Free tool
Standfast Guardrail
Onboarding checks a connection once. Guardrail checks it every day.
Every source feeding a health information exchange drifts. An EHR upgrade moves a field, a lab starts reusing MRNs, a front desk starts typing birthdates as free text. Nobody sends bad data on purpose, and nobody gets told. The records just land in the review queue.
Standfast Guardrail watches each source's feed every day and tells your team which source changed, what changed, and what it's likely to cost in manual review. It runs inside your environment, reads a copy of the feed, and keeps no raw PHI.
- Standard
- HL7 v2 ADT and ORU
- Runs
- Inside your environment
- Keeps
- Counts, patterns, salted hashes
- Cost
- Free
The problem
Onboarding a source is careful work. Someone reads the spec, maps the fields, runs the test messages, and signs off. Then the connection runs for years, and the only time anyone looks at it that hard again is an audit.
Between those two moments the source changes. An EHR upgrade ships. A lab reuses a block of MRNs. A front desk starts typing birthdates as free text because the new form let them. None of it is anyone's fault, and none of it is announced. The records just land in the manual-review queue, where the cost shows up weeks later as a number nobody can trace back to a source.
The dashboards most exchanges already run show the trend. What they leave to people is the loop: which source, what changed, what it's likely to cost, and whether the fix actually landed. Guardrail is built for that loop. It was built against the NC HealthConnex Data Target v3.2, and it generalizes to any exchange that publishes one.
What it does
Every source, every day, compared against its own history.
Checks every message
Each message is checked against the exchange's data target and a set of plausibility rules: placeholder names, default or free-text dates of birth, an SSN sent as the MRN, codes outside their sets. Every finding carries text, never color alone.
Compares today with the baseline
Each feed is profiled as counts and format patterns and compared with its own learned baseline, so an EHR upgrade, MRN reuse, or a source going quiet shows up the day it starts. A flu surge can be marked expected and stays quiet.
Estimates the review cost
A transparent stand-in matcher follows the hub's published method and charges each likely review-queue addition to a source and a cause. It's an estimate, labeled as one, and it's the number that turns a finding into a priority.
Writes the fix, tracks the fix
A one-page fix report per source, in the source's own terms: what changed, what it likely means at the source, the data target line, and the fix. The tracker follows each issue until the feed itself shows the fix. Only the feed can mark an issue verified.
Every source's status and estimated daily cost. Status always carries text, never color alone.
The review-queue cost of drift, with incidents as dashed markers. The toggle switches to watched monthly.
The one-page fix report, with the estimated cost and restore to matching.
The tracker. Only the feed can mark an issue verified.
One day, in detail
Day 45 of the demo, a Tuesday. Piedmont Family Medicine, a synthetic ambulatory practice, has sent a clean feed for six weeks. Overnight its EHR is upgraded, and the next morning's 206 messages carry four changes at once: a new sending facility, PFM0006 to PFM-EPX; a new assigning authority, PFM to PFMX; a new MRN format, NNNNNNN to AAA-NNNNNNN; and sex codes that switched from F and M to 2 and 1. Every one of the 206 messages is affected. Every one is still valid HL7.
Guardrail raises all four the same day. Every returning patient now arrives with an identifier the hub has never seen, so none of them link deterministically. They drop to probabilistic matching, the sex codes no longer agree, and they go to review. The fix report puts the cost at about 24 records a day added to the manual-review queue, labeled as the estimate it is, and names the fix: map the new facility code and assigning authority back to the old ones at the interface, keep the MRN format, and ask the hub to restore the source's records to matching.
The remap lands on day 75. The feed shows it, the four findings resolve, and on day 77 the tracker marks the issue verified. Not because someone closed a ticket. Because the data moved. A monthly dashboard would have seen the change on December 1, three weeks later.
All of it is synthetic: eight fictional sources, 90 days, one story. No real feed was used.
How it runs
Guardrail reads a copy of the feed: a copy of the SFTP drops, a mirror of the incoming connection, or the message archive. It runs on its own host inside the exchange's environment and is never in the delivery path. If Guardrail stops, nothing else stops. It makes no queries against the EMPI and no writes anywhere, not to the hub, not to the sources, not to the feed.
What it keeps is deliberately small: daily counts per source, format patterns, the most frequent code values per field, salted hashes of the identifiers it needs to notice reuse, and the findings themselves. It never keeps message text, names, addresses, phone numbers, SSNs, or raw MRNs, and a date of birth survives only as a salted hash. The one exception is documented rather than hidden: when a source mis-maps free text into a coded field, up to twenty of those values per field per day are stored so the drift can be reported. Guardrail flags that the day it starts, and the security document that ships with the code says exactly how it works.
A statewide day, about 2 million messages from 20,000 sources, is checked and profiled in under 30 seconds on one laptop-class machine. It counts as the feed flows by; it never pins a CPU.
What it doesn't do
Guardrail stops the drift and the defaults. The ambiguous pairs stay with your reviewers: a typo that is still a real date, a plausible name on the wrong record, the single wrong value that only a person can call. Nothing here matches, fixes, or rebuilds anything in production, and nothing writes back.
It complements the hub's EMPI and its data-quality dashboards. It doesn't replace them. The EMPI matches, the dashboards show the trend, and Guardrail watches each feed before the EMPI sees it, so the people on both ends find out the day something changed instead of the month after.
Why it's free
Guardrail is free because it was built to be useful. It was built from the outside, from the specifications and material an exchange publishes, and the thing we want from it is to see it run in production on a real feed.
There is one more reason, and it sets the tone of every line the tool writes. Nobody is treated as a bad actor. An upgrade ships, a field moves, and the people on both ends find out weeks later. Making the feeds easier to measure, monitor, and manage means everyone can do the right thing sooner. That is worth giving away.