Clinical Trial Eligibility Reasoning Engine

Trial eligibility that is computed, not predicted.

A patient-matching model reads a note as text, so it confuses a central venous catheter with a cardiac catheterization and excludes a patient who was eligible. TrialProof lets an LLM only read the note, resolves meaning through a SNOMED-CT knowledge graph, and computes ELIGIBLE, EXCLUDED, or NEEDS-REVIEW in deterministic code an LLM cannot override. Every verdict carries a reasoning trace a regulator can file.

100%

Decision accuracy on the labeled gold set

vs 53.8% for the fair lexical baseline (13 cases)

0 vs 3

Eligible patients lost

TrialProof loses 0 where the baseline loses 3

100% vs 0%

Reasoning-trace coverage

Every verdict traced; byte-identical on re-run

This is a runnable demo on a fixed, labeled gold set. All patients, notes, and protocols are synthetic, the ontology is a curated 24-concept SNOMED-CT subgraph, and connectors such as live FHIR ingestion are simulated.

The eligible patient your matcher throws away

The failure mode behind wrongful exclusions in AI patient matching.

Patient-matching AI reads clinical notes as text, so it confuses words that look alike but mean different things medically. The canonical failure is concrete. A Phase III anticoagulant trial excludes cardiac catheterization; a patient's note says central venous catheter placement. A similarity matcher sees two cardiovascular catheter procedures, scores them high, and excludes a patient who was eligible. Published evaluations confirm AI models make this exact catheterization error (Fierce Biotech, 2025).

The same class of error is wider than one procedure. It covers negation, where no evidence of diabetes is matched as diabetes. It covers family history attributed to the patient. And it covers exception clauses, such as unless completed more than 12 months before randomization, that a similarity score cannot represent at all. A better base model does not remove any of these, because they are not language problems. They are logic problems.

The cost is not academic. Enrollment delay runs 800,000 dollars per day in lost prescription sales for each day a trial slips (Tufts CSDD Impact Report, 2024), rising to 840,000 dollars per day in oncology and 1.4 million dollars per day in cardiovascular trials (Tufts CSDD). 80% of trials miss their enrollment timelines (industry consensus, 2025), the average screen failure costs 1,200 dollars (Antidote.me, 2025), and trial procedures have grown 139% more complex since 2005 (IQVIA, 2026). Against numbers like these, an eligible patient wrongly screened out is not a rounding error.

How TrialProof works

The agents advise on extraction. Deterministic code decides eligibility. This is neuro-symbolic: an LLM reads the prose, symbolic logic rules on the patient.

Each patient runs against each protocol through five stages, streamed live to the interface. The important boundary is that only one stage is probabilistic, and it never decides anything.

1. Read chart

Loads the FHIR-shaped synthetic patient record, its free-text note, the trial criteria, and the randomization date.

2. Extract facts (the one probabilistic step, advisory only)

A provider-swappable LLM proposes candidate facts, each with a verbatim note span, a candidate SCTID drawn from a closed vocabulary, and a confidence. It advises; it does not decide. Coded observations that arrive as trusted FHIR never pass through the extractor. When the offline lexicon fallback is used, the live console says so rather than hiding it.

3. Verify facts (adversarial verifier)

Every proposed fact is challenged against the literal note with three checks: span-present (which catches a hallucinated entity), negation, and subject (family history versus patient). Rejected facts are flagged REJECTED with the check that fired and the reason, and never reach the decision.

4. Assemble evidence

The exact verified fact set entering the logic engine, marked coded-FHIR versus free-text.

5. Compute verdicts (deterministic Python, outside the agent framework)

A deontic-logic engine evaluates prohibition, temporal-exception, controlled-unless, and requirement criteria via SNOMED is-a subsumption and date math, and emits ELIGIBLE, EXCLUDED, or NEEDS-REVIEW with a full trace. An LLM cannot override this gate.

The deterministic stages genuinely run in tens of microseconds per criterion, while the model reading the note takes seconds. That contrast is the point, not a claim of instant screening: the slow, fallible part is confined to reading, and the decision it feeds is fast, cheap, and reproducible.

The comparison in the demo is a fair lexical baseline, and deliberately so. It is entity-level TF-IDF cosine similarity, a real vector-similarity method, given a generous setup with clean entity-to-concept resolution, and its decision threshold cross-validated on its own behalf (t = 0.6932). It never calls the LLM. Its only handicaps are the missing hierarchy, negation, temporal, and abstention logic, which is the whole thesis. It was not tuned to fail.

