In this article
Before you start
This page is one design topic in the generative AI system design guide.
Why interviewers ask this
The question bank behind this page holds questions that candidates reported being asked in Hippocratic AI loops. They cover multi-agent design for a post-discharge call, serving latency, an emergency-recognition dataset, a streaming voice pipeline, a release evaluation pipeline, a clinical safety harness and retrieval over health records. These are reports from candidates, not a public statement by the company.
What the topic separates is whether you treat safety as a system property. A weak answer picks one big model, adds "be careful" to the prompt and measures question-answering accuracy. A strong answer splits the work among agents, defines what must always escalate to a person, and shows how a new checkpoint is blocked from shipping when its safety numbers fall. The Polaris authors position their work against prior healthcare language-model work on question answering, and focus on "long multi-turn voice conversations" (Mukherjee et al., 2024).
Hippocratic-style clinical LLM agents from first principles
- Constellation
- A constellation is a set of cooperating language models with different jobs, here one stateful primary agent that holds the conversation and several specialist agents that handle narrow healthcare tasks, so that no single model has to be both fluent and safe.
- Release gate
- A release gate is an automated check that runs a new model checkpoint against a fixed safety test suite before deployment and blocks the release if any required metric falls below its threshold.
In plain words
Think of a hospital phone line. One friendly coordinator talks to the patient. Behind them sit a pharmacist, a scheduler and a charge nurse who can step in. The coordinator stays warm and keeps track of the call. The experts check the facts. The analogy breaks in one place: the human experts here are replaced by models, so each expert model can itself be wrong and must be tested.
In one precise sentence, a Hippocratic-style design splits a clinical voice call between a stateful conversational agent and specialist agents, adds a human handoff, and gates every release on safety tests.
The source for the pattern is the Polaris paper by Mukherjee et al. (2024). Its abstract describes "a stateful primary agent that focuses on driving an engaging conversation" and several specialist support agents. The authors say the system has about one trillion parameters in total, made of several models of multiple billions each, and they call it the first such system; treat "first" as their own claim. The abstract does not say that "Hippocratic" means certified or regulated, and this page does not claim it. The steps below are a design built on that pattern, not a description of the paper's internals, which this page does not cover.
Step 1: The primary agent drives the conversation and holds state
The primary agent is the model the patient talks to. It keeps state across a long call: who the patient is, what the call is for, what was already said and what remains. Its input is the transcript so far plus the call goal; its output is the next spoken turn.
Keep it narrow. Its job is to be warm, to follow the call plan and to ask the next question. It is not the final authority on a drug dose or a lab value. That separation is why the abstract describes the primary agent as focused on the conversation while specialists handle healthcare tasks. You now know who speaks. The next step decides when it must stop speaking.
Step 2: A human-handoff path is the safety floor
The handoff path watches every turn for signs that a person must take over: an emergency, a distressed caller, or a request the system cannot safely handle. Input: the latest turns and the call state. Output: continue, or transfer to a nurse with a short summary.
Design it first, before the specialists, because it is the floor that the rest of the system stands on. Make it independent of the primary agent: a separate detector, so a fluent but wrong primary agent cannot talk itself out of escalating. Bias it toward false alarms. A needless transfer costs a nurse a few minutes; a missed emergency is the failure you cannot accept. Then measure it as a classifier with its own recall target, which the worked example sizes. You now have a safety floor; the next step adds the checks that run on normal turns.
Step 3: Specialist agents check each turn
Specialist agents are narrow models or tools for one task each, such as a medication check, a scheduling lookup or a record query. Input: the primary agent's draft turn plus the facts the specialist owns. Output: approve, correct, or block with a reason.
The authors state the purpose of the specialists as "to increase safety and reduce hallucinations". A specialist that reads patient records needs grounded retrieval; for a record query, wrong-patient retrieval is the failure to design out, with filters on patient identifier before any similarity search (see designing RAG over real documents). Each specialist can be tested alone, which a single prompt does not allow. Next comes the question of how any of this is allowed to ship.
Step 4: A release gate tests every new checkpoint
A release gate runs each new model checkpoint against a fixed suite before it reaches patients. Input: the checkpoint and the suite. Output: pass, or a block with the failing cases.
The suite has labeled cases built from de-identified transcripts, physician review of the labels and the hard cases, and regression tests that replay every past failure. The gate compares each safety metric to a threshold, per category, so a gain in friendliness cannot hide a loss in emergency recall.
