Back to the checkagent tools not detected in this browser

Built for the OpenAI WebMCP Challenge

Nine tools, one human gate. The agent can do everything except decide.

Small practices are already running AI over patient information — ambient scribes, chatbots, dictation — usually without a vendor agreement, documented consent, or a written risk analysis. This page is a three-minute diagnostic that an agent can run conversationally, with every result mirrored on screen for the human.

01 / 04 — THE WORKFLOW

  1. 01The agent calls start_readiness_check with specialty, clinician count, state and the AI tools in use. The workspace opens on screen.
  2. 02It asks the ten questions in its own words and records each with answer_check_question. The stepper advances live.
  3. 03get_readiness_score returns the weighted score and the three sharpest exposures — free, never gated.
  4. 04explain_risk turns any exposure into plain language with the statute reference.
  5. 05email_remediation_roadmap opens a real dialog. The agent cannot fill it in; the promise resolves only when the human submits or cancels.

02 / 04 — SETUP

ChatGPT desktop browser

Open this page in ChatGPT's in-app browser. Tools register in the top-level document on load, so the badge above turns green with no further setup. Ask it to run the readiness check.

Chrome

Enable chrome://flags/#enable-webmcp-testing, restart, then load this page with a WebMCP-capable agent extension attached.

Without either, nothing breaks: the identical ten-question click-through is on the home page.

03 / 04 — TOOL DIRECTORY

check_ai_vendor_baa

read only

Tells a practice whether a named AI vendor will sign a business associate agreement on a given subscription tier, and what the eligible path looks like if it will not. Use it the moment someone names a tool they already use, even before any readiness check has started. Returns the vendor verdict, the consumer-versus-enterprise distinction and a line to verify with the vendor. This is general education and never a determination about the practice.

{
  "type": "object",
  "properties": {
    "vendor": {
      "type": "string",
      "enum": [
        "openai_chatgpt",
        "anthropic_claude",
        "google_gemini",
        "microsoft_copilot",
        "nuance_dax",
        "abridge",
        "suki",
        "freed",
        "nabla",
        "other"
      ]
    },
    "tier": {
      "type": "string",
      "enum": [
        "consumer_free",
        "consumer_paid",
        "team_business",
        "enterprise",
        "api",
        "not_sure"
      ]
    }
  },
  "required": [
    "vendor"
  ],
  "additionalProperties": false
}

check_state_ai_rules

read only

Explains the recording-consent rule in one US state and what it means for an ambient scribe sitting in the room. Use it when a practice names its state or asks whether it needs the patient's agreement before recording. Returns whether the state is all-party or one-party, any AI-disclosure statute we are confident about, and the practical implication. General education only, not a legal determination.

{
  "type": "object",
  "properties": {
    "state": {
      "type": "string",
      "enum": [
        "AL",
        "AK",
        "AZ",
        "AR",
        "CA",
        "CO",
        "CT",
        "DE",
        "DC",
        "FL",
        "GA",
        "HI",
        "ID",
        "IL",
        "IN",
        "IA",
        "KS",
        "KY",
        "LA",
        "ME",
        "MD",
        "MA",
        "MI",
        "MN",
        "MS",
        "MO",
        "MT",
        "NE",
        "NV",
        "NH",
        "NJ",
        "NM",
        "NY",
        "NC",
        "ND",
        "OH",
        "OK",
        "OR",
        "PA",
        "RI",
        "SC",
        "SD",
        "TN",
        "TX",
        "UT",
        "VT",
        "VA",
        "WA",
        "WV",
        "WI",
        "WY"
      ]
    }
  },
  "required": [
    "state"
  ],
  "additionalProperties": false
}

start_readiness_check

Opens the ten-question readiness check on screen with the practice profile filled in. Use it once, after you know the specialty, how many clinicians there are, the state and which AI tools are already in use. Returns the list of question ids to work through in order. Nothing here is a determination about the practice, and no patient information should ever be entered.

{
  "type": "object",
  "properties": {
    "specialty": {
      "type": "string",
      "enum": [
        "primary_care",
        "therapy_behavioral",
        "dental",
        "dermatology",
        "pediatrics",
        "other"
      ]
    },
    "clinician_count": {
      "type": "integer",
      "minimum": 1,
      "maximum": 10
    },
    "state": {
      "type": "string",
      "enum": [
        "AL",
        "AK",
        "AZ",
        "AR",
        "CA",
        "CO",
        "CT",
        "DE",
        "DC",
        "FL",
        "GA",
        "HI",
        "ID",
        "IL",
        "IN",
        "IA",
        "KS",
        "KY",
        "LA",
        "ME",
        "MD",
        "MA",
        "MI",
        "MN",
        "MS",
        "MO",
        "MT",
        "NE",
        "NV",
        "NH",
        "NJ",
        "NM",
        "NY",
        "NC",
        "ND",
        "OH",
        "OK",
        "OR",
        "PA",
        "RI",
        "SC",
        "SD",
        "TN",
        "TX",
        "UT",
        "VT",
        "VA",
        "WA",
        "WV",
        "WI",
        "WY"
      ]
    },
    "ai_tools": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "ambient_scribe",
          "general_chatbot",
          "ehr_builtin_ai",
          "dictation",
          "other",
          "not_sure"
        ]
      },
      "minItems": 1,
      "maxItems": 6
    }
  },
  "required": [
    "specialty",
    "clinician_count",
    "state",
    "ai_tools"
  ],
  "additionalProperties": false
}

answer_check_question

Records the practice's answer to one of the ten questions and advances the visible progress. Use it once per question, after the human has actually answered in their own words, choosing the option that matches. Returns the recorded answer and which question comes next. Answers stay in the browser; never pass anything that identifies a patient.

