Industry Vocabulary Reference

Healthcare & Life Sciences

Healthcare and life sciences fields cover clinical workflows, prior authorization, patient data, pharmacy, and research. Clinical Trials uses this shared vocabulary rather than a separate namespace.

Back to industry coverage library

This page shows selected examples and categories. Download the JSON for the complete vocabulary, including every field, permitted value, and policy pattern in this catalog.

How to use this reference

1. Start with the core file if you need the cross-industry governance baseline.
2. Choose an industry file for its workflow fields and permitted values.
3. Match the OTel attributes to the policy paths your rules use, then verify the recorded fields in a test session.

Catalog context

Choose a workflow and identify the minimum data needed to explain its decisions. Record metadata without including patient information unless its use is authorized.

Risk note: Clinical review, privacy obligations, and device requirements depend on the application and its use. Keep proposed rules separate from effective requirements when defining controls.

Vocabulary file

• Download filename: 04_vertical_healthcare_life_sciences.json
• Kind: vertical

OTel namespaces

Referenced standards

These references explain the catalog's context. A listed standard does not establish that a configured application meets its requirements.

• HL7 FHIR v6.0 (R6 ballot), Fast Healthcare Interoperability Resources
• HL7 FHIR R4.0.1, CMS-mandated API baseline (45 CFR 170.215(a)(1))
• HL7 Da Vinci Project, CRD, DTR, PAS Implementation Guides (ePA workflow)
• CMS Interoperability and Prior Authorization Final Rule CMS-0057-F (Jan 2024): metrics Jan 2026, APIs Jan 2027
• ONC 21st Century Cures Rule / HTI-1 Final Rule (Jan 2024), USCDI v3, SMART on FHIR
• FDA AI/ML SaMD Action Plan, PCCP Final Guidance (December 2024)
• FDA Draft Guidance: AI-Enabled Device Software Functions Lifecycle (January 7, 2025)
• HIPAA Privacy Rule 45 CFR Part 164 Subpart E
• HIPAA Security Rule 45 CFR Part 164 Subpart C, HHS OCR Proposed Update (January 2025)
• HITECH Act, Breach Notification 45 CFR Part 164 Subpart D
• 21 CFR Part 11, Electronic Records and Electronic Signatures
• HITRUST CSF v11, Healthcare-specific security framework
• ICH E6(R3) Good Clinical Practice, Principles and Annex 1 final; Annex 2 final Step 4 (June 2026)
• FDA 21 CFR Part 312, IND regulations for drug and biologic trials
• CMS Conditions of Participation, Hospital and SNF requirements
• CMS Stars Rating / HEDIS, Quality measure frameworks

Source references

• https://build.fhir.org/ 
• https://www.cms.gov/cms-interoperability-and-prior-authorization-final-rule-cms-0057-f 
• https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-software-medical-device 
• https://www.hhs.gov/hipaa/for-professionals/security/index.html 
• https://hl7.org/fhir/us/davinci-pas/ 
• https://www.healthit.gov/topic/oncs-cures-act-final-rule 
• https://www.fda.gov/regulatory-information/search-fda-guidance-documents/e6r3-good-clinical-practice-gcp 
• https://www.fda.gov/regulatory-information/search-fda-guidance-documents/electronic-systems-electronic-records-electronic-signatures-clinical-investigations-questions 
• https://database.ich.org/sites/default/files/ICH_E6%28R3%29_Annex%202_Guideline_Step%204_2026_0603_0.pdf 

Subdomains

Implementation examples

• Prior Authorisation & Utilisation Management: Prior Authorization Status. OPA rule: SLA gate, deny claim for autonomous PA determination when elapsed_hours > 72 (expedited) or elapsed_days > 7 (standard) and status is not in terminal states {approved, denied_*, cancelled_by_provider}. Escalate to human reviewer. (Cms 0057 F: CMS-0057-F: 72h expedited PA decision; 7-day standard PA decision; metrics reporting Jan 1 2026; PA API Jan 1 2027)
• PHI Data Governance & HIPAA Compliance: Business Associate Agreement Status. OPA rule: block any agentic tool action that would transmit or store PHI with a vendor whose baa_status is not baa_executed_active. Block AI model training on PHI when status is not_required_no_phi_access without first applying de-identification. (Hipaa 164 504: HIPAA 45 CFR 164.504(e), BAA requirements for business associates)

Control ideas

These patterns describe possible controls, not active rules. Confirm applicability, implement the control, and test its effect on the application.

Enforce before the action

Pass the request and your business action to this function. The core SDK checks policy before the action runs and again before its result is released. A deny or review decision means the action never runs.

import { Veriproof } from '@veriproof/sdk-core';
import type { GovernedResult, IndustryFact, JsonValue } from '@veriproof/sdk-core';

const veriproof = Veriproof.fromEnv();

export async function runProtectedAction<TInput extends JsonValue, TValue>(
  request: TInput,
  action: (input: TInput, signal: AbortSignal) => Promise<TValue>,
): Promise<GovernedResult<TValue, TInput>> {
  // Catalog values for this vertical. Replace them with facts from the current workflow.
  const industry: IndustryFact[] = [
    { attribute: "healthcare.clinical_trial.solution_category", policyInput: "healthcare_clinical_trial_solution_category", value: "clinical_trials" },
    { attribute: "healthcare.condition.clinical_status", policyInput: "healthcare_condition_clinical_status", value: "active" },
    { attribute: "healthcare.observation.status", policyInput: "healthcare_observation_status", value: "registered" },
  ];

  // Policy runs before action() and again before the result is released.
  // A deny or review decision means action() never runs.
  return veriproof.govern(
    "healthcare.life.sciences.evaluate",
    request,
    ({ input, signal }) => action(input, signal),
    { industry },
  );
}

• Replace the sample values with facts from the current workflow. Rules read them under input.snapshot.industry.
• Test both permitted and blocked actions. Confirm that a blocked action never reaches your business function.
• Only completed, completed_with_warning, and transformed results carry a released value.

For review decisions, follow the Human Review guide to configure continuation. Observe remains available when you need to record activity without enforcing a decision.

Set up the Healthcare & Life Sciences example. See the API reference for TypeScript, Python, or .NET.

Selected vocabulary categories

This page uses the vocabulary JSON distributed with the documentation. Check its version when comparing it with an installed SDK.

Download the vocabulary JSON for offline review or automated comparisons.

Use the SDK reference for configuration and supported APIs. Keep vocabulary selection separate from the compliance team's assessment of applicable requirements.