Step-by-step description
- The primary agent holds the call.
- An emergency goes to a nurse.
- Specialists check each turn.
- Safety tests gate each checkpoint.
- The primary agent drives the conversation and holds the call state.
- A separate handoff path sends an emergency to a human nurse.
- Specialist agents check each turn of the primary agent.
- A release gate tests every new checkpoint before deployment.
Knowing it is half the job. Saying it is the other half.
Interview Clozo is an AI interview copilot for real interview rounds: it hears the question and puts a strong answer on your screen, and you say it in your own words. See the features or how it works.
Start Free Trial →Worked example
How many emergency test cases do you need before you can say the miss rate is below a target? Suppose, illustratively, the goal is to show that the handoff detector misses fewer than 1 in 100 true emergencies, with 95% confidence. The miss rate is the share of true emergencies the detector fails to catch, so miss rate = 1 − recall.
The 95% upper bound is the highest true miss rate that could still plausibly produce the misses you saw; if the real rate were higher, a result this good would happen less than 5% of the time. If the detector misses none, the smallest test set that supports that claim is 299 cases.1 For a target of 2 in 100 it is 149 cases, and for 1 in 200 it is 598.1
Real calls rarely contain emergencies. If, illustratively, 2% of calls do, collecting 300 emergencies at random needs 15,000 calls.1 That is why a team builds the set from labeled transcripts, adds physician-written and synthetic emergencies, and labels every case.
| Quantity (illustrative inputs) | Value |
|---|---|
| Cases needed, zero misses, target miss rate under 2% | 149 |
| Cases needed, zero misses, target miss rate under 1% | 299 |
| Cases needed, zero misses, target miss rate under 0.5% | 598 |
| Upper bound on miss rate, 300 cases, 0 misses | 0.99% |
| Upper bound, 300 cases, 1 miss | 1.57% |
| Upper bound, 300 cases, 2 misses | 2.08% |
| Upper bound, 300 cases, 3 misses | 2.56% |
| End-to-end emergency recall, detector 0.98 times handoff connects 0.995 | 0.9751 |
With three misses the upper bound is 2.56%. The upper bounds are exact one-sided limits (called Clopper-Pearson) from the binomial distribution, which gives the chance of seeing a given number of misses in a fixed number of independent cases: each is the largest true miss rate that still makes the observed count of misses plausible at the 5% level.1 The last row shows why you test the whole path, not just the detector: two stages that look strong multiply to a lower number.1
Text description of the diagram
- With 300 emergency cases and zero misses the upper bound on the miss rate is 0.99%.
- With three misses the upper bound is 2.56%.
A latency budget is the other number to work out. Take an illustrative end-to-end target of 1.5 seconds for a streaming voice agent loop of automatic speech recognition (ASR), the language model and text-to-speech (TTS). Split it as 300 milliseconds for ASR, 200 for the model's time to first token (time to first token (TTFT), the delay before the first output token appears), 250 for TTS first audio and 300 for the network.
That sums to 1,050 milliseconds and leaves 450 milliseconds of headroom.1 Text-to-speech usually needs a first speakable phrase of several tokens, not just one, so in practice the time to that first phrase matters more than time to first token alone. The 200 and 1.5 seconds come from the reported questions, not from a public source.
Trade-offs and edge cases
A constellation trades simplicity for separable checks. More agents mean more model calls per turn, more latency to budget and more places to fail; the gain is that each check can be tested, replaced and gated on its own.
Text description of the diagram
- A constellation keeps checks in separate specialist agents.
- A constellation costs more model calls per turn.
Edge cases to name in an interview:
- Specialists disagree with the primary agent. Define who wins. A safe default is that a block from a specialist or the handoff detector overrides the fluent answer.
- Evaluation drift. A fixed suite goes stale. Refresh it from new labeled transcripts, but keep old failures as regression cases.
- Rater disagreement. Physicians can disagree on a label. Record who reviewed, resolve disagreement by a second reviewer and report agreement.
- Regulation depends on function. Whether software is a regulated medical device depends on what it does. The U.S. Food and Drug Administration (FDA) issued its final clinical decision support software guidance on 2022-09-28, and guidance of this kind is revised, so as of October 2026 read the current version on fda.gov for your function rather than relying on this summary. The non-device criteria in that guidance concern software that supports a health-care professional, so a patient-facing voice agent should not assume it fits them.
