The hospital operating system
Clinical, financial and operational intelligence on one event-driven substrate — with a live digital twin of the patient and the building.
EVENT MESH
Everything is an event
Orders, results, bed moves, ledger posts — one NATS mesh, realtime read-models, zero polling.
PATIENT 360
The 3D patient
Diagnoses, labs and vitals anchored on a 3D body. Multiplayer cursors, voice orders, launchpad to every module.
AI COWORKERS
Propose, never act
Named agents with plane-scoped DB grants. Every proposal lands in a human inbox — accept, edit, reject.
DECISION TWIN
Simulate before you commit
7-agent DES + Monte-Carlo on your live bed logs, OR costing and claims facts.
EVENT MESH
Everything is an event
Orders, results, bed moves, ledger posts — one NATS mesh, realtime read-models, zero polling.
PATIENT 360
The 3D patient
Diagnoses, labs and vitals anchored on a 3D body. Multiplayer cursors, voice orders, launchpad to every module.
AI COWORKERS
Propose, never act
Named agents with plane-scoped DB grants. Every proposal lands in a human inbox — accept, edit, reject.
DECISION TWIN
Simulate before you commit
7-agent DES + Monte-Carlo on your live bed logs, OR costing and claims facts.
Latest from medOS
Shipping in the open
2026-06-10
Introducing the Bot Extension Substrate
One automation engine for twin, PRM, marketing, insurance and intelligence — every action lands as a human-approved proposal.
Epidemiology to capacity — one map, six lenses
Inventory stream live: 3,892 balances, consume-to-charge
Voice attestation ships — biometric sign-off for AI orders
One substrate, every department
Everything a hospital runs on, built as one system
One event mesh
Every order, result, bed move and billing ledger entry is a hospital event on a NATS mesh. 16 microservices project into realtime read-models — no nightly batch, no polling.
AI cowork substrate
Coder, nurse, pharmacist and RCM coworkers operate as named identities with plane-level DB grants. Every proposal lands in a human inbox — accept, edit or reject. That decision is the training label.
Bot Extension Substrate
One automation engine drives PRM, marketing, insurance and intelligence bots. Three seams — trigger sources, medos.* SDK capabilities, cowork identity — are the only things extended. medos.propose() is the universal safety output.
HORUS Decision Twin
7-agent DES + Monte-Carlo simulator calibrated on your live operational data. Workforce, supply and reimbursement scenarios run before you commit. Every recommendation is population-level — the device line is a hard invariant.
CDS rule engine
NEWS2, MEWS, qSOFA, sepsis, hyperkalemia, NPO violation — every vitals write auto-fires CDS. Rules are data rows editable live at /admin/cds-rules. Alerts surface via global FAB + inline badge.
Universal billing ledger
Charge-capture pricing: every stock issue and procedure auto-resolves a menu price and posts to an append-only billable_ledger. ER, IPD, OR, LR all write to the same spine. Country rule packs handle NHSO, PhilHealth and Kaigo.
Platform primitives
Use one or all. Best of breed, pre-integrated.
EVFS Storage
Store, organize and serve large clinical files — DICOM, scans, documents — on IPFS-backed sovereign storage.
Realtime
Build multiplayer clinical surfaces — presence, cursors and per-row locks on every chart.
Vector & RAG
Turn documents and outcomes into a private, de-identified corpus — embeddings stay in-region.
Ollama · local models
medOS LLM platform
Data APIs
Instant, standards-native FHIR R4 + REST APIs over every read model.
Realtime everywhere
Presence, cursors and edit locks on every surface
Nurse notes, patient profiles, ICU flowsheets and the 3D patient room are all multiplayer — the same presence substrate runs under every miniapp.
14:22 Patient arrived via EMS, chest pain onset 13:40, GCS 15.
14:25 12-lead ECG obtained — ST changes in II, III, aVF
14:27 ASA 300mg given per protocol. Cardiology paged.