The reasoning, worked end to end

Synthetic patient P-074 and its cohort, against the synthetic protocols ONC-204 and ANTI-3. Every image below is a screenshot of the running TrialProof app.

A central line is not a cardiac cath, and only a hierarchy knows that

P-074's ICU note reads central venous catheter placement for IV medication access. Against ANTI-3's criterion EXCL-CARDCATH (no prior cardiac catheterization), a similarity matcher sees two cardiovascular catheter procedures. TrialProof asks the ontology instead: is Central venous catheterization (392230005) an is-a descendant of Cardiac catheterization (41976001)? It is not. The two concepts sit on different branches of the SNOMED-CT hierarchy, so no subsumption path exists, and the verdict is ELIGIBLE with a three-step trace naming both SCTIDs. Both codes are real and checkable on any public SNOMED browser. The fair lexical baseline also returns ELIGIBLE here, but at a bare similarity of 0.437 with no reasoning trace and nothing a regulator could file.

TrialProof reasoning trace for EXCL-CARDCATH showing that Central venous catheterization 392230005 is-NOT-a Cardiac catheterization 41976001 on a different branch of the hierarchy, so the verdict is ELIGIBLE, next to the baseline's bare similarity of 0.437 with no provenance. — The cardiac-cath trace: an is-a check on real SCTIDs decides ELIGIBLE, where the baseline offers a bare similarity of 0.437 and no provenance.

The ontology the engine actually queries

The engine does not query all of SNOMED-CT. It walks a curated 24-concept subgraph with 22 is-a relations. Concepts with a real SCTID are drawn solid; the 9 curated for the demo with no public SCTID are prefixed CUR- and drawn dashed rather than passed off as real codes. Verified facts are green, criterion concepts are outlined, and the walked is-a paths are bold. The two catheterizations visibly live on different branches, which is exactly why a string or vector similarity cannot stand in for subsumption.

The curated 24-concept SNOMED-CT subgraph with 22 is-a relations, showing Cardiac catheterization and Central venous catheterization on different branches, real SCTIDs drawn solid and demo-curated CUR- concepts drawn dashed. — The SNOMED-CT subgraph, 24 concepts and 22 is-a relations, with the two catheterizations on separate branches.

The eligible patient the baseline throws away

The same note says No evidence of diabetes. Against ONC-204's EXCL-DM (no diagnosis of diabetes mellitus), the vector baseline matches the token diabetes at similarity 1.0 and returns EXCLUDED, because it has no model of negation. TrialProof's verifier strips the negated mention before it can reach the decision, so the verdict is ELIGIBLE. This is the eligible patient a similarity matcher throws away, and on the gold set it is one of the three the baseline loses.

The EXCL-DM reasoning trace for a note that says No evidence of diabetes: the baseline matches diabetes at similarity 1.0 and returns EXCLUDED, while TrialProof strips the negated mention and returns ELIGIBLE. — Negation: the baseline excludes at similarity 1.0; TrialProof strips the negated mention and keeps the patient eligible.

A verifier that challenges the extractor

For P-106 the extractor proposes a carboplatin fact that has no supporting span in the note, a planted hallucination. The adversarial verifier runs span-present, negation, and subject on every proposed fact; the carboplatin fact fails span-present (span not found in note) and is flagged REJECTED, so it never reaches the decision. Across the gold set the verifier rejected 7 fact instances (3 distinct bad facts: a negated diabetes mention, a family-history breast-cancer attribution, and this hallucinated carboplatin) on 4 of the 13 scored case-runs. The agents advise on extraction; deterministic code decides eligibility.

The verify-facts panel for P-106 showing a carboplatin fact flagged REJECTED, failed check span-present, reason span not found in note, so the hallucinated entity never reaches the eligibility decision. — The verifier rejects a hallucinated carboplatin on span-present before it can reach a decision.