- Evaluation style has moved toward rubrics. HealthBench (OpenAI, 2025) scores model replies in multi-turn health conversations against physician-written rubrics, which is the same shape as the physician-reviewed suites described above.
- Gateway and routing. Several models behind one call path need shared limits and logging; the LLM gateway interview questions cover that layer.
How to answer it in an interview
How would you design a multi-agent system for a post-discharge patient call?
I would use a primary conversational agent that holds the call state and speaks, plus specialist agents for medication, scheduling and records, each narrow and testable alone. A separate handoff detector watches every turn and transfers to a human nurse on an emergency; I would tune it for recall and measure it on a labeled emergency set. Specialists can block or correct the primary agent. Every checkpoint passes a release gate with physician-reviewed cases and regression tests. The cost is more calls per turn, so I would budget latency.
The spoken structure: name the agents, name the handoff as the floor, say how specialists override, then say how you gate releases and what it costs.
Common mistakes
- "One large model with a safety prompt is enough." (wrong) The Polaris abstract describes a primary agent plus specialists. (right) "I separate the conversation from the safety checks so each can be tested."
- "I would measure question-answering accuracy." (wrong) The work targets long voice conversations, not single-turn answers. (right) "I evaluate whole simulated calls, including emergencies and handoff."
- "The primary agent decides when to escalate." (wrong) A fluent model can talk itself out of it. (right) "An independent detector owns escalation and can override the primary agent."
- "Fifty emergency cases are plenty." (wrong) A small set cannot support a tight miss-rate claim. (right) "I size the set from the confidence bound, as in the worked example."
Follow-up questions
How would you build an automated evaluation dataset to test a model's ability to recognize emergency situations and hand off the call to a human nurse?
Label de-identified transcripts, have physicians write and review hard and borderline emergencies, add synthetic variants for rare cases, and split by emergency type. Size each type's set from the confidence bound so a zero-miss run supports your target, and keep every past failure as a regression case.
How would you design a scalable evaluation pipeline that benchmarks new model checkpoints against clinical safety standards before deployment?
On each new checkpoint, replay the labeled suites in parallel jobs, score each safety category separately, and compare to thresholds and the last released checkpoint. Block the release on any required category falling, and send the failing calls to physician review. Store the suite version with each result so runs are comparable.
How do you keep the time to first token low for a large model on a phone call?
Stream every stage, keep the prompt short, reuse cached prefixes, keep the model warm on dedicated hardware and measure the slow tail rather than the average. For a 70B model, tensor parallelism splits each layer across several graphics processing units (GPUs) to shorten the prefill delay; speculative decoding speeds later tokens but does not cut time to first token. The 200 milliseconds in the reported question is a budget line to defend, as in the latency split above.
How do you build retrieval over health records with zero tolerance for wrong-patient data?
Filter by patient identifier before any similarity search, store that identifier as metadata on every chunk, and refuse to answer when the filter returns nothing. Test it with adversarial near-duplicate patients; the RAG over real documents page covers chunking.
What if the miss-rate target is cut in half?
The test set roughly doubles: with zero misses allowed, 1% needs 299 cases and 0.5% needs 598, per the worked example.
Does Hippocratic mean the system is certified or regulated?
No source read for this page says so. The name describes the safety-first pattern; whether a product is regulated depends on its function and the rules that apply to it.
- Hippocratic-style clinical LLM agents split a call between a stateful primary agent and specialist safety agents.
- Design the human-nurse handoff first, as an independent detector with its own recall target.
- Size the emergency test set from a confidence bound, not from a round number.
- Gate every checkpoint on per-category safety metrics and regression cases.
- The cost is more model calls per turn, so budget latency end to end.
Sources
- Polaris: A Safety-focused LLM Constellation Architecture for Healthcare (arXiv 2403.13313v1) — arXiv (Mukherjee et al., Hippocratic AI), 20 Mar 2024
- HealthBench: Evaluating Large Language Models Towards Improved Human Health (arXiv 2505.08775) — arXiv (OpenAI), 13 May 2025
- FDA Issues Final Clinical Decision Support Software Guidance — Goodwin Procter LLP (summary of FDA guidance of 2022-09-28), 17 Oct 2022
