A common way to build an AI assistant today: a router picks a model, one model talks to the user, a second model checks its answers in the background, and guardrails block what should not happen. On 13 October 2026 the USPTO granted Hippocratic AI a patent, US 12,763,195 B2, whose first claim describes that stack in five elements, and claim 1 itself does not mention healthcare.
AG Tech Consulting's advice for clients this week: draw your AI system as boxes (router, generator, auditor, guardrails, human handoff), mark which checks run before a response or action and which run in parallel after it, move every check that guards a harmful action into the "before" column, and if you ship conversational AI in the US, have your patent counsel read the claims of US 12,763,195 B2 against that drawing.
The grant in one paragraph
US 12,763,195 B2 is titled "Conversational artificial intelligence system with multi-agent orchestration and parallel supervisory processing." It is assigned to HealthGPT, Inc. of Palo Alto, which does business as Hippocratic AI. The nine inventors are Munjal Shah, Vishal Parikh, Meenesh Bhimani, Subhabrata Mukherjee, Alex Miller, Saad Godil, Debajyoti Datta, Paul Gamble and Rae Lasko. Application 19/547,381 was filed on 23 February 2026, published as US 2026/0188474 A1 on 2 July 2026 and granted on 13 October 2026 with 20 claims. Its primary CPC class is G16H 40/20, healthcare resource management.
It is the newest member of a family that claims priority to two provisionals, filed on 15 May 2023 and 18 December 2023.
What claim 1 actually covers
Claim 1 is a system claim with five elements, and each one limits its scope:
1. A plurality of large language models, with individual models configured to perform different functions.
2. A routing system that sends a request to the model "best suited for a task associated with the request."
3. A conversation manager that coordinates the flow of a conversation between the system and a user using those models.
4. A supervisory module that operates in parallel with the conversation, audits responses generated during it, and provides feedback that "contributes to construction of downstream responses to the user."
5. One or more safety modules that prevent the system from performing actions outside defined constraints.
Independent claim 14 recites the same five steps as a method, and claim 19 recites the same elements as instructions on a computer-readable medium.
The dependent claims add the detail
Claim 2 routes on latency requirements, domain or classification task. Claim 3 has the conversation manager orchestrate models to process speech, interpret meaning and generate responses in parallel. Claim 4 is where healthcare appears: the functions include at least two of intake, scheduling, order processing, pre-operative preparation, discharge or navigation.
Claim 5 says the supervisor uses a different LLM from the one generating responses. Claim 6 allows several supervisors with different functions. Claim 7 has the supervisor decide a response needs clarifying and make the conversation manager clarify it mid-conversation. Claim 11 transfers the conversation to a human when clarification is not enough.
Claim 8 has the safety modules detect and intercept threat vectors. Claim 9 adds redundancy across model providers, with failover to a different LLM when one degrades. Claim 10 adds speech recognition and text-to-speech, claim 12 domain fine-tuned models, claim 13 at least two channels among voice, chat, email and messaging, and claim 20 a mix of at least one commercial and one proprietary LLM.
How the described system works
The specification is shared with the earlier family members, and it is more concrete than the claims.
A fast talker and a slow checker
A primary model holds the conversation. One or more "second opinion" models run deeper research in parallel on what the patient said and what the AI answered: prescriptions and dosage, co-morbidities, family history. The specification gives an example latency of 50 ms for the primary model and 200 ms for each second-opinion model.
If the second opinion decides an earlier answer should be clarified, it sends feedback and the primary model corrects itself a turn or two later. The patent's own example: the AI says a patient can have soup, then adds that because of high blood pressure in the patient or family, they should check sodium in pre-packaged soups. If clarification is not enough, a "kick out" engine transfers the call to a nurse or doctor, and above a risk threshold it can request a "third opinion" from a human specialist.
Router, tools and safety modules
FIG. 7 describes the part that claim 1 leans on. Requests go through LLM APIs to commercial and proprietary models, a proprietary LLM routing system picks the best-suited model, tools and agents perform tasks, safety modules stop unsafe output, and a conversation manager uses speech recognition and natural-language understanding to identify intent and route to the right model. The specification also describes a "set of safety-focused language models that function to audit the output of the core models."
What it looks like in production
Hippocratic AI's March 2024 Polaris paper describes the same "constellation" idea in public detail. It reports a system of more than one trillion parameters in total: a stateful primary agent of 70B to 100B parameters and specialist agents (medication, labs and vitals, nutrition, policy, EHR summary, privacy, human intervention) of 50B to 100B parameters each. The models use grouped-query attention, FlashAttention 2, RMSNorm, SwiGLU and RoPE, were trained on several hundred NVIDIA H100 GPUs with DeepSpeed, and some run in int8 weight-only quantization at inference.
