The VIBE-HI framework: a conceptual model for evaluating vibe coding appropriateness, quality, and safety in health...

Vibe coding-generating software through natural-language prompts to large language models without reviewing the underlying code-has moved rapidly from consumer technology into peer-reviewed clinical applications. By early 2026, clinicians had published vibe-coded teaching tools, a validated clinical nomogram, and an end-to-end omics platform built in under 10 minutes for under two dollars. Collins Dictionary named vibe coding its 2025 Word of the Year. No governance framework currently addresses the practice in healthcare.

To introduce VIBE-HI, a health-informatics-specific framework for evaluating the appropriateness, quality, and safety of vibe coding across clinical contexts, and to specify its decision logic, quality constructs, and regulatory mapping in operational detail.

VIBE-HI was developed as a conceptual framework through a structured, theory-informed narrative synthesis of three literatures-emerging biomedical vibe-coding reports, empirical software-engineering and security research on AI-generated code and established sociotechnical health-informatics theory and software-quality standards-following recognized conceptual-framework methodology. It was refined through illustrative application to four published clinician-built tools. This is a conceptual contribution; it is not a systematic review or a consensus (Delphi) study, and formal empirical validation is identified as the next step.

VIBE-HI organizes governance into three sequential layers. (1) Risk and Role Stratification assign one of four risk tiers-Green, Yellow, Orange, Red-and a matched clinician-developer role, from prototype to requirements analyst, using four criteria combined by an explicit dominant-criterion rule. (2) Quality and Validation extend ISO/IEC 25010:2023 with three measurable constructs-Code Provenance Transparency, Comprehension Coverage, and Hallucination Resilience-each with defined indicators and tier-dependent thresholds. (3) Compliance and Governance maps HIPAA, IEC 62304, FDA SaMD criteria, and the EU AI Act onto each tier and binds a named accountability owner. The framework treats comprehension abdication-the structural surrender of understanding to a generative system-as the core sociotechnical hazard distinguishing vibe coding from prior AI-assisted development, grounded in the automation-bias, responsibility-gap, and sociotechnical-systems literatures.

Clinical vibe coding needs risk-stratified governance now, before largely invisible adoption outpaces the field's capacity to assess it. VIBE-HI offers an architecture institutions can apply immediately and provides a clear pathway for empirical validation, beginning with a modified-Delphi consensus study and stakeholder review.