Defense · DSI Source Attributes
DSI Source Attributes for defense AI workflows
DSI Source Attributes in defense AI workflows: what compliance requires, who asks for evidence, and the records to keep.
01 / The rule
What DSI Source Attributes requires
Developers of Health IT Modules certified to 45 CFR 170.315(b)(11) under the ONC Health IT Certification Program; hospitals and clinicians are not directly regulated.
- 01Support all 31 source attributes for each predictive DSI and 13 for each evidence-based DSI the developer supplies.
- 02Give a limited set of identified users complete, up-to-date plain-language access to those attributes.
- 03Show when validation, local performance or update-schedule information is not available for a predictive DSI.
- 04Let identified users record, change and access source attributes, including extra attributes for predictive DSIs.
- 05Apply risk analysis, risk mitigation and governance to each supplied predictive DSI across eight characteristics, including validity, fairness and safety.
- 06From January 1, 2025, review and update source attributes and risk practices on an ongoing basis (45 CFR 170.402(b)(4)).
02 / In this sector
In a defense AI workflow
A predictive DSI is any technology that learns relationships from training data and outputs a prediction, classification, recommendation, evaluation or analysis, so machine-learning and other AI models in certified EHRs fall squarely in scope. The attributes amount to a mandated model card for those tools.
Program office leads and ATO-package owners.
NIST AI RMF · DoW RAI · OMB M-25-21.
03 / Records
Records to keep
- 01Source attribute record for each supplied predictive and evidence-based DSI
- 02External validation and fairness test results by demographic group
- 03Intervention risk management analysis and mitigation log
- 04Dated review history showing attributes kept current
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Federal Register (ASTP/ONC)
RELATED
Related: DSI Source Attributes: the full guide · DSI Source Attributes for medicine · DSI Source Attributes for law · DSI Source Attributes for education