HugoScore agency checklist, pilot draft (October 30, 2026)

Status updated October 30, 2026: adopted by Hugo Campos and implemented locally with the ten accepted review corrections. Classifications are document-based drafts, with incomplete confirmation and evidence gaps visible. The integration was committed and pushed as 225439b on October 30. See decisions, current results, the GitHub evidence follow-up and the unchanged independent review.

Latest accepted answer update: MAIA Q12 is no, giving 10/12 and still Expands. OwnChart Q12 and Fetch scope remain unresolved. This does not change the five-category thresholds or adopt a new advertising-scope rule. See current decisions.

Purpose

One reproducible reading per tool: does it work for the patient or for the institution? Every tool answers the same twelve yes-or-no questions from public sources. The count of yes answers sets the zone. Evidence strength is shown separately (dashed outline: documents only; solid: tested) and never blocks a zone.

Answer rules

• Answer each question yes or no, about the patient (or a caregiver acting for them), for the function under review.
• Yes needs a public source that says so: product page, help page, terms, privacy policy, regulatory record or credible reporting. Quote the passage (under 25 words) and give the URL.
• Not documented counts as no. Opacity is itself an agency problem. Record "not documented" in the note so the reason is visible.
• A yes that depends on the deploying institution choosing it (for example, a consent step a health system may or may not switch on) counts as no unless the source says it is always on. Note "deployer-dependent".
• Answer about what the patient can do, not what a clinician or administrator can do for them.
• Self-started tools and question 5. When the patient starts the tool themselves (question 3 is yes) and no care or service depends on using it, question 5 is yes. (Added after the pilot: helpers answered this unevenly.)
• Third-party AI hosts. When the function runs inside an AI host the patient uses (for example ChatGPT or Claude), the host's public terms count for questions 8 to 12, the same way for every tool. (Added after the pilot.)

The twelve questions

1. Told it's AI. The patient is told, in the product or a documented consent step, that AI is involved.
2. Who's behind it is named. The company running it and the maker of its AI model are both named publicly.
3. The patient chooses to use it. The patient decides to start using it. It is not applied to them by a clinician, clinic, insurer or employer.
4. The patient sets what it's for. The patient decides the task or question. The operator does not fix the purpose or steer toward its own goal.
5. The patient can say no. The patient can decline or stop the AI and still get the same care or service.
6. The patient sees what it produced. The patient can see the AI's own output about them: the transcript, draft, summary, score or decision, not only a later product a person rewrote.
7. The patient can correct or challenge it. A documented route lets the patient correct or contest that output.
8. The patient can get their data out. The patient can export or obtain a copy of their data, recording or output.
9. The patient can delete it. The patient can have their data or recording deleted.
10. Their data isn't used against their choice. Their data is not used to train models or sold, or the patient can opt out.
11. The patient can run it or take it elsewhere. The patient can run the tool themselves (open source, self-hosted or local) or move the same function to another provider, keeping their data, without the operator's permission. Vendor-hosted only, with no documented way out, is no. (Added October 30 after the pilot.)
12. The operator has no business in the patient's data. The operator does not show the patient advertising and does not sell, license or share patient data, including de-identified data, for its own revenue, even with consent. Any documented advertising, data sale, data licensing or data business is no. When a third-party AI host is part of the function, the host must also meet this. (Added October 30 after the pilot.)

Scope and review status

Assess the named function and plan. Not assessed is separate from Not enough evidence and never receives zero. Inaccessible or prohibited sources remain explicitly unverified; retained answers contribute only provisional arithmetic. Do not call the whole checklist independently confirmed. Missing quotations remain an evidence defect, not proof of harmful behavior.

Zones

Twelve questions. The share of yes answers sets the zone.

Adopted cap, October 30 at 17:26: a score of 10 to 12 with Q11 no is Leans expands. Only Q11 yes permits Expands. This is already applied in RESULTS-ALL.md.

Output per tool

answers.json with, for each question: answer (yes or no), basis (documented, not-documented, deployer-dependent), quote, url, retrieved (date), note. Plus toolId, function (what was assessed), coder (model and vendor), relationships (any recorded relationship with Hugo Campos).