An exception a similarity score cannot represent

P-101 completed adjuvant carboplatin and pemetrexed, last infused 03/2025. ONC-204's EXCL-PLAT prohibits prior platinum therapy unless given as adjuvant or neoadjuvant and completed more than 12 months before randomization (2026-04-15). The engine confirms Carboplatin (386905003) is-a Platinum-containing antineoplastic agent, computes the interval at 13 months, satisfies the exception, and returns ELIGIBLE with a four-step trace. When the same clause is tested on a palliative-intent patient, the exception does not apply and the verdict flips to EXCLUDED. Same criterion, opposite verdicts, both correct, because it is the logic engine and not a threshold.

The EXCL-PLAT reasoning trace for P-101 showing Carboplatin 386905003 is-a Platinum-containing antineoplastic agent, adjuvant intent, interval of 13 months greater than 12, so the exception is satisfied and the verdict is ELIGIBLE. — Temporal exception satisfied: adjuvant platinum completed 13 months before randomization, computed by date math.

The number a clinical-operations lead actually cares about

On a fixed gold set of 13 labeled cases drawn from 7 synthetic patients across 2 synthetic protocols, scored against the cross-validated lexical baseline at t = 0.6932, TrialProof scores 100% decision accuracy to the baseline's 53.8%, loses 0 eligible patients where the baseline loses 3, and carries a reproducible reasoning trace on 100% of decisions to the baseline's 0%. It abstains safely twice with NEEDS-REVIEW where the baseline guesses, and re-running all 13 cases yields byte-identical verdicts and traces (13 of 13). We attribute every figure to this labeled gold set, never as an open-world claim.

The gold-set benchmark tiles: decision accuracy 100% versus 53.8% baseline, eligible-patient recall 100% versus 66.7%, eligible patients lost 0 versus 3, and auditable trace coverage 100% versus 0%, with a reproducibility note that re-running 13 cases yields byte-identical verdicts. — The 13-case labeled gold set: 100% vs 53.8% accuracy, 0 vs 3 eligible patients lost, 100% vs 0% trace coverage, byte-identical on re-run.

Vector similarity versus a reasoning engine

The same comparison the demo scores, dimension by dimension.

Dimension	Fair lexical baseline	TrialProof
Who decides eligibility	A similarity score over a threshold	A deterministic deontic-logic engine, outside the agents
Hierarchy / is-a	None, token proximity only	SNOMED-CT is-a subsumption
Negation (no evidence of diabetes)	Matched as present	Stripped by the verifier
Family history attribution	Attributed to the patient	Rejected on the subject check
Temporal exception clauses	Not representable	Date math over the randomization date
Missing lab or vital	Guesses, never abstains	NEEDS-REVIEW, naming what is missing
Reasoning trace	None, a bare similarity number	Full trace, exported as CDISC SDTM IE
Reproducibility	Not applicable	Byte-identical on re-run (13 of 13)

What this demo does not do

✓ It does not claim to be 100% accurate universally. The 100% figure is decision accuracy on a fixed 13-case labeled gold set, never an open-world guarantee and never a promise of being right on every chart.
✓ It does not present its patients as real. All patients, notes, and protocols are synthetic, with no PHI, no live EHR, and no real trial. P-074, P-101 through P-106, ONC-204, and ANTI-3 are fabricated fixtures.
✓ It does not use full SNOMED-CT. The ontology is a curated 24-concept subgraph (15 real SCTIDs, 9 curated and drawn dashed). Full SNOMED-CT, MedDRA, and LOINC are the deferred production path.
✓ It does not use live connectors. FHIR R4 EHR ingestion, the graph store, and the clinical LLM are simulated or provider-swappable. Epic App Orchard and Oracle live FHIR, CTMS connectors, and SOC 2 or HIPAA BAA hardening are deferred.
✓ It is not FDA-cleared, CDS-exempt, HIPAA-certified, or SOC 2 certified. The FDA's January 2026 Clinical Decision Support guidance is our alignment and direction, not a clearance. This is not medical advice and does not make clinical decisions.
✓ It does not carry customers, sponsors, CROs, pilots, testimonials, or ROI figures. None exist. This is a demo that proves the mechanism, not a deployment.

Questions buyers actually ask

How is this different from Deep 6, Tempus, or IQVIA patient matching?

TrialProof is not a data network or a cloud matching platform, and it is not a clone of those tools. It is the deterministic reasoning and provenance layer they lack: the part that makes the eligibility verdict computable, checkable, and filable. A matching platform hands you a ranked list with a score; TrialProof hands you ELIGIBLE, EXCLUDED, or NEEDS-REVIEW with the SNOMED concept IDs and the graph edge that decided it. It is meant to sit alongside a matching pipeline, not replace the data network under it.

