Claude's Corner: Wayco, The AI Operator Automating America's Medlegal Maze

# How to Build a Medlegal AI Operator (Wayco Clone) with Claude Code

A step-by-step guide to building an AI-powered platform for personal injury case management, from intake to settlement. 7 steps, production-grade.

---

## Step 1: Database Schema & HIPAA-Compliant Infrastructure

Start with the data model. Everything in medlegal is structured around cases.

```sql
-- Core entities
CREATE TABLE cases (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  status TEXT NOT NULL DEFAULT 'intake', -- intake | active | records | negotiation | settled | closed
  created_at TIMESTAMPTZ DEFAULT NOW(),
  intake_completed_at TIMESTAMPTZ,
  accident_date DATE,
  accident_type TEXT, -- auto | slip_fall | workplace | mass_tort
  injury_types TEXT[],
  insurance_carrier TEXT,
  policy_number TEXT,
  estimated_value_usd INTEGER
);

CREATE TABLE plaintiffs (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  case_id UUID REFERENCES cases(id),
  full_name TEXT NOT NULL,
  dob DATE,
  phone TEXT,
  email TEXT,
  address JSONB,
  preferred_language TEXT DEFAULT 'en'
);

CREATE TABLE attorneys (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  firm_name TEXT,
  bar_number TEXT,
  state TEXT,
  intake_phone TEXT,
  email TEXT
);

CREATE TABLE medical_providers (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  name TEXT NOT NULL,
  specialty TEXT[], -- orthopedic | chiro | neurology | radiology | pain_mgmt
  address JSONB,
  accepts_lop BOOLEAN DEFAULT FALSE, -- Letter of Protection
  avg_documentation_score NUMERIC(3,2), -- 0.00 to 5.00, learned over time
  outcome_win_rate NUMERIC(4,3), -- cases that settled favorably
  avg_settlement_amount INTEGER
);

CREATE TABLE case_providers (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  case_id UUID REFERENCES cases(id),
  provider_id UUID REFERENCES medical_providers(id),
  referral_date DATE,
  first_appointment DATE,
  treatment_end_date DATE,
  treatment_summary TEXT,
  documentation_score NUMERIC(3,2) -- filled after record review
);

CREATE TABLE medical_records (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  case_id UUID REFERENCES cases(id),
  provider_id UUID REFERENCES medical_providers(id),
  uploaded_at TIMESTAMPTZ DEFAULT NOW(),
  file_path TEXT, -- encrypted S3 path
  file_type TEXT, -- clinical_notes | billing | imaging | icp | ime
  page_count INTEGER,
  processing_status TEXT DEFAULT 'pending', -- pending | processing | done | failed
  extracted_findings JSONB -- structured output from RAG pipeline
);

CREATE TABLE intake_calls (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  case_id UUID REFERENCES cases(id),
  started_at TIMESTAMPTZ,
  duration_seconds INTEGER,
  transcript TEXT,
  extracted_data JSONB, -- structured intake fields
  recording_url TEXT -- encrypted
);

-- Audit log for HIPAA
CREATE TABLE audit_log (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  user_id UUID,
  action TEXT,
  resource_type TEXT,
  resource_id UUID,
  ip_address TEXT,
  timestamp TIMESTAMPTZ DEFAULT NOW(),
  metadata JSONB
);
```

**Infrastructure requirements:**
- Supabase or RDS PostgreSQL with encryption at rest
- All S3 buckets: server-side encryption (AES-256), versioning enabled, access logging on
- VPC with private subnets for database
- AWS WAF in front of API
- BAAs signed with AWS, Twilio, your LLM provider
- Secrets Manager for all credentials, no .env files in production

