FMRP-LEAN: A HIPAA-Compliant AI-Augmented LIMS Architecture for End-to-End Clinical Assay Workflow Optimization

Source: arXiv:2607.20382 · Published 2026-07-22 · By Eva McCord, Ernest Pedapati, Zag ElSayed

TL;DR

This paper addresses operational inefficiencies, limited state visibility, and regulatory compliance challenges inherent in clinical biomarker workflows for Fragile X Messenger Ribonucleoprotein (FMRP) assays, which involve complex multi-day Luminex-based quantification. Current workflows heavily rely on spreadsheets, manual quality control (QC), and fragmented identifiers, leading to delays, increased human error, and lack of auditability. The authors introduce FMRP-LEAN, a HIPAA-compliant, AI-augmented Laboratory Information Management System (LIMS) designed to formalize end-to-end assay workflows through a finite-state machine model with guarded transitions and dwell-time observability. Key architectural features include a self-hosted Supabase/PostgreSQL stack within hospital-controlled networks, encrypted edge-to-internal tunnels with loopback-only service binding, and bi-directional REDCap integration for synchronized clinical-research data. A unified MRN–UUIDv7 identifier framework with QR tracking ensures traceable linkage while preserving PHI residency constraints. The system embeds governance-constrained AI that operates solely on aggregate data projections with deterministic fallback to preserve compliance and correctness.

Deployment in a real-world clinical environment demonstrated significant improvements in workflow transparency, reduced QC latency, and enhanced coordination across laboratory technicians, research coordinators, and patient-facing teams versus legacy spreadsheet-based tracking. This work contributes a generalizable framework for rigorous, state-explicit, secure LIMS workflows augmented by AI within regulated healthcare settings. The approach effectively balances operational efficiency gains with strict HIPAA-compliance and institutional governance demands, reframing AI as a bounded operational co-pilot rather than a decision-making authority.

Key findings

• FMRP-LEAN replaced spreadsheet-driven tracking with a guarded finite-state workflow model enabling explicit lifecycle state visibility and dwell-time monitoring.
• Automated statistical QC pre-screening reduced reviewer burden while maintaining mandatory dual human attestation for reportable state transitions.
• PHI isolation was formalized by constraining AI inputs to aggregate-only statistics excluding MRNs and UUIDs, satisfying HIPAA residency constraints (see equations 4–7).
• Deterministic AI fallback guarantees operational continuity by reverting to structured statistical summaries if the AI service is unavailable (equation 8).
• Hybrid edge–internal security architecture used encrypted tunneling plus loopback-only internal services, significantly reducing public attack surface.
• REDCap synchronization was bidirectional and executed entirely within the protected network boundary, enabling traceable clinical-research data consistency.
• Deployment showed measurable reductions in QC latency and variability of backlog dwell times with improved cross-role workflow transparency (Fig. 5).
• Compared to state-of-the-art cloud and on-prem LIMS, FMRP-LEAN uniquely combined formal workflow modeling, internal PHI residency, loopback-only binding, and governance-constrained AI.

Threat model

The adversary is external attackers attempting unauthorized access to PHI or disruption of the clinical assay workflow. They cannot directly access hospital-internal systems due to hybrid edge-internal topology with encrypted tunnels and strict loopback-only service binding, nor can they extract patient-level identifiers because AI modules only process aggregate data projections. The system assumes the hospital maintains internal security governance practices but architectural constraints reduce attack surface.

Methodology — deep read

1. Threat Model and Assumptions: The adversary is an external attacker seeking unauthorized access to PHI or disruption of assay workflows. They cannot breach the hospital-controlled internal network directly due to encrypted tunnel ingress and loopback-only internal services. AI modules must operate without exposing record-level PHI or altering workflow state without human oversight.

2. Data: The system manages clinical research datasets D composed of records ri = (MRNi, UUIDi, Xi), where MRN is protected health information, UUIDv7 is a workflow ID, and Xi are assay measurements. Data provenance is internal hospital infrastructure, adhering to HIPAA policies. Labels correspond to finite-state workflow stages representing each biospecimen's lifecycle. No PHI leaves the internal network.

3. Architecture/Algorithm: FMRP-LEAN implements a hybrid edge-internal system architecture with four layers: clinical interaction (user interfaces for CRCs, technicians), workflow orchestration (finite-state machine with guarded transitions, UUID-based tracking, QC hooks), AI-augmented LIMS core (self-hosted Supabase/PostgreSQL, Kong API gateway, internal edge functions for QC and AI briefing generation), and secure infrastructure with encrypted ingress. The AI module inputs aggregate statistics projections A(D) (counts, dwell times, QC anomaly counts) and outputs advisory natural-language summaries via function h(g(A(D))). The system enforces PHI isolation by design: no record-level identifiers are input to or output from the AI. Workflow states include Stored, PlateAssigned, QCPending, Verified, Reported, with dual human attestation gating transitions. The AI augmentation is advisory with deterministic fallback to aggregate statistics if AI fails.

4. Training Regime: Not applicable in the classic AI training sense; AI usage is limited to prompting aggregate data with no training on PHI. The AI operates as an oracle for briefing generation.

