Documentation Audit Engine · Air-Gapped · Evidence-Grade
STM checks your clinical notes against treatment plans, catches copy-paste, flags unusual changes, and generates evidence you can hand to an auditor—without sending patient data to the cloud.
# No external calls. No data egress.
docker run -p 8000:8000 \
-v ./data:/app/data \
stm-engine:latestSix checks that surface audit risks, training needs, and documentation problems—before they become liabilities.
Staff gradually modify procedures until what's delivered doesn't match the written BIP/ISP. STM compares notes against authorized plans and flags divergence.
Identical notes across multiple sessions are an audit red flag. STM detects templated documentation and suspiciously similar text.
Notes that never change suggest either copy-paste or lack of clinical progress. STM flags documentation that shows no meaningful variation over time.
Compare what RBTs document against what BCBAs supervise. Misalignment indicates training gaps or communication breakdowns.
Sudden shifts in documentation content may indicate clinical events, staff changes, or problems. STM flags sessions that deviate significantly from baseline.
If you use AI to help write notes, STM can verify summaries against source content—catching hallucinations or omissions before they're signed.
Keyword search misses context. Sentiment analysis misses function. LLMs hallucinate and require data egress. STM measures what actually changes in your documentation over time.
Clinical signal lives in session notes. "Client was upset" and "emotional dysregulation following tangible denial" describe the same event—but keyword search treats them as unrelated.
Sending PHI to OpenAI or Anthropic creates compliance headaches. STM runs entirely on-prem with no external API calls.
Auditors look for stagnation, copy-paste, and protocol drift. If you can't prove documentation integrity, you lose revenue.
Export notes from your EHR. Run STM. Get a report showing what to review.
Compares each session note against the authorized treatment plan. Flags when documentation describes procedures that weren't approved.
Measures how documentation changes over time. High change rate may indicate crisis or breakthrough. Zero change indicates stagnation or copy-paste.
Compares RBT session notes against BCBA supervision notes. Flags gaps that indicate training needs or miscommunication.
For engineering teams: STM uses sentence embeddings to represent clinical text as vectors, then measures distances and trajectories over time. No LLM generation—just deterministic, reproducible analytics.
POST /v1/analysis/audit
POST /v1/analysis/alignment
POST /v1/analysis/drift
GET /v1/artifacts/{id}Job-style endpoints. Returns artifact URLs + metrics JSON.
// POST /v1/analysis/audit
{
"client_id": "3920-AC",
"protocol": {
"text": "Implement extinction for vocal stereotypy. Do not provide verbal attention.",
"source": "BIP v2.1"
},
"sessions": [
{
"session_id": "sess_892",
"date": "2024-12-20",
"text": "Client was yelling. I told him to use his inside voice."
}
]
}
// Response
{
"alerts": [
{
"type": "protocol_mismatch",
"severity": "high",
"session": "sess_892",
"finding": "Note describes verbal attention during extinction protocol",
"protocol_says": "Do not provide verbal attention",
"note_says": "I told him to use his inside voice",
"billing_risk": "Session may not be billable as written"
}
],
"artifacts": {
"report_url": "/artifacts/3920-AC/audit_report.html"
}
}Deploy inside your infrastructure. No data leaves your environment. No vendor API calls.
# Deploy in your VPC. No external calls.
docker run -p 8000:8000 \
-v ./data:/app/data \
stm-engine:latest
# Run an audit report
curl -X POST http://localhost:8000/v1/analysis/audit \
-H "Content-Type: application/json" \
-d @./data/sessions.jsonSingle container + mounted volume. Wire it to your EHR export pipeline.
Embedding model runs locally. No OpenAI. No Anthropic. No data egress.
Accepts CSV/JSON exports from any EHR or practice management system.
HTML reports for clinical review. JSON metrics for dashboards. Manifest for reproducibility.
Set retention policies. Delete on schedule. Meet your compliance requirements.
STM outputs are designed for QA teams, clinical directors, and auditors. Show the problem. Preserve the evidence.
STM is good at some things and bad at others. Here's what to know.
"Did not hit" and "hit" can look similar to embedding models. STM mitigates this with preprocessing and by keeping evidence visible for human review.
Different staff use different words for the same thing. STM shows where vocabulary diverges—but humans decide if it matters clinically.
Notes can change because the setting changed, not because the client changed. STM supports context conditioning but can't read minds.
STM surfaces what to look at. It doesn't tell you what to do. Human judgment remains the decision boundary.