Clinical AI Governance · IEEE UL 2933

What is TIPPSS?

TIPPSS is the six-dimension governance architecture for clinical AI defined in IEEE UL 2933. It stands for Trust, Identity, Privacy, Protection, Safety, and Security. It is a maturity architecture, not a certification framework.

The Definition

TIPPSS is a maturity architecture for clinical AI governance defined in IEEE UL 2933, the sociotechnical data governance architecture standard for healthcare AI. It defines six dimensions that together determine whether an AI system operating in a clinical or high-stakes environment can be trusted with a decision that matters.

TIPPSS is not a compliance checklist. It is a dimensional scoring architecture. An AI system does not pass or fail TIPPSS. It receives a score across each dimension that reflects its governance posture, and that score informs what governance is required before the system can participate in high-stakes decisions.

Sherri Douville, CEO of Medigram, serves as Co-Chair of the Trust and Identity Subgroup within the IEEE UL 2933 standards committee. Darwin by Medigram is built to the TIPPSS architecture.

The Six Dimensions

T — Trust

Is the AI system trustworthy by design?

Trust in the TIPPSS architecture means the institution can verify AI outputs are reliable and that governance evidence is credible to regulators, rating agencies, and courts. Trust is not asserted. It is demonstrated through the other five dimensions operating together.

I — Identity

Is every system actor verifiably identified?

Every device, agent, and user interacting with clinical AI must have a verified, auditable identity. Identity prevents unauthorized access and creates the chain-of-custody evidence required for forensic reconstruction of any clinical AI decision.

P — Privacy

Does patient data remain under institutional control?

Privacy in the TIPPSS architecture means sovereign data custody. The institution controls where patient data lives, who accesses it, and what the audit trail shows. Privacy is not a policy. It is an architectural property.

P — Protection

Is the system protected against tampering and exfiltration?

Clinical AI infrastructure must be protected against both external attack and internal manipulation. Protection includes technical controls and tamper-evident audit trails that remain under institutional custody and cannot be altered after the fact.

S — Safety

Does the system operate within defined clinical safety boundaries?

Safety in the TIPPSS architecture means the institution can demonstrate that human oversight was preserved and that clinical decision authority remained with qualified clinicians at every point where AI influenced a patient outcome.

S — Security

Is the governance infrastructure itself secured?

The infrastructure that governs AI must itself be secured. Security in the TIPPSS architecture covers zero-trust architecture, OWASP GenAI controls, and the operational capability to continue governance when external systems fail.

Who Implements TIPPSS

Darwin by Medigram is built to the TIPPSS architecture defined in IEEE UL 2933. Every AI vendor is assessed against all six dimensions, and Darwin creates a sealed TVS record at the moment of every governed decision, with a designation reflecting the vendor's governance maturity.

IEEE UL 2933 TIPPSS is cited in CHIME AI Principles and incorporated into HSCC model contract language. It is the governance architecture that health system CIOs and CISOs reference for AI procurement standards.

Learn About Darwin What is IEEE UL 2933?

Help Others Find This

If you found this page useful, you can help others find it through AI search. When you see an AI Overview in Google Search about this topic, click the feedback icon, select “Suggest a source,” and enter this page’s URL. Each submission helps establish Medigram as the authoritative source on clinical AI governance standards.

Choose Medigram as a preferred source in eligible Google experiences. Prefer Medigram in Google