The regulator-grade spine (Govern → Map → Measure → Manage) with five first-class workstreams — Voice & UX, Accuracy & Evals, Integrations, Compliance & Safety, and Operations & Trust — so voice and integrations aren't buried inside a compliance document.
We keep these inside Feasibility & Viability rather than as separate rubrics — the tags make them visible without splintering the checklist.
Before any model touches a member, name the risk tier, the accountable owners, and the policies each workstream must satisfy. Compliance and Model Risk Management sign off here.
Persona, tone, and accessibility are governed as brand + compliance decisions, not styling.
Why: The AI's voice is a brand and compliance surface, not a styling choice.
Criteria: Named persona; tone principles; forbidden phrasings; humor policy.
Evidence: Signed persona doc from Brand, Legal, and Compliance.
Risk if skipped: Off-tone or non-compliant language reaches members.
Why: Medicare skews older and multi-ability. WCAG is a floor, not a stretch goal.
Criteria: WCAG 2.1 AA minimum; plain-language target ≤ 8th grade; assistive-tech scope.
Evidence: Accessibility policy; accountable owner (Design + Compliance).
Risk if skipped: Exclusion of the members most likely to need help; ADA exposure.
Why: Someone else often drives the conversation; consent must be explicit.
Criteria: Who can act on whose behalf; consent capture; disclosure UX.
Evidence: Proxy policy; consent flow spec.
Risk if skipped: Unauthorized enrollment; HIPAA violations.
Risk tier drives how rigorously the model is evaluated and re-approved.
Why: MRM depth (evals, review cadence, sign-off) scales with tier.
Criteria: Tier defined per model use (recommendation, extraction, explanation).
Evidence: MRM tiering memo signed by risk officer.
Risk if skipped: Under-reviewed high-risk models slip into production.
Why: Ships gates need numbers, not adjectives.
Criteria: Strategy accuracy, ranking accuracy, hallucination rate, refusal rate.
Evidence: Approved thresholds by MRM + Product.
Risk if skipped: Subjective launch decisions; no basis for rollback.
Why: Prompt and model changes are model changes.
Criteria: Who approves prompt/model changes at each tier.
Evidence: Change policy; approver list.
Risk if skipped: Silent regressions from unreviewed prompt tweaks.
Each integration is a data contract and an access decision.
Why: You can't govern what you can't name.
Criteria: HealthSafe ID, Plan Finder, Formulary, Provider Directory, CRM, Enrollment listed with owner.
Evidence: Integration register with named owners.
Risk if skipped: Orphaned dependencies; unclear escalation.
Why: PHI/PII handling is regulated at every hop.
Criteria: Data classification, retention, minimum-necessary use, encryption in transit + at rest.
Evidence: Signed data contract per integration.
Risk if skipped: Breach; HIPAA fines; carrier contract violations.
Why: Least-privilege for humans and services alike.
Criteria: Role matrix; approval workflow; periodic recertification.
Evidence: Access review evidence.
Risk if skipped: Standing broad access; insider risk.
CMS, HIPAA, and marketing rules become the guardrails — mapped, not memorized.
Why: Third-Party Marketing Org rules apply the moment we discuss plans.
Criteria: TPMO disclaimer scope; scope-of-appointment logic (where applicable).
Evidence: Regulatory matrix; Compliance sign-off.
Risk if skipped: Marketing suspension; fines; carrier termination.
Why: AI-generated member-facing text is still marketing.
Criteria: Templates + high-risk copy pre-approved; runtime constraints defined.
Evidence: Marketing review policy.
Risk if skipped: Non-compliant material reaches members.
Why: Enrollment requires licensed agents in each state.
Criteria: State list; licensing + appointment coverage.
Evidence: Licensing register.
Risk if skipped: Illegal sales activity.
Human oversight and incident response are governance, not afterthoughts.
Why: AI decisions in Medicare need a human path, always.
Criteria: Escalation triggers; agent handoff SLAs; member override rights.
Evidence: Oversight policy signed by Compliance + Ops.
Risk if skipped: Members trapped in AI loop; complaints; regulatory exposure.
Why: Not every error is a Sev-1; not every Sev-1 is obvious.
Criteria: Sev-1..3 definitions; notification obligations; comms owners.
Evidence: IR policy; on-call roster.
Risk if skipped: Missed reg notification windows; brand damage.
Why: Retiring or swapping a model is a governed event.
Criteria: Sunset criteria; member communication; audit trail.
Evidence: Retirement runbook.
Risk if skipped: Silent behavior change; broken auditability.