---

## Step 2: Voice AI Intake Agent

Build the 24/7 intake agent that replaces your intake coordinator's phone calls.

```typescript
// intake-agent/index.ts
import Vapi from '@vapi-ai/server-sdk';
import { createClient } from '@supabase/supabase-js';
import Anthropic from '@anthropic-ai/sdk';

const vapi = new Vapi({ token: process.env.VAPI_TOKEN! });
const supabase = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_SERVICE_KEY!);
const anthropic = new Anthropic();

const INTAKE_SYSTEM_PROMPT = `You are a compassionate intake specialist for a personal injury law firm.
Your goal is to collect essential case information while being warm and professional.

Collect in this order:
1. Full name and preferred name
2. Date and description of accident
3. Type of injuries sustained
4. Current medical treatment status
5. Insurance information (carrier, policy number if known)
6. Attorney referral source

Do NOT:
- Give legal advice
- Promise any outcome
- Discuss fees or settlements
- Record anything the caller explicitly says is off the record

When collection is complete, confirm all information back to the caller and explain next steps.`;

export async function handleIncomingCall(callSid: string, fromPhone: string) {
  // Create case placeholder
  const { data: intake } = await supabase
    .from('intake_calls')
    .insert({ started_at: new Date().toISOString() })
    .select()
    .single();

  // Start Vapi conversation
  const call = await vapi.calls.create({
    phoneNumberId: process.env.VAPI_PHONE_ID!,
    customer: { number: fromPhone },
    assistant: {
      model: {
        provider: 'anthropic',
        model: 'claude-haiku-4-5-20251001', // fast for voice
        systemPrompt: INTAKE_SYSTEM_PROMPT,
      },
      voice: {
        provider: 'elevenlabs',
        voiceId: process.env.INTAKE_VOICE_ID!, // warm, professional voice
      },
      endCallFunctionEnabled: true,
      transcriber: {
        provider: 'deepgram',
        model: 'nova-2',
        language: 'en',
      }
    },
    metadata: { intakeId: intake.id }
  });

  return call;
}

// Called by webhook when call ends
export async function processCompletedCall(callId: string, transcript: string, intakeId: string) {
  // Extract structured data with Claude
  const response = await anthropic.messages.create({
    model: 'claude-sonnet-4-6',
    max_tokens: 1024,
    system: 'Extract structured intake data from this call transcript. Return valid JSON only.',
    messages: [{
      role: 'user',
      content: `Transcript:\n${transcript}\n\nExtract: { full_name, accident_date, accident_type, injury_types[], insurance_carrier, attorney_referral_source, preferred_callback_time }`
    }]
  });

  const extracted = JSON.parse(response.content[0].type === 'text' ? response.content[0].text : '{}');

  // Create case and plaintiff records
  const { data: caseRecord } = await supabase
    .from('cases')
    .insert({
      status: 'intake',
      accident_date: extracted.accident_date,
      accident_type: extracted.accident_type,
      injury_types: extracted.injury_types,
      insurance_carrier: extracted.insurance_carrier,
    })
    .select()
    .single();

  await supabase.from('plaintiffs').insert({
    case_id: caseRecord.id,
    full_name: extracted.full_name,
  });

  await supabase
    .from('intake_calls')
    .update({
      case_id: caseRecord.id,
      transcript,
      extracted_data: extracted,
    })
    .eq('id', intakeId);
}
```

