Chronos AI: Legal and medical document chronology platform
By Colter Mahlum, Founder & CEO of Mahlum Innovations — published 2026-05-01.
Colter Mahlum architected and shipped this case study end-to-end. Mechanical engineer turned AI builder, based in Bigfork and Kalispell, Montana. 11 production AI systems shipped across healthcare, wellness, legal, wealth management, fitness, and consumer apps.
Turning complex record sets into structured, searchable patient timelines for law firms
App: Chronos AI | Industry: Legal Technology | Client: Legal document intelligence platform (designed for law firms handling medical record review) | Company size: Law firms handling personal injury, medical malpractice, and workers compensation matters | Duration: Initial build complete, ongoing development
Summary
A HIPAA-aligned document chronology platform that ingests legal and medical record sets and produces structured, citation-linked event timelines, built on React, TypeScript, Node, and Supabase Postgres with pgvector for semantic search across document corpora.
The Challenge
Law firms handling personal injury, mass tort, and workers' compensation matters routinely receive hundreds to thousands of pages of medical records per case — an industry benchmark of 40–60 pages/hour means a 1,000-page file is 15–25 hours of manual review before a single fact is verified, with no source citations built in. On top of the speed problem, any vendor that touches that PHI on a law firm's behalf is required under HIPAA's Privacy Rule to sign a Business Associate Agreement (BAA), and under the Security Rule to protect that data at rest and in transit — obligations the platform had to satisfy from day one, not retrofit later.
Our Approach
- Built an ingestion pipeline that accepts multi-format document uploads (including scanned and handwritten records) and extracts structured events with dates, providers, diagnoses, and billing, each linked to its exact source page
- Used pgvector in Supabase Postgres for semantic similarity search across the full record corpus so queries find relevant records by meaning, not just keyword
- Designed a React and TypeScript frontend for reviewing, editing, and exporting structured, citation-linked chronologies
- Built a Node API layer with document parsing and event extraction pipeline
- Implemented per-matter organization with role-based access control for attorney and paralegal workflows
- Completed a full HIPAA compliance lift: signed BAA offered on every account, TLS 1.3 in transit and provider-managed AES-256 encryption at rest for all PHI, satisfying the Security Rule's encryption requirements alongside the Privacy Rule's BAA mandate
Outcomes & ROI
- 15–25 hrs → minutes — Review time per case: A 1,000-page file that takes 15–25 hours to read manually comes back as a first-draft timeline in minutes
- 100% — Citation-linked lines: Every extracted event cites its exact source page, so the chronology holds up when opposing counsel challenges it
- HIPAA + BAA — Compliance built in: Signed BAA on every account plus TLS 1.3 + AES-256 encryption, satisfying HIPAA's Privacy and Security Rules without separate negotiation
Reduces the time from record receipt to a reviewable, court-ready chronology from days of manual review to minutes, replaces open-ended billable-hour review cost with one flat credit per case, and clears the HIPAA/BAA bar every law firm vendor handling PHI has to clear before it can even be evaluated.
Technologies Used
React, TypeScript, Node.js, Supabase Postgres, pgvector, Drizzle ORM, TLS 1.3, AES-256 encryption at rest
Key Takeaways
- pgvector makes a document corpus searchable by meaning rather than keyword, which changes how legal teams find relevant records in large files
- Structured, page-cited event extraction is the foundation for any downstream legal analytics — a chronology only holds up in litigation if every line traces back to its exact source page
- HIPAA compliance (signed BAA plus encryption in transit and at rest) is a hard prerequisite for legal-medical tooling, not a nice-to-have — firms won't evaluate a vendor that can't produce a BAA
Frequently Asked Questions
What document formats does the platform accept?
The ingestion pipeline handles multi-format uploads including PDFs, scanned documents, and handwritten notes. Events are extracted with structured metadata including date, provider, facility, diagnosis, and billing, each linked back to its exact source page.
How does semantic search work across medical records?
Records are embedded using pgvector in Supabase Postgres. Search queries are also embedded and matched by vector similarity, so a search surfaces relevant records even when they use different clinical terminology than the query.
Is the platform HIPAA compliant?
Yes. A signed Business Associate Agreement (BAA) is included with every account as required under HIPAA's Privacy Rule, and PHI is protected with TLS 1.3 in transit and provider-managed AES-256 encryption at rest, satisfying the Security Rule's encryption requirements.
Is the platform in use at law firms today?
Yes, the platform is live at medchronosai.com and in active use by litigation teams handling personal injury, mass tort, and workers' compensation matters.
Related Services
About the Builder
Mechanical engineer turned AI builder. Colter personally architected and shipped Chronos AI end-to-end — strategy, model development, and the production MLOps work — alongside 10+ other AI systems across manufacturing, wealth management, healthcare, and consumer apps. Read full bio · LinkedIn.
More Case Studies
- Montana Athletic Club App — A member mobile application for a regional Montana health club, featuring Apple HealthKit integration for activity and health data sync, member account management, and class scheduling.
- Elysian Operations Platform (Time Warp + Nexus Wellness) — All-in-one workforce, payroll, wellness, and tax-compliance platform that replaces 8+ separate SaaS tools with a single unified system.
- Elysian Institute Website — A modern, SEO-optimized marketing website for a recovery, wellness, and longevity center, featuring 20 detailed service pages, transparent membership pricing, and direct integration with the client's external booking system.
- March Madness Commissioner — A full-stack commissioner dashboard that automates ESPN bracket league management — syncing picks, tracking payments, and generating AI-powered win projections — with a companion iOS mobile app.
- MealPlan — AI-powered family meal planning app that generates personalized weekly meal plans, tracks nutrition, scans barcodes, identifies food from photos, and acts as a personal nutrition coach.
- Smart Home Integrator Management Platform — A comprehensive AI-enabled business management platform that unifies CRM, project tracking, inventory, service tickets, and scheduling for a premium smart home automation company.