Allergies
Penicillin — anaphylaxis
Medications
Metformin 500mg BID
Insurance
UCS — verified
Next of kin
Somchai P. (brother)
| row | 06:00 | 08:00 | 10:00 | 12:00 | 14:00 |
|---|---|---|---|---|---|
| MAP | 72 | 75 | 71 | 69 | 74 |
| HR | 88 | 92 | 95 | 101 | 97 |
| SpO2 | 96 | 95 | 94 | 93 | 95 |
RN Ploy · comment on HR 12:00
Trending up post-wean — keep on 2h obs.
Patient Digital Twin
One patient, every signal, in 3D
Patient 360 puts the chart on the body. Every vital recorded anywhere — triage kiosk, bedside monitor, HL7 feed — lands in the unified observation pipeline and pins itself to the anatomy it belongs to.
GCS, pupils and sedation scores chart straight to the head.
Troponin trends and CDS alerts pin to the chest in realtime.
Drains, wounds and surgical notes live on the operative site.
DVT risk and ambulation plans track the lower limbs.
HORUS Atlas
The campus as a living model
Rotate the campus, zoom into a tower, drill into a floor — occupancy, queues and RTLS movers render on the architecture itself.
HORUS Network Intelligence
From epidemiology to capacity — one map, many lenses
The same facility network rendered through switchable intelligence lenses: disease spread, occupancy heat, referral corridors, supply routes — every recommendation grounded in the Decision Twin.
Network lens
Epidemiology lens
dengue surge scenario · ไข้เลือดออก — district forecast
SEIR modelCompliance
HIPAA-compliant from day one.
Build with confidence.
Row-level security on every read model, plane-scoped grants, per-inference audit and regional data residency — compliance is the architecture, not an add-on.
Automation Bots
One platform for your agents.
Memory, tools and data in one place.
Agents run as first-class identities with capability-gated SDKs, full audit trails and a human inbox on every outward action. The bot org chart is the picture of the mesh.
From contract to go-live
Configure your deployment in four steps
Market packs, modules and connectors are all data — try the same configurator our deployment engineers use.
STEP 1 OF 4
Profile your facility
Pick your market and facility type — this selects the market pack: insurance scheme tables, locale, terminologies.
Bot Extension Substrate
One automation engine.
Four domains.
The shipped bot engine is domain-neutral. Only three seams are extended — trigger sources, medos.* SDK capabilities, and cowork identity — to drive PRM, marketing, insurance and intelligence bots from the same executor.
- medos.propose() — The linchpin — every outward action funnels through a cowork_proposals row. Human Accept/Edit/Reject. No autonomous send, no clinical write.
- Plane isolation — Clinical / Operational / Growth enforced at the DB-grant level. A Growth bot physically cannot read a chart.
- Extension kit pattern — Adding a domain = seed rows (trigger sources + capability grants + template bots). Zero TypeScript. Same idiom as market packs.
SINGLE ENGINE
trigger → bot-executor (Deno) → medos.* SDK → medos.propose() → Ack Inbox
recall outreach
→ medos.propose
OR utilization low
→ medos.propose
eligibility lapsed
→ medos.propose
forecast breach
→ medos.propose
Invariant: every outward action funnels through medos.propose — human Accept/Edit/Reject. No autonomous send. No clinical write.
Open step-down unit (12→10 beds, budget-capped)
optimizedRenegotiate NHSO scheme — denial rate 18%→9%
4 sign-offs pendingIn-source blood supply — 3 scenario runs
decidedHITL gate · 4 sign-offs release optimized → decided
HORUS Decision Twin
Simulate the decision
before you make it
Stochastic programming applied to your real operational data. 7 agents (Demand, Capacity, Workforce, Supply, Reimbursement, Quality, Compliance) run DES + Monte-Carlo simulations on bed logs, OR costing, claims facts and vitals hypertables.
- · Output is population/resource-level only — the device line is a hard invariant
- · 4-role HITL gate: optimized → decided only with human sign-off
- · LLM writes narrative + commentary, never decides a number
- · Portfolio Command for C-suite roll-up across all initiatives
Distribution of outcomes, not a point estimate. The capacity line sits above P95 — the step-down plan holds at the 95th-percentile surge. Calibrated by live twin_metric_* RPCs.