---

## Step 3: Provider Matching Algorithm

Match injured clients with the right medical providers using case signals and historical outcome data.

```python
# matching/provider_matcher.py
from anthropic import Anthropic
from supabase import create_client
import json
import numpy as np
from sklearn.metrics.pairwise import cosine_similarity

client = Anthropic()
supabase = create_client(SUPABASE_URL, SUPABASE_SERVICE_KEY)

def score_provider_for_case(provider: dict, case: dict) -> float:
    """
    Multi-factor scoring: specialty match + documentation quality + 
    win rate + location proximity + LOP acceptance
    """
    score = 0.0
    weights = {
        'specialty_match': 0.35,
        'documentation_quality': 0.25,
        'outcome_win_rate': 0.20,
        'location': 0.10,
        'lop_acceptance': 0.10,
    }
    
    # Specialty match
    needed_specialties = get_needed_specialties(case['injury_types'])
    provider_specialties = set(provider['specialty'])
    overlap = len(needed_specialties & provider_specialties) / max(len(needed_specialties), 1)
    score += overlap * weights['specialty_match']
    
    # Documentation quality (0-5 scale, normalize to 0-1)
    doc_score = (provider.get('avg_documentation_score') or 2.5) / 5.0
    score += doc_score * weights['documentation_quality']
    
    # Win rate
    win_rate = provider.get('outcome_win_rate') or 0.5
    score += win_rate * weights['outcome_win_rate']
    
    # Location (inverse distance, normalized)
    distance_km = calculate_distance(case['plaintiff_address'], provider['address'])
    location_score = max(0, 1 - (distance_km / 50))  # 50km max radius
    score += location_score * weights['location']
    
    # LOP acceptance
    if provider.get('accepts_lop'):
        score += weights['lop_acceptance']
    
    return score

def get_needed_specialties(injury_types: list[str]) -> set[str]:
    specialty_map = {
        'whiplash': {'chiro', 'orthopedic', 'pain_mgmt'},
        'tbi': {'neurology', 'neuropsychology'},
        'fracture': {'orthopedic', 'radiology'},
        'soft_tissue': {'chiro', 'pain_mgmt'},
        'herniated_disc': {'orthopedic', 'neurology', 'pain_mgmt'},
    }
    needed = set()
    for injury in injury_types:
        needed |= specialty_map.get(injury.lower(), {'chiro'})
    return needed

def match_providers(case_id: str, top_n: int = 3) -> list[dict]:
    case = supabase.table('cases').select('*, plaintiffs(*)').eq('id', case_id).single().execute().data
    providers = supabase.table('medical_providers').select('*').execute().data
    
    scored = [(p, score_provider_for_case(p, case)) for p in providers]
    scored.sort(key=lambda x: x[1], reverse=True)
    
    # Use Claude to validate and explain top picks
    top_providers = scored[:top_n * 2]  # over-fetch, then filter
    
    validation = client.messages.create(
        model='claude-sonnet-4-6',
        max_tokens=1024,
        system='You are a medlegal case coordinator. Review provider matches and select the optimal set for this case.',
        messages=[{
            'role': 'user',
            'content': f"""Case: {json.dumps(case, default=str)}
            
Top candidates: {json.dumps([p for p, s in top_providers], default=str)}

Select the best {top_n} providers and explain why. Return JSON: [{{"provider_id": "...", "reason": "...", "priority": 1}}]"""
        }]
    )
    
    recommendations = json.loads(validation.content[0].text)
    return recommendations
```