{
  "type": "object",
  "properties": {
    "question_id": {
      "type": "string",
      "enum": [
        "q01",
        "q02",
        "q03",
        "q04",
        "q05",
        "q06",
        "q07",
        "q08",
        "q09",
        "q10"
      ]
    },
    "answer": {
      "type": "string",
      "description": "One option value for that question. For q02 pass a comma-separated list of tool values."
    }
  },
  "required": [
    "question_id",
    "answer"
  ],
  "additionalProperties": false
}

get_readiness_score

read only

Reveals the readiness score out of 100 and the three sharpest exposures on screen, with the animated score ring. It is always free and never gated behind an email. Use it as soon as the questions are answered, or at any point to show where the practice stands. Returns the score, the ranked risks and the plain-language reason each one matters.

{
  "type": "object",
  "properties": {},
  "required": [],
  "additionalProperties": false
}

explain_risk

read only

Explains one exposure in plain language: what is exposed, why it matters in one sentence, what fixes it, and the statute reference behind it. Use it when the practice asks why a particular gap is on their list. Returns the explanation and the related safeguards from the thirty-control library. This is general education, not a determination about the practice.

{
  "type": "object",
  "properties": {
    "risk_id": {
      "type": "string",
      "enum": [
        "risk_vendor_baa",
        "risk_consumer_tier",
        "risk_recording_consent",
        "risk_human_review",
        "risk_risk_analysis",
        "risk_written_rule",
        "risk_officer_training"
      ]
    }
  },
  "required": [
    "risk_id"
  ],
  "additionalProperties": false
}

email_remediation_roadmap

Offers the personalised remediation roadmap. This tool takes no arguments and cannot accept an email address: it opens a dialog on screen where the human types their own address and ticks consent themselves. Use it after the score has been revealed and the practice wants the full roadmap. It waits for the human, then returns whether they sent it and opens the roadmap page.

{
  "type": "object",
  "properties": {},
  "required": [],
  "additionalProperties": false
}

open_21_day_mission

Hands the practice over to the 21-day adoption mission on lab.hipaa.technology, carrying their profile and top exposure in the link. Use it once the roadmap is on screen and they want a paced way through it. Opens the link in a new tab and shows it on screen. Returns the link that was opened.

{
  "type": "object",
  "properties": {},
  "required": [],
  "additionalProperties": false
}

book_compliance_review

Shows the booking card for a 20-minute review with a human from Safe AI Technology. Use it when the practice asks to talk to a person rather than work through the roadmap alone. It only puts the card and the link on screen — the human books the time themselves. Returns the booking link.

{
  "type": "object",
  "properties": {},
  "required": [],
  "additionalProperties": false
}

Return contract

Every tool returns { display, spoken, next_step, disclaimer }. display is the structured result, spoken is written to be read aloud, next_step names exactly one action, and disclaimer carries the standing language on every scoring tool.

04 / 04 — SAFETY BOUNDARIES

AI may

  • Inspect the ten questions and the safeguard library
  • Ask the practice each question in its own words
  • Record answers and advance the check
  • Score the answers and explain every exposure
  • Stage the roadmap offer and open the dialog

Human must

  • Type their own email address and tick consent
  • Book the 20-minute review themselves
  • Make any determination about their own practice
  • Decide what the practice does about a gap
  • Keep patient information out of the conversation entirely

Never enter protected health information.

Implementation evidence

  • src/webmcp/registerTools.tsThe nine tools, schemas, and the shared return contract
  • src/webmcp/useWebMcp.tsStrict-Mode-safe registration and teardown in the top-level document
  • src/lib/check/questions.tsThe ten questions, options, CFR references and weights
  • src/lib/check/scoring.tsWeighted scoring, risk ranking, state overlay, roadmap builder
  • src/lib/check/store.tsBrowser-only state, activity log, and the promise-based email gate
  • src/lib/check/gate.tsThe single conversion path shared by agents and click-through visitors
  • src/lib/hipaa/controls.tsThe thirty-safeguard library that powers the roadmap
lab.hipaa.technology — the 21-day mission

This is general education, not legal, compliance, security, or clinical advice. It does not determine HIPAA compliance and does not satisfy the security risk analysis required under 45 CFR 164.308(a)(1)(ii)(A). No HIPAA certification is offered or implied — HHS does not recognise any HIPAA certification.