Forecast mean with 90% band. Week-8 demand crosses staffed beds — the Workforce agent proposes a roster shift before the breach, not after.
Every option scored on the same axes. Budget-cap rule rows prune infeasible runs (12 beds → 10) — the twin never recommends what the rule engine forbids.
optimized → decided
LLM writes commentary, never decides a number
Live operations
Watch the whole hospital move in realtime
▸ manifest.lab.result_filed
K+ 5.9 mmol/L → CDS fired
▸ cds.alert.critical
hyperkalemia rule · charge nurse ack
▸ rx.prescribed
insulin-glucose protocol · Ward 4B
▸ billing.ledger.posted
auto-priced ฿1,240 · SKU LAB-0042
Nurse coworker · proposal
Repeat K+ in 2h, ECG now. Awaiting physician sign-off.
Clinical Decision Support
Rules as data. Alerts as first-class events.
Every observation write — from the frontend, HL7v2 ORU, lab feeds, devices, or FHIR write API — auto-fires the CDS engine. NEWS2, MEWS, qSOFA, hypoxia, sepsis and HTN rules ship in the baseline library. New rules are data rows at /admin/cds-rules — no code deploy.
- · Global FAB + drawer + modal + toast via CdsAlertSurface
- · Inline InlineCdsAlertBadge for any form or worklist cell
- · Critical alerts: no snooze — ack-with-reason or escalate only
| NEWS2 aggregate ≥ 7 | CRITICAL | 2 today |
| Hyperkalemia K+ ≥ 5.5 | CRITICAL | 1 today |
| qSOFA ≥ 2 (sepsis screen) | WARNING | 3 today |
| NPO violation — oral order | WARNING | 0 today |
| Antibiotic timing 1h window | INFO | 4 today |
Every vitals write auto-fires CDS. Alerts surface via global FAB + drawer + inline badge. Rules are data rows — editable live, no code deploy.
ADT/ORM/ORU
read/write/sub
NM/CT/PET
OData connector
HR/finance feed
lab instrument
claims rail
NHSO 16-file
Interoperability
48 connectors. Every dialect.
FHIR R4 read/write + subscriptions (HMAC-signed bundles), HL7v2 ADT/ORM/ORU over MLLP, DICOM modality worklists for NM/PET/CT/SPECT, and a connector store spanning EHR/HIS, LIS, RIS/PACS, claims rails, ERP, HRM, identity and messaging.
Browse the marketplaceGlobal by data, not by fork
One codebase. Market packs for every region.
United States
FHIR R4, HL7v2, DEA & state-license compliance, HIPAA
UK & Europe
GDPR-first deployments, NHS-style pathways, MDR alignment
Japan
Kaigo long-term care billing, APPI residency, ja locale
China
Air-gapped on-premise, local HIS adapters, yonyou-cn connector
Southeast Asia
NHSO / PhilHealth market packs, PDPA, fil + th locale
Australia
Medicare / ECLIPSE connectors, AU market pack
Open source
Open source from day one —
apply first.
medOS is built in the open because hospital infrastructure should be transparent, inspectable and owned by the institutions that run it. Read, contribute, self-host — you are never locked in. Sovereign storage runs on EVFS (IPFS) and audit-grade ledgers on Hyperledger Besu, with the same stylization across the stack.
The public GitHub release is being staged. Until then, access is application-based — and free-use foundation licenses are open now for aid-model deployments across Africa and low-resource health systems.
Self-hostable
All-in-one compose: 16 services + infra + nginx on your hardware. Air-gapped supported.
EVFS — sovereign files
IPFS-backed clinical file store with content addressing and node-local custody.
Besu audit ledger
Tamper-evident, permissioned EVM chain for cross-org audit trails.
Foundation / aid model
Zero-license deployments for qualifying public-health programs — apply by email.
See your hospital running on medOS ultra
A 30-minute walkthrough with our clinical engineering team — on your workflows, not a canned demo.