected enterprise pilot scope and annual platform readiness review. ### Customer Inputs Required - Pilot sponsor - Workflow owner - Record retention preference - Clinical reviewer role - Privacy contact - Security contact ### Retention Policy Template - Default duration: 90 to 180 days for synthetic pilot evidence - Trigger: Work-order creation, governed transition, proof-packet release, or incident export. - Deletion gate: Tenant-admin attestation plus privacy/security approval before evidence deletion. - Approval owner: Customer privacy owner or designated pilot governance lead ### Legal Review Workflow - Confirm synthetic-only pilot scope and no live PHI processing. - Map reviewer authority for clinical-adjacent drafts. - Approve proof-packet language and prohibited claims. - Record retention decision in the governance ledger. ### Required Approvals - Pilot sponsor - Privacy owner - Clinical governance owner ### External Gates - BAA/DPA path if live PHI is proposed - Licensed clinician validation before clinical claims ### Incident Export Workflow - Trigger: Suspected boundary violation, unsafe claim, evidence-release dispute, or customer diligence request. - Release gate: AAL2 tenant-admin or pilot-lead request with write-before-release ledger event - Committed governance-ledger entry - Workspace summary - Work-order snapshot - Boundary controls - Known limitations ### Automation Boundaries - No diagnosis - No treatment guidance - No patient outreach - No medical-record mutation - No production connector execution ### Blocked Claims - HIPAA compliant - SOC 2 certified - FDA cleared - Clinical decision support authorized ## Payer And RCM Incident Export Pack - Slug: payer-rcm-incident-export - Status: pilot-ready - Buyer segment: Payers, revenue cycle teams, denial management, and finance operators - Customer archetype: Organization testing RCM or payer intelligence with synthetic claims and policy evidence. - Scope: Controls for denial-risk work orders, retention of policy evidence, incident export, and no-submission boundaries. - Pricing use: Premium add-on for RCM, payer, and revenue integrity protected pilots. ### Customer Inputs Required - RCM owner - Payer operations owner - Policy source owner - No-submission acknowledgement - Revenue metric baseline ### Retention Policy Template - Default duration: 120 to 365 days for synthetic payer workflow evidence - Trigger: Denial work-order creation, policy source mapping, proof packet download, or incident export. - Deletion gate: Finance/RCM approval plus tenant-admin attestation. - Approval owner: RCM governance lead or payer operations owner ### Legal Review Workflow - Confirm no live claim identifiers, member IDs, or payer credentials. - Map payer policy source handling and citation boundaries. - Approve no-reimbursement-guarantee language. - Record retention or legal-hold decision in the governance ledger. ### Required Approvals - RCM owner - Compliance reviewer - Executive sponsor ### External Gates - Customer legal review before payer submission workflows - Coding/reimbursement expert review ### Incident Export Workflow - Trigger: Potential payer-submission implication, unsupported reimbursement claim, or policy-source dispute. - Release gate: AAL2 tenant-admin or pilot-lead request with incident severity recorded - Governance-ledger incident entry - Denial work-order snapshot - Policy evidence status - No-submission controls - Revenue metric caveats ### Automation Boundaries - No final coding - No payer submission - No coverage determination - No reimbursement guarantee ### Blocked Claims - Revenue guaranteed - Coverage approved - Coding finalized - Payer submission authorized ## TrialCore Research Legal Hold Pack - Slug: trialcore-research-legal-hold - Status: customer-tailoring-required - Buyer segment: Academic medical centers, research operations, oncology programs, and trial networks - Customer archetype: Research organization evaluating synthetic trial matching or eligibility review. - Scope: Research-review controls for eligibility evidence, legal hold, protocol-source retention, and no-outreach boundaries. - Pricing use: Research operations premium pilot module with external governance tailoring. ### Customer Inputs Required - Research operations owner - Protocol source owner - IRB or governance contact where applicable - Research reviewer role - Protocol-version handling rule ### Retention Policy Template - Default duration: 180 to 365 days for synthetic research evidence - Trigger: Eligibility work-order creation, criteria trace release, review disposition, or incident export. - Deletion gate: Research governance approval plus tenant-admin attestation. - Approval owner: Research governance lead ### Legal Review Workflow - Confirm synthetic research workflow and no patient outreach. - Map criteria source, protocol version, and eligibility uncertainty language. - Approve reviewer role and escalation path. - Record legal-hold decision when protocol evidence must be preserved. ### Required Approvals - Research operations owner - Governance reviewer - Executive sponsor ### External Gates - IRB/legal review where applicable - Licensed clinician or investigator review before claims ### Incident Export Workflow - Trigger: Eligibility claim dispute, protocol-source issue, or patient-outreach boundary concern. - Release gate: AAL2 governance request and research reviewer awareness - Ledger incident entry - Eligibility work-order snapshot - Criteria source state - Reviewer status - No-outreach controls ### Automation Boundaries - No enrollment recommendation - No patient outreach - No treatment recommendation - No live record ingestion ### Blocked Claims - Patient eligible - Enrollment recommended - Trial match clinically validated ## Public Sector Sovereign Retention Pack - Slug: public-sector-sovereign-retention - Status: external-review-required - Buyer segment: Government health programs, ministries of health, and public-sector agencies - Customer archetype: Public-sector buyer requiring regional retention, sovereignty, and audit evidence planning. - Scope: Sovereign deployment readiness, retention controls, incident export, and jurisdiction-specific approval gates. - Pricing use: Strategic platform partnership and public-sector protected pilot requirement. ### Customer Inputs Required - Jurisdiction - Data residency requirement - Public-sector sponsor - Procurement route - Incident commander - Regional counsel ### Retention Policy Template - Default duration: Customer-defined by jurisdiction and procurement requirements - Trigger: Workspace activation, work-order release, security evidence update, or incident export. - Deletion gate: Government sponsor approval plus regional counsel/security review. - Approval owner: Customer-designated public-sector governance owner ### Legal Review Workflow - Map jurisdiction, data residency, and sovereignty expectations. - Confirm synthetic-only pilot boundary until approved deployment profile exists. - Approve incident owner and evidence release path. - Record retention and legal-hold decisions in the governance ledger. ### Required Approvals - Public-sector sponsor - Regional counsel - Security owner ### External Gates - Sovereign-cloud architecture review - Procurement/legal approval - Regional privacy review ### Incident Export Workflow - Trigger: Sovereignty concern, evidence-release request, security review finding, or jurisdictional escalation. - Release gate: AAL2 request plus named public-sector incident owner - Incident ledger entry - Sovereign readiness controls - Workspace/work-order snapshot - Jurisdictional gates - Production exclusions ### Automation Boundaries - No cross-border live data movement - No production connector execution - No public health reporting - No patient-level intervention ### Blocked Claims - Sovereign compliant - Government approved - Production authorized ## Enterprise BAA/DPA Readiness Pack - Slug: enterprise-baa-dpa-readiness - Status: customer-tailoring-required - Buyer segment: Large providers, payers, employers, and enterprise healthcare operators - Customer archetype: Enterprise buyer preparing contract, privacy, security, and production-readiness diligence. - Scope: Contract-readiness controls for BAA/DPA path, retention schedule, legal review, incident export, and human-review operating model. - Pricing use: Required for protected enterprise pilot conversion and annual operating license diligence. ### Customer Inputs Required - Procurement owner - Privacy owner - Security owner - Legal owner - Workflow sponsor - Reviewer authority matrix ### Retention Policy Template - Default duration: 90 to 365 days until customer policy is approved - Trigger: Protected pilot activation, reviewer disposition, proof release, or incident export. - Deletion gate: Legal/privacy approval plus tenant-admin attestation. - Approval owner: Customer legal/privacy owner ### Legal Review Workflow - Confirm product boundary and no-PHI pilot posture. - Map BAA/DPA decision path before live data. - Approve claims register and proof-packet language. - Record retention/legal-hold actions in the governance ledger. ### Required Approvals - Legal owner - Privacy owner - Security owner - Workflow sponsor ### External Gates - BAA/DPA execution before PHI - Security review - Incident response runbook approval ### Incident Export Workflow - Trigger: Diligence request, legal review question, privacy/security concern, or claims-boundary escalation. - Release gate: AAL2 governance request with customer owner mapped - Ledger entry - Claims and boundary controls - Work-order evidence - Reviewer status - Remaining external gates ### Automation Boundaries - No PHI processing before written approval - No live connector execution - No autonomous clinical decision - No compliance certification claim ### Blocked Claims - HIPAA certified - SOC 2 certified - BAA approved - Production ready ## Next Implementation Step Promote selected governance pack slugs from buyer intake into protected workspace activation records and governance-ledger metadata when an enterprise pilot is created.