5. Evaluation Protocol: The system was deployed within a hospital conducting multi-day Luminex FMRP assays. Operational metrics compared pre-deployment legacy spreadsheet-based tracking to post-deployment finite-state LIMS across four dimensions: workflow observability (real-time lifecycle state visibility), QC latency (time from assay export to verification), backlog management consistency (variance in dwell times), and cross-role transparency (coordination among lab, CRCs, patient teams). Statistical details of metric improvements are not fully disclosed due to institutional constraints but normalized improvements are shown (Fig. 5). There was no adversarial testing reported.

6. Reproducibility: Source code is publicly available (https://github.com/drpedapati/fmrplean) but datasets are hospital-confidential. System requires hospital infrastructure for deployment; no frozen weights or AI model details are provided given the advisory AI usage context.

Example workflow: A specimen collected and assigned UUIDv7 passes through discrete finite states (Stored ➔ PlateAssigned ➔ QCPending ➔ Verified ➔ Reported). Upon assay completion, statistical QC triggers automated pre-screening. If thresholds are met, the specimen moves to QCPending state requiring dual human reviewer attestation. AI generates daily summary briefings using aggregate counts and dwell times. If AI unavailable, fallback presents raw summaries. All data querying and transitions occur in-hospital, with encrypted ingress and no PHI leakage. REDCap data synchronizes metadata and final reports bi-directionally.

This step-by-step design addresses clinical multi-day assay complexity, governance constraints, and operational inefficiencies with layered security and AI-augmented visibility enhancements.

Technical innovations

• Formalization of biospecimen lifecycle as a guarded finite-state machine with explicit dwell-time observability replacing manual spreadsheet tracking.
• Hybrid edge-internal deployment architecture using encrypted tunneling and loopback-only internal services enforcing strict HIPAA PHI residency and exposure minimization.
• Governance-constrained AI module accepting only aggregate projection inputs excluding all patient-level identifiers and bounded by deterministic fallback guarantees.
• Bi-directional REDCap synchronization implemented as an internal-only service preserving PHI residency and enabling traceable clinical-research data linkage.

Datasets

• FMRP Assay Clinical Research Dataset — size undisclosed — Hospital internal data (not public)

Baselines vs proposed

• Legacy Spreadsheet Workflow: QC latency = baseline; FMRP-LEAN: QC latency reduced by an unspecified normalized amount (Fig. 5)
• Backlog Management Variance: Legacy workflow showed higher variability; FMRP-LEAN reduced variance significantly (Fig. 5)
• Cross-Role Transparency: Legacy depended on manual status reconciliation; FMRP-LEAN provided synchronized state-aware dashboards improving communication clarity
• Cloud LIMS: Internal PHI residency often violated, loopback-only rare, formal workflow limited; FMRP-LEAN: enforced all (Table 1)

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.20382.

Fig 1: FMRP-LEAN HIPAA-compliant LIMS architecture.

Fig 2: Finite-state workflow model for FMRP-LEAN biospecimen lifecycle.

Fig 3: Hybrid edge–internal security topology of FMRP-LEAN and PHI isolation

Fig 4: Sample screenshots fo the FMRP-LEAN Implementation system operation

Fig 5: Before & after comparison of clinical assay workflow performance following

Limitations

• Single-site observational deployment limits broad generalizability across institutions and assay workflows.
• Lack of detailed quantitative statistical evaluation due to institutional data disclosure constraints.
• No adversarial or penetration testing of security boundaries is reported, leaving real-world threat resilience unconfirmed.
• Ongoing compliance depends on institutional governance practices like credential rotation and audit, which are not automated.
• AI augmentation is advisory and does not address clinical decision-making integration or predictive model training within PHI constraints.

Open questions / follow-ons

• How does the system perform under adversarial attack scenarios or insider threat models targeting PHI extraction?
• Can the governance-constrained AI framework be extended to support predictive analytics or clinical decision support within HIPAA bounds?
• What are the quantitative effects of AI augmentation on lab throughput and error rates over longer-term multi-institution deployments?
• How generalizable is the finite-state workflow model to other complex multi-day biomarker assays beyond FMRP?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, FMRP-LEAN provides an illustrative case study of integrating AI augmentation within a strictly regulated, high-compliance environment where data isolation and security boundaries are paramount. The system enforces strict segmentation between sensitive identifiers and AI processing inputs, a useful pattern when considering secure AI operations in sensitive domains. The finite-state workflow modeling coupled with deterministic fallback aligns with design principles of fail-safe automation. While not directly related to bot-detection, the hybrid edge-internal security architecture with tunneling and loopback-only services demonstrates robust network boundary enforcement relevant to safeguarding sensitive backend services from automated or malicious external probes. The careful interplay of transparency, auditability, and AI augmentation under compliance regimes helps inform secure AI operationalization strategies pertinent to CAPTCHAs embedding AI assistants or behavioral analytics in privacy-sensitive contexts.

Cite

@article{arxiv2607_20382,
  title={ FMRP-LEAN: A HIPAA-Compliant AI-Augmented LIMS Architecture for End-to-End Clinical Assay Workflow Optimization },
  author={ Eva McCord and Ernest Pedapati and Zag ElSayed },
  journal={arXiv preprint arXiv:2607.20382},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.20382}
}

Read the full paper

• arXiv:2607.20382 (abstract)
• arXiv:2607.20382 (PDF)