Oracle Health stays the system of record for the encounter. Dock is the system of record for what the agent inferred and which clinician signed off. The agent reads the Millennium FHIR R4 feed, writes an interpretive brief to a Dock row, and the named physician approves or rejects before anything posts back. Epic shops use the same pattern against their own FHIR endpoints. The encounter never moves. The interpretation lives in Dock.
The architecture
Oracle Health (Cerner Millennium) and Epic stay the systems of record for the raw clinical data: encounters, problem lists, medication orders, labs. Dock is the system of record for what the AGENT INTERPRETS from that data. Each Dock row carries a pointer back to the platform record (oracle_encounter_id or epic_encounter_id), the agent identity, the reviewing clinician, the decision, and the timestamp. The agent re-fetches platform data via fresh FHIR reads when it needs current state. We never cache the chart. We cache the interpretation.
See Dock for healthcare operations and Dock for compliance for context.
The Dock surface
Table: oracle_encounter_briefs
| oracle_encounter_id | patient_mrn | agent | draft_summary | reviewing_clinician | decision | reviewed_at |
|---|---|---|---|---|---|---|
| 9F3-44218 | 008812 | triage-agent-v3 | "Likely viral URI. No red flags. Supportive care, recheck 72h." | Dr. K. Mensah | approved | 2026-05-30T09:14Z |
| 9F3-44219 | 008813 | triage-agent-v3 | "Elevated troponin. Cards consult, admit telemetry." | Dr. K. Mensah | escalated | 2026-05-30T09:21Z |
| 9F3-44220 | 008814 | triage-agent-v3 | "Med rec flags lisinopril + spironolactone interaction." | Dr. R. Alvarez | rejected: clinical judgment differs | 2026-05-30T09:38Z |
Three real rows. Each pins the agent's reasoning to a clinician's name.
The workflow
The triage agent pulls a fresh FHIR Encounter, Condition, and Observation bundle from Oracle Health. It drafts a structured brief into oracle_encounter_briefs with the encounter ID as pointer. A clinician opens their Dock queue, reads the brief alongside the live chart, and approves, escalates, or rejects. Approval triggers a consent-gated write back to Oracle Health: a clinical note attributed to the clinician, with the agent named as drafter. Rejection writes nothing. The Dock row records both. This is the dangerous ops contract applied to clinical writes.
Why this matters
HIPAA Security Rule 45 CFR 164.312(b) requires covered entities to "implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information" (eCFR). Audit controls are a standard, not addressable. When an agent participates in clinical workflow, that audit trail has to name the agent, the human reviewer, and the decision. Dock rows do that natively. See agent audit and compliance for the full pattern.
Oracle Health exposes encounters through the Millennium Platform FHIR R4 APIs with SMART on FHIR and OAuth 2.0 (Oracle docs). The agent gets a scoped token tied to its agent identity, and writes back only after a named clinician approves. No service accounts.
The architecture survives platform migration. If a health system moves from Cerner to Epic, the pointer column swaps and the interpretive history stays intact. The agent's track record is portable because it lives in Dock, not in the EHR.
CTA
Read the healthcare cluster for the full ambulatory, inpatient, and revenue cycle patterns.
FAQ
Does Dock replace the EHR? No. Oracle Health or Epic remains the system of record for clinical data. Dock holds the agent's interpretation and the clinician's attributed review. The chart write happens through the EHR's own API.
How does the agent authenticate to Oracle Health? Through SMART on FHIR with OAuth 2.0, using a scoped token bound to the agent's identity. The token is rotatable and revocable.
What happens when a clinician rejects the agent's brief? The Dock row records the rejection with the clinician's name and timestamp. No write occurs to the EHR. The rejection becomes training signal and audit evidence both. See agent audit and compliance.
Does this work for Epic shops? Yes. Same pattern, different pointer column. The agent reads Epic FHIR endpoints, writes the brief to Dock, and the clinician approves before anything posts back. The separation is platform-agnostic.
