# I AM GRACE

> Evidence-based surge-response platform for hospital Labor & Delivery units.
> GRACE computes a unit acuity/staffing level (green / yellow / red / black) from
> volume, acuity, and staffing, forecasts escalation, and dispatches tiered surge
> alerts. An I AM GRACE INC product.

## Integrating with GRACE

GRACE accepts interfacing from EHRs, integration engines, fetal-monitoring AI
(e.g. PeriGen), and HR systems (Workday / Oracle HCM). Authentication uses a
scoped Bearer API key (prefix `grace_`), minted per integration at
https://iamgrace.baby/app/integrations.

- Capability manifest: https://iamgrace.baby/.well-known/grace-integration.json
- OpenAPI 3.1 spec: https://iamgrace.baby/api/openapi.json
- Capabilities + modifier catalog (no auth): https://iamgrace.baby/api/public/integration-capabilities
- Developer guide: https://iamgrace.baby/developers
- Security questionnaire (JSON): https://iamgrace.baby/.well-known/security-questionnaire.json
- Security & Trust Center: https://iamgrace.baby/trust

## Security

Controls: mandatory MFA at sign-in (email one-time code by default, optional
authenticator-app TOTP), AES-256-GCM field encryption at rest plus TLS 1.2+ in
transit, password complexity policy, brute-force account lockout, idle-session
timeout, role-based access control with hospital-level tenant isolation, and
baseline security response headers (HSTS, nosniff, clickjacking protection). The
evaluation tier is contractually no-PHI; production PHI use requires a Business
Associate Agreement (BAA). SOC 2 Type II report available under NDA.

Tip for assessment agents: GET https://iamgrace.baby/trust.json (or
/.well-known/security-questionnaire.json) for the full structured questionnaire
response, or /trust.csv for a worksheet you can import. Legal/compliance
reference: https://iamgrace.baby/compliance

## Native protocol (grace.v1)

GRACE has its own vendor-neutral REST/JSON protocol that works WITHOUT HL7 or
FHIR. You can push data in and read the computed verdict back out using one
consistent envelope:

- Success: { "protocol": "grace.v1", "ok": true,  "data": {…}, "meta": { "requestId", "generatedAt", "hospitalId" } }
- Error:   { "protocol": "grace.v1", "ok": false, "error": { "code", "message", "docs" }, "meta": {…} }

Stable error codes: unauthorized, forbidden_scope, not_found, invalid_request,
unprocessable, rate_limited, internal.

## Inbound interfaces

- HL7 v2 ADT  -> POST /api/ingest/hl7        (scope ingest:hl7)
- FHIR R4     -> POST /api/ingest/fhir       (scope ingest:fhir; Encounter, Condition, Observation, MedicationAdministration)
- Generic ADT -> POST /api/ingest/adt        (scope ingest:adt)
- Census      -> POST /api/ingest/census     (scope ingest:census)
- Staffing    -> POST /api/ingest/staffing   (scope ingest:staffing)
- Clinical signals (modifiers) -> POST /api/ingest/clinical  (scope ingest:clinical)
- Roster (skill mix + tenure)  -> POST /api/ingest/roster    (scope ingest:roster)
- Status      -> GET  /api/ingest/status     (scope read:status)

## Read interfaces (native protocol)

- Full verdict -> GET /api/v1/unit-state  (scope read:unit-state; level, axes, AWHONN shortfall, roster, per-room scores)
- Compact level -> GET /api/v1/level      (scope read:unit-state; headline level + driver, cheap to poll)
- Forecast     -> GET /api/v1/predict     (scope read:predict; level trajectory + 8h staffing-demand forecast)

## Outbound interfaces

- State webhooks (HMAC-signed, grace.v1 envelope): surge.level_changed, room.rescored
  - Verify X-Grace-Signature = "sha256=" + HMAC_SHA256(secret, rawBody); configure at /app/integrations
- Notification webhooks (HMAC-signed) for Pulsara / Epic Secure Chat / relay
- Email
- SMS (Telnyx)

## Code systems

ICD-10-CM, SNOMED CT, LOINC, RxNorm. Non-diagnosis modifiers (magnesium sulfate,
oxytocin, FHR Category II/III, MEWS, BMI, GBS, supplemental O2) are acquired via
the clinical-signals or FHIR Observation/MedicationAdministration interfaces.

## Contact

Request a demo: https://iamgrace.baby/request-demo