I Work at a Military Hospital, and I Just Claimed Three

A few days ago I joined a coalition called Reverse Alignment. Its argument fits on one line: we are building AI faster than we are building the society that has to receive it.

That line stopped me, because it named something I feel every day. The models keep getting stronger, and yet what I actually work with is a system that has been running for more than twenty years and was never built to receive anything like this.

What reverse alignment means

Usually when we talk about AI alignment, we mean making a model behave in line with human values. This coalition flips that around. They point out that even a perfectly aligned model will underdeliver, or do real harm, if you drop it into an economy, a government, or a hospital that is not ready for it.

So the neglected work is redesigning our institutions, norms, and workflows so that society can absorb AI safely. They call that reverse alignment. AI has to fit us, but we also have to be ready for it.

They list twelve grand challenges and ask people from every sector to claim one. When you join, there is an option that says bring a challenge into your own organization or sector. I chose that, and I picked three: identity, privacy, and provenance.

I did not pick them at random. These three are exactly what I handle in a hospital every day, and a hospital is the least forgiving place on earth to get them wrong.

Challenge one: identity

Start with a very unglamorous question. A patient is standing in front of you. How do you know they are really who they say they are?

We used to lean on the national health card and a clerk checking by hand. But once AI makes it nearly free to forge a document, a face, or a whole synthetic persona, that is no longer enough. And the problem has a second half: you need to prove this is the right person, but you do not always need to know everything about who they are.

The coalition calls this a personhood credential, a way to prove cryptographically that you are a real, unique human without laying your identity bare. That sounds abstract until it lands in a hospital. The SMART on FHIR work I do sits on top of an OAuth2 authorization layer that decides who gets which slice of data. Whether identity is verified correctly is the foundation the whole thing stands on.

Challenge two: privacy

For a long time I also thought privacy had only two settings: everything open, or everything locked away. Doing this work taught me it is neither.

What you actually need is to reveal only the exact slice a situation calls for, and nothing more. What the registration desk needs to know, what the attending physician needs, and what an insurance claim needs are three completely different slices. Yet a traditional hospital information system is often one key that opens every door. Once you are logged in, you can see everything.

OAuth scopes exist precisely for this. They carve up what you are allowed to see into narrow pieces. The person handling a claim gets the claim scope and sees only the few fields a claim requires. The rest of the record stays out of reach. In a hospital this is not a bonus feature, it is the baseline. A patient's data should be the patient's to control, not something anyone with a login can read in full.

Challenge three: provenance

The third one is the easiest to overlook and, I think, the one that matters more every month: for any piece of data, who produced it, when, and has it been altered?

In an era where a convincing fake costs nothing, how do you know an official looking lab report or a set of orders is real? Medical records get used in lawsuits, in insurance claims, in clinical decisions. Their trustworthiness cannot rest on looking authentic.

That is what provenance solves. Every record should be traceable back to who produced it, at what time, under what identity, and signed for. In my system I use digital signatures to fill that gap, so every document carries its own history instead of drifting through the system as a file with no origin.

Why a hospital

You might ask which industry does not need these three things. Why a hospital.

Because a hospital is the stress test for all three at once. Here, wrong data can cost a life. Here, a privacy leak makes the news. Here, every record can become legal evidence. Finance may have the budget for this and tech companies may have the headcount, but hospitals are often short on both while being the least allowed to fail. If these three hold up in a hospital, moving them to another sector is comparatively easy. And if a hospital cannot manage them, then what other places are promising is mostly just talk.

How I actually do it

Here is the part I find a little funny. The person doing all of this is, more or less, just me.

I use Rails, with AI assisted development, to wire SMART on FHIR piece by piece into a hospital system that is actually live. Identity and authorization run on OAuth2, data is standardized with FHIR, and provenance and accountability are filled in with digital signatures. This is not a demo sitting in a lab. It runs, and people use it.

I gave this whole thing a name: Omakase Smart Hospital. The name borrows the omakase spirit from Rails. Rather than hand picking every technical decision from scratch, you accept a set of well considered defaults that already fit together, and you spend the energy you saved where it actually matters. A hospital needs to adopt too many things for one person to reinvent every wheel, so I choose to stand on the shoulders of open standards. FHIR, OAuth, SMART, these are specifications other people already thought through, and I use them directly so my limited time goes into the hardest and most valuable part: fitting them into real hospital workflows. Identity, privacy, and provenance are not three separate projects to me. They are three foundations that a single Omakase smart hospital was always supposed to grow properly.

I keep coming back to one belief: a lot of what we assume needs a whole team and a big budget can, with today's tools, be moved by one person. That is what I want to bring into this coalition. Not another polished white paper, but a working example of one person, in a resource constrained military hospital, actually building these three challenges out with open standards.

What comes next

I claimed these three challenges, but honestly this is just the beginning. The coalition is still very early, and a lot is still taking shape. My plan is to document this stretch of the road first, in the open, in a way other people can copy, so whoever comes next has a path to follow.

Because reverse alignment, in the end, is not one genius making AI stronger. It is a great many people, each in their own corner, laying down the road that receives it, one segment at a time. My segment happens to be a hospital.