Two design choices in the paper matter for anyone copying the pattern. Support agents can be synchronous (the primary waits for them) or asynchronous (their output conditions a later turn). And support agents emit structured outputs that deterministic code parses before anything reaches the primary agent's prompt.
How US 12,763,195 B2 is put together: a routing system selects among commercial and proprietary LLMs (with failover, claim 9), a conversation manager runs the dialogue, a supervisory module audits responses in parallel and feeds back clarifications or a human transfer (claims 7 and 11), and safety modules block actions outside defined constraints (claims 1 and 8). Red tags mark the attack surfaces CTOs should test: router manipulation, supervisor injection, failover downgrade and the gap between an asynchronous audit and an answer that has already been delivered.
The patent family, and how it has fared
This is not Hippocratic AI's first patent on the architecture.
US 12,142,371 B1 issued on 12 November 2024 from application 18/592,441, covering a multi-turn conversational system with control logic that shapes downstream conversation. In August 2025 OneSource Solutions International petitioned for post-grant review (PGR2025-00075), arguing lack of enablement, indefiniteness and obviousness against all 20 claims. Institution was denied on 3 February 2026; Hippocratic AI's outside counsel says the denial was on the merits, not discretionary.
US 12,367,971 B2 issued on 22 July 2025 from continuation 18/900,253, with method claims built around completing a checklist during a conversation.
Application 18/900,289, the direct parent of today's patent, is still pending. According to IP Author's office-action tracker, the examiner issued a non-final rejection on 29 July 2026 under 35 U.S.C. 103 over Brown et al. (US 9,824,188 B2) in view of Kuusela et al. (US 2025/0073494 A1). Brown also appears in the references cited on the new grant.
So the family is growing, has already survived one challenge at the institution stage, and is still being examined on a sibling.
Prior art and related work
The architecture claimed here sits in a crowded field. Public work from before or around the family's 2023 priority dates includes NVIDIA's open-source NeMo Guardrails, announced on 25 April 2023 as programmable safety and topical rails for LLM conversations, and Stanford's FrugalGPT paper of May 2023, which described an LLM router and cascade with a scoring function that decides when to escalate to a more expensive model.
Since then, LLM routing has become a product category; the 2025 "Rerouting LLM Routers" paper from Cornell Tech, the Hebrew University of Jerusalem and Wild Moose evaluated commercial routers from Unify, NotDiamond, OpenRouter and Martian. None of this tells you whether the claims are valid or what they cover; that is a question for patent counsel, claim construction and, if it comes to it, the PTAB or a court. It does tell you that the five elements of claim 1 are things many teams build independently.
Why a CTO should care
First, scope. Claim 1 is written for a "conversational artificial intelligence system" and a "user," not for patients. The healthcare limitations live in the dependent claims and the specification. A grant is not a finding that any product infringes, but a broad independent claim is the part competitors and acquirers read first.
Second, architecture. The patent describes a supervisor that runs in parallel and corrects answers after they are delivered. That is a sensible latency trade for advice in a phone call. It is the wrong pattern for an agent that is about to send money, change a record or call a tool. The Polaris paper itself separates synchronous and asynchronous support agents; your design should make the same split explicitly.
Third, governance. A router, a supervisor and safety modules give you natural places to log decisions: which model answered, what the auditor flagged, when a human took over. Those logs are the evidence auditors and regulators will ask for.
Future security risks to plan for
1. Router manipulation. The Rerouting LLM Routers authors showed query-independent "confounder gadgets" that push routers to send queries to the strong model, raising measured costs by 1.7x on Unify in their tests and by more than 8x on OpenRouter with the gadgets that worked there, and they also evaluate rerouting toward the weak model. If your router chooses which model, and which guardrails, a request gets, its integrity is a security property.
2. Supervisor injection. The auditor reads the same untrusted conversation as the generator. Text crafted to mislead the auditor, rather than the main model, can switch off the check that the architecture depends on.
3. Feedback-channel poisoning. In this design the supervisor's feedback flows into the primary model's next response. A compromised or confused support agent therefore speaks with the authority of the system prompt. Structured, schema-checked outputs, as the Polaris paper describes, shrink that channel.
4. Failover downgrade. Claim 9 fails over to a different provider when one degrades. An attacker who can degrade the primary path can push traffic onto a fallback model with a different safety profile unless the fallback passes the same evaluations.
5. The asynchronous audit window. A parallel auditor catches problems after the user has heard the answer. For actions with side effects, that window is the exploit.