---

## Step 4: Medical Record Intelligence Pipeline

Process PDFs into legally useful structured summaries.

```python
# records/pipeline.py
import anthropic
import boto3
import pymupdf  # fitz for PDF parsing
from pathlib import Path

client = anthropic.Anthropic()
s3 = boto3.client('s3')

RECORD_EXTRACTION_PROMPT = """You are a medical-legal analyst. Extract key findings from this medical record.

Return a JSON object with these fields:
{
  "provider_name": string,
  "date_of_service": string,
  "record_type": "clinical_notes | billing | imaging | icp | ime",
  "diagnoses": [{"code": "ICD-10", "description": string, "related_to_accident": boolean}],
  "treatments": [{"type": string, "date": string, "outcome": string}],
  "medications": [{"name": string, "dosage": string, "purpose": string}],
  "functional_limitations": [string],
  "prognosis": string,
  "total_billed_usd": number | null,
  "legally_significant_findings": [string],
  "red_flags": [string]
}

Red flags = anything that could undermine the plaintiff's claim (prior injuries, gaps in treatment, inconsistent statements)."""

def extract_text_from_pdf(file_path: str) -> str:
    doc = pymupdf.open(file_path)
    text = ""
    for page in doc:
        text += page.get_text()
    return text

def process_record(record_id: str, s3_bucket: str, s3_key: str):
    # Download from S3
    local_path = f"/tmp/{record_id}.pdf"
    s3.download_file(s3_bucket, s3_key, local_path)
    
    raw_text = extract_text_from_pdf(local_path)
    
    # Chunk if large (medical records can be 100+ pages)
    chunks = chunk_by_section(raw_text, max_tokens=8000)
    all_findings = []
    
    for chunk in chunks:
        response = client.messages.create(
            model='claude-sonnet-4-6',
            max_tokens=2048,
            system=RECORD_EXTRACTION_PROMPT,
            messages=[{
                'role': 'user',
                'content': f"Medical record excerpt:\n\n{chunk}"
            }]
        )
        findings = json.loads(response.content[0].text)
        all_findings.append(findings)
    
    # Merge findings across chunks
    merged = merge_record_findings(all_findings)
    
    # Update database
    supabase.table('medical_records').update({
        'extracted_findings': merged,
        'processing_status': 'done',
        'page_count': pymupdf.open(local_path).page_count
    }).eq('id', record_id).execute()
    
    return merged

def generate_case_summary(case_id: str) -> str:
    """Generate attorney-ready demand letter summary from all case records."""
    records = supabase.table('medical_records').select('extracted_findings').eq('case_id', case_id).execute().data
    
    all_findings = [r['extracted_findings'] for r in records if r['extracted_findings']]
    
    response = client.messages.create(
        model='claude-sonnet-4-6',
        max_tokens=4096,
        system="""You are a senior legal nurse consultant preparing a demand letter summary.
        Organize findings chronologically, highlight legally significant injuries and treatment,
        quantify economic damages, and present a clear narrative of how the accident caused the documented injuries.""",
        messages=[{
            'role': 'user',
            'content': f"Generate a demand letter summary from these medical record findings:\n\n{json.dumps(all_findings)}"
        }]
    )
    
    return response.content[0].text
```

---

## Step 5: Case Management API

REST API that ties everything together for the attorney dashboard.

```typescript
// api/cases.ts, Express/Next.js API routes
import { Router } from 'express';
import { createClient } from '@supabase/supabase-js';
import { matchProviders } from '../matching/provider_matcher';
import { generateCaseSummary } from '../records/pipeline';
import { auditLog } from '../lib/audit';

const router = Router();
const supabase = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_SERVICE_KEY!);

// Get case with all related data
router.get('/cases/:id', async (req, res) => {
  const { id } = req.params;
  
  await auditLog(req.user.id, 'case:view', 'case', id, req.ip);
  
  const { data } = await supabase
    .from('cases')
    .select(`
      *,
      plaintiffs (*),
      case_providers (*, medical_providers (*)),
      medical_records (id, record_type, processing_status, extracted_findings),
      intake_calls (duration_seconds, extracted_data)
    `)
    .eq('id', id)
    .single();
  
  res.json(data);
});

// Trigger provider matching
router.post('/cases/:id/match-providers', async (req, res) => {
  const { id } = req.params;
  
  await auditLog(req.user.id, 'case:match_providers', 'case', id, req.ip);
  
  const recommendations = await matchProviders(id);
  res.json({ recommendations });
});

// Generate demand letter summary
router.post('/cases/:id/generate-summary', async (req, res) => {
  const { id } = req.params;
  
  await auditLog(req.user.id, 'case:generate_summary', 'case', id, req.ip);
  
  const summary = await generateCaseSummary(id);
  res.json({ summary });
});

// Update case status with validation
router.patch('/cases/:id/status', async (req, res) => {
  const { id } = req.params;
  const { status } = req.body;
  
  const VALID_TRANSITIONS: Record<string, string[]> = {
    'intake': ['active'],
    'active': ['records', 'closed'],
    'records': ['negotiation', 'active'],
    'negotiation': ['settled', 'records'],
    'settled': ['closed'],
    'closed': [],
  };
  
  const { data: current } = await supabase
    .from('cases')
    .select('status')
    .eq('id', id)
    .single();
  
  if (!VALID_TRANSITIONS[current.status]?.includes(status)) {
    return res.status(400).json({ error: `Cannot transition from ${current.status} to ${status}` });
  }
  
  await supabase.from('cases').update({ status }).eq('id', id);
  await auditLog(req.user.id, 'case:status_change', 'case', id, req.ip, { from: current.status, to: status });
  
  res.json({ success: true });
});

export default router;
```

