Longitudinal drift and responsible deployment

"On day one I knew what a healthy resting heart rate looked like. Four hundred days later the person had aged, the sensor had yellowed, and I had quietly retrained myself into confident nonsense. Nobody told me. That was the whole problem."

A Chastened AI Agent

This section assumes the personalized-baseline machinery of Section 33.2 and the change-detection vocabulary of Chapter 12. Drift is the deployment-scale cousin of the distribution shift treated formally in Chapter 66, and the calibration language here (does a 0.8 alarm still mean an 80% chance of the event?) comes from Chapter 18. The regulatory machinery for changing a deployed medical model, the predetermined change control plan, waits in Chapter 34; here we build the technical monitoring that such a plan governs.

Three drifts you must never confuse

The word "drift" hides three physically distinct processes, and the correct response to each is different, so conflating them is the root cause of most bad long-term monitors.

Sensor drift is the measurement chain changing while the body stays the same. A skin-temperature thermistor develops a slow offset; an optical PPG path loses contact as adhesive cures; an electrochemical glucose sensor's sensitivity decays across its wear period. This is the drift of Chapter 2: a change in the measurement model, not in the quantity measured. The correct response is recalibration or a hardware replacement, never a clinical alert.

Physiological drift is the body genuinely changing on a slow clock: aging raises arterial stiffness, a summer heat wave lifts resting heart rate, a new beta-blocker lowers it, pregnancy reshapes half the panel. Some of this drift is benign adaptation the baseline should track; some of it is the early slope of a disease the baseline must not absorb. Distinguishing the two is the central clinical judgment of the whole chapter.

Model or concept drift is the relationship between features and label decaying even when both input and body are stable, because the label distribution or care pathway changed, or because an online learner has slowly poisoned itself. This is where a self-updating personalized baseline turns dangerous: if it adapts fast enough to fold a two-week decline into its running mean, it erases exactly the trend a physician needed to see.

Detecting drift across a fleet

You cannot label most of this in the field, so drift monitoring is unsupervised: watch distributions, not accuracy. Three complementary signals catch most problems. First, input drift: compare the recent feature distribution against a reference window with a divergence statistic. The Population Stability Index (PSI) and the two-sample Kolmogorov-Smirnov statistic are the workhorses; a PSI above roughly 0.2 on a feature is a standard "investigate" threshold. Second, prediction drift: the model's own output histogram (fraction of windows flagged anomalous, mean risk score) should be roughly stationary for a stable individual, so a rising flag rate with no matching input shift usually indicts the model or the sensor, not the patient. Third, calibration drift: whenever a delayed ground truth does arrive (a clinic visit, a confirmed event, a labeled CGM excursion), recompute reliability. A monitor whose 0.8-score events used to fire 80% of the time and now fire 40% has decalibrated, and per Chapter 18 that silently breaks every downstream threshold.

The subtlety unique to health is separating input drift from a real clinical event, because both look like "the distribution moved." The discriminator is timescale and reversibility. Sensor and seasonal drift are slow, monotone, and correlated with context you can measure (device age, ambient temperature, wear duration); an acute event is fast and often correlated with symptoms or other modalities. This is why the multimodal fusion of Section 33.3 pays a second dividend at deployment: a heart-rate shift that co-moves with an accelerometer activity change is behavior, while the same shift at rest with rising temperature is a candidate fever, not a broken sensor.

A minimal fleet drift monitor

The code below implements the input-drift half of that policy: it computes PSI between a reference window and a current window for one feature, and, critically, gates the verdict on whether a matched context channel (here, activity) also moved. That gate is what stops the monitor from screaming "sensor drift" every time the wearer simply started exercising. You would run this per feature, per device, on a rolling schedule inside the fleet-operations stack of Chapter 69.

import numpy as np

def psi(reference, current, bins=10):
    edges = np.quantile(reference, np.linspace(0, 1, bins + 1))
    edges[0], edges[-1] = -np.inf, np.inf
    r = np.histogram(reference, edges)[0] / len(reference) + 1e-6
    c = np.histogram(current, edges)[0] / len(current) + 1e-6
    return float(np.sum((c - r) * np.log(c / r)))

def triage(feat_ref, feat_cur, ctx_ref, ctx_cur, feat_thr=0.2, ctx_thr=0.2):
    d_feat = psi(feat_ref, feat_cur)      # how much the vital-sign feature moved
    d_ctx  = psi(ctx_ref, ctx_cur)        # how much the context channel moved
    if d_feat < feat_thr:
        return "stable", d_feat
    if d_ctx > ctx_thr:
        return "behavioral: feature moved with context, do not alert", d_feat
    return "sensor-or-physiological drift: investigate, do not auto-adapt", d_feat

rng = np.random.default_rng(0)
hr_ref  = rng.normal(62, 4, 2000)          # resting HR, healthy baseline window
hr_cur  = rng.normal(70, 4, 2000)          # HR has risen 8 bpm
act_flat = rng.normal(0.1, 0.05, 2000)     # still, both windows
print(triage(hr_ref, hr_cur, act_flat, act_flat))

From monitoring to responsible response

Detecting drift is the easy half; responding without harm is the hard half, and it is where sensing meets ethics. Four rules separate a responsible long-term monitor from a liability. Do not auto-adapt through uncertainty: when drift is flagged and its cause is ambiguous, freeze the personalized baseline rather than update it, because a wrong update is silent and compounding. Design for the alert budget, not the ROC curve: a screening monitor worn by millions produces alarms at population scale, so alert fatigue, the clinician or user learning to swipe away a chronically noisy device, is a safety failure exactly as much as a missed event. Positive predictive value at the deployed prevalence, not sensitivity in the lab, is the number that governs trust. Watch for over-medicalization: a contactless or wearable monitor that surfaces every benign variation converts healthy people into anxious patients and floods clinics; the responsible default for an ambiguous, low-consequence signal is to observe and trend, not to alarm. Audit for equity: drift is rarely uniform. PPG-derived signals degrade differently across skin tones, and a fleet retrained on whoever wears the device most will drift toward that majority, so drift metrics must be sliced by demographic and device cohort or the model will quietly get worse for the underserved, a fairness obligation developed fully in Chapter 70.

What's Next

In Chapter 34, we turn the monitoring discipline of this section into an approvable process: how software as a medical device is validated prospectively, how a predetermined change control plan lets a model adapt without a new submission each time, and how the same physiological signals that reveal disease can also re-identify the person, forcing biometric privacy to the center of any long-lived health deployment.