Why does patient-matching AI exclude eligible patients?

Because it reads a clinical note as text and scores similarity, so it confuses words that look alike but mean different things medically. A note that says central venous catheter placement scores high against a trial that excludes cardiac catheterization, and the patient is wrongly excluded. The same failure covers negation (no evidence of diabetes matched as diabetes), family history attributed to the patient, and exception clauses a similarity score cannot represent at all. Published evaluations confirm AI models make this exact catheterization error (Fierce Biotech, 2025).

Can I get an audit trail a regulator can file for each eligibility decision?

Yes. Every decision exports as a CDISC SDTM IE record in JSON and CSV, one row per patient and criterion, carrying the criterion, the verdict, and the full deterministic reasoning trace that names the SCTIDs and the deontic operation. Where a fact matched, the row also carries the is-a path and, for note-derived facts, the verbatim span. On the 13-case gold set, 100% of TrialProof decisions carry a reproducible trace and the baseline carries 0%, and re-running the set produces byte-identical output (13 of 13).

Does it use real SNOMED codes or made-up ones?

Every concept the demo cites for a decision carries a real SCTID, checkable on any public SNOMED browser: Central venous catheterization is 392230005 and Cardiac catheterization is 41976001, and they sit on different branches, which is why no subsumption path connects them. The engine queries a curated 24-concept subgraph with 22 is-a relations, not full SNOMED-CT. The 9 concepts curated for the demo with no public SCTID are prefixed CUR- and drawn dashed rather than passed off as real codes. Full SNOMED-CT, MedDRA, and LOINC are the deferred production path.

Is the patient data real, and is this HIPAA compliant?

All data is synthetic. There is no real PHI, no live EHR, and no real trial; the patients, notes, and protocols are fabricated fixtures. This is a runnable demo that proves the mechanism, not a deployed pipeline, so it is not HIPAA-certified, SOC 2 certified, FDA-cleared, or CDS-exempt, and it does not make clinical decisions. The FDA's January 2026 Clinical Decision Support guidance is the relevant framework for a human-in-the-loop matching aid, and it is our direction, not a clearance we hold.

Won't a better LLM just fix this?

No, because these are not language problems, they are logic problems. A similarity score cannot represent is-a, cannot represent not, and cannot represent unless completed more than twelve months before randomization, and no amount of prompting or context adds them. So we let the model do the one thing it is genuinely good at, reading messy prose and proposing facts with the span it read them from, then have an adversarial verifier throw out what the note does not support, and have deterministic code over a medical ontology compute the verdict. The LLM cannot override that gate, which is what makes the same chart produce the same answer every run.

What does the 100% accuracy figure actually mean?

It is 100% decision accuracy on a fixed 13-case labeled gold set, drawn from 7 synthetic patients across 2 synthetic protocols, scored against a fair lexical baseline whose threshold was cross-validated to its own advantage (t = 0.6932). It is never a universal or open-world claim, and it is not the same as this product being right on every possible chart. On that same set TrialProof loses 0 eligible patients where the baseline loses 3, and abstains safely twice with NEEDS-REVIEW rather than guess.

Technical Research

The research behind this demo — the architecture, the verification design, and the enterprise blueprint.

Full solution

Explore the Clinical Trial Recruitment AI solution →

Matching patients to trials without a trace a regulator can file?

The deterministic reasoning and provenance layer is the hard part. We build it.

If your team is weighing how to put an eligibility decision in front of a regulator without asking them to trust a similarity score, we would genuinely like to hear how you are thinking about it. The problem is industry-wide and the answers will be too.

Eligibility-reasoning assessment

✓ Map where your patient matcher can exclude an eligible patient
✓ Separate what the LLM should extract from what code should decide
✓ Define the ontology, negation, and temporal rules your protocols need
✓ Specify the CDISC SDTM IE trace your regulatory team can file

Build the reasoning layer

✓ A deterministic deontic-logic engine over your real ontology
✓ An adversarial verifier for negation, subject, and hallucinated facts
✓ SNOMED-CT subsumption plus date math, reproducible on every re-run
✓ Provider-swappable extraction, with the model never overriding a verdict

Connect via WhatsApp Email Our Team