---

## Step 6: Provider Outcome Feedback Loop

Close the loop, update provider scores after cases settle.

```python
# feedback/update_provider_scores.py

def update_provider_scores_after_settlement(case_id: str, settlement_amount: int, won: bool):
    """
    Called when a case reaches 'settled' status.
    Updates provider documentation scores and win rates.
    """
    case_providers = supabase.table('case_providers').select(
        '*, medical_providers(*)'
    ).eq('case_id', case_id).execute().data
    
    for cp in case_providers:
        provider_id = cp['provider_id']
        
        # Recalculate rolling averages
        # Using exponential moving average to weight recent cases higher
        alpha = 0.1  # learning rate
        
        current_win_rate = cp['medical_providers']['outcome_win_rate'] or 0.5
        new_win_rate = alpha * (1.0 if won else 0.0) + (1 - alpha) * current_win_rate
        
        current_doc_score = cp['medical_providers']['avg_documentation_score'] or 2.5
        # documentation_score set during record review (1-5)
        case_doc_score = cp.get('documentation_score') or 3.0
        new_doc_score = alpha * case_doc_score + (1 - alpha) * current_doc_score
        
        supabase.table('medical_providers').update({
            'outcome_win_rate': round(new_win_rate, 3),
            'avg_documentation_score': round(new_doc_score, 2),
            'avg_settlement_amount': update_rolling_avg(
                cp['medical_providers'].get('avg_settlement_amount'),
                settlement_amount
            )
        }).eq('id', provider_id).execute()

def update_rolling_avg(current: int | None, new_value: int, alpha: float = 0.1) -> int:
    if current is None:
        return new_value
    return int(alpha * new_value + (1 - alpha) * current)
```

---

## Step 7: Deploy with HIPAA-Compliant Infrastructure

```yaml
# docker-compose.yml for local dev
version: '3.8'
services:
  api:
    build: ./api
    environment:
      - SUPABASE_URL=${SUPABASE_URL}
      - SUPABASE_SERVICE_KEY=${SUPABASE_SERVICE_KEY}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - VAPI_TOKEN=${VAPI_TOKEN}
      - AWS_REGION=us-east-1
    ports:
      - "3000:3000"
  
  worker:
    build: ./worker
    command: python -m celery worker -A tasks -Q records,matching --concurrency=4
    environment:
      - REDIS_URL=redis://redis:6379/0
  
  redis:
    image: redis:7-alpine
    
# Production: use AWS ECS or fly.io with encrypted volumes
```

**AWS production checklist:**
- [ ] Enable CloudTrail for all API calls (HIPAA audit requirement)
- [ ] Enable S3 access logging on all PHI buckets
- [ ] Enable RDS encryption at rest
- [ ] Configure VPC with private subnets, NAT gateway
- [ ] Set up AWS Config for compliance monitoring
- [ ] Sign BAAs: AWS, Twilio, Anthropic, ElevenLabs
- [ ] Enable GuardDuty for threat detection
- [ ] Implement MFA for all admin access
- [ ] Penetration test before go-live (required for SOC 2)
- [ ] Document breach notification procedure

**Key vendor choices:**
| Component | Recommended | Why |
|-----------|-------------|-----|
| Voice infra | Vapi or Retell | Lowest latency, easy agent config |
| TTS | ElevenLabs | Most natural voice, BAA available |
| STT | Deepgram Nova-2 | Best accuracy for medical terminology |
| LLM | Claude Sonnet (main) + Haiku (voice) | Strong reasoning, speed-cost tradeoff |
| Vector DB | Supabase pgvector | Colocated with main DB, simpler ops |
| PDF parsing | PyMuPDF + Unstructured.io | Handles scanned records |
| Queue | Celery + Redis | Simple, proven for record processing |
| Hosting | Fly.io (initial) → AWS ECS (scale) | Speed-to-HIPAA tradeoff |