6. Human handoff as an attack path. Escalation to a human is a safety feature and a social-engineering target. Expect attempts to trigger handoffs to reach staff, or to flood them.
A 10-point checklist for CTOs
Draw your AI system's control plane: every router, generator, auditor, guardrail and human-handoff path, with the model and provider behind each. Classify each check as synchronous (blocks the response or action) or asynchronous (corrects later), and move every check that guards a payment, record change, tool call or clinical statement to synchronous. Run the auditor on a different model, and ideally a different provider, from the generator, and treat everything it reads as untrusted input. Make support agents emit structured, schema-validated outputs parsed by deterministic code, not free text pasted into the main prompt. Log every routing decision per user and alert on abnormal rates of strong-model or weak-model routing; red-team the router with adversarial suffixes and prefixes. Hold fallback models to the same evaluation and safety suite as the primary, and alarm on every failover event. Define human-handoff criteria in writing, pass a summary to the human, authenticate the caller before sensitive data loads, and rate-limit escalations. Red-team the supervisor directly with injections aimed at it, not only at the user-facing model. Keep decision logs (model used, auditor flags, overrides, handoffs) long enough to answer an auditor or regulator. Ask counsel to review US 12,763,195 B2, US 12,142,371 B1, US 12,367,971 B2 and pending application 18/900,289 against your architecture, and document your own design dates and the public prior art you relied on.
The bottom line
US 12,763,195 B2 puts a patent on a pattern many teams treat as plain good practice: route to the right model, let a second model audit the first, and wrap everything in safety modules. Whether that claim holds up is for lawyers and the PTAB. What CTOs control today is the engineering: decide which checks must block, give the auditor its own model and its own threat model, and log the control plane like the security boundary it is.
Sources: USPTO Official Gazette entry for US 12,763,195 B2, 13 Oct 2026 (https://patentsgazette.uspto.gov/week41/OG/html/1551-2/US12763195-20261013.html); Google Patents, US 2026/0188474 A1 with specification, priority data and assignment (https://patents.google.com/patent/US20260188474A1/en); full claims 1-20 and assignment record via The Patent Place (https://thepatentplace.com/iplibrary/patent-grant/12763195/); Google Patents, US 12,142,371 B1 (https://patents.google.com/patent/US12142371B1/en); USPTO Official Gazette entry for US 12,367,971 B2, 22 Jul 2025 (https://patentsgazette.uspto.gov/week29/OG/html/1536-4/US12367971-20250722.html); PGR2025-00075 case details (https://ipverse.greyb.com/ptab-web/cases/case-details/PGR2025-00075) and Cabello Hall Zinda announcement of the denial (https://www.linkedin.com/posts/cabello-hall-zinda-pllc_pgr2025-00075-decision-denying-instituion-activity-7432449231946203136-BPBd); IP Author office-action analysis for application 18/900,289 (https://insights.ipauthor.com/18900289.html); Hippocratic AI, "Our Safety Focused Healthcare LLM is Now Patented" (https://hippocraticai.com/safety-focused-llm-patent/); Mukherjee et al., "Polaris: A Safety-focused LLM Constellation Architecture for Healthcare," arXiv:2403.13313 (https://arxiv.org/abs/2403.13313); Shafran, Schuster, Ristenpart and Shmatikov, "Rerouting LLM Routers," arXiv:2501.01818 (https://arxiv.org/abs/2501.01818); Chen, Zaharia and Zou, "FrugalGPT," arXiv:2305.05176 (https://arxiv.org/abs/2305.05176); NVIDIA, "NeMo Guardrails Keep AI Chatbots on Track," 25 Apr 2023 (https://blogs.nvidia.com/blog/ai-chatbot-guardrails-nemo/).
Also on our website: https://agtechconsulting.ai/insights/your-ai-second-model-checking-first-new-patent-claims.html
Want help mapping your AI control plane and deciding which checks must block before your next release? Email avinash@agtechconsulting.ai, visit agtechconsulting.ai, or book a 30-minute call: https://calendly.com/avinash-dubey-30-min-catchup/meeting-with-ag-tech
Mentioned: Hippocratic AI Munjal Shah Vishal Parikh USPTO NVIDIA OpenRouter Not Diamond Cornell Digital Tech & Innovation OWASP GenAI Security Project National Institute of Standards and Technology (NIST) Coalition for Health AI (CHAI) Cloud Security Alliance HIMSS OpenAI Anthropic Google DeepMind Microsoft Subhabrata (Subho) Mukherjee
Originally published on LinkedIn in the Your CTO Advisor newsletter: read and comment on LinkedIn →
