On that, I'm not sure. My area of ML & data science practice is, thankfully, not so high-stakes. There's a method of anomaly detection called one-class SVM (Support Vector Machine) that is pretty much this- train on normal, flag on "wtf is this you never training me on this 01010##" <-- Not actual ISO standard ML model output or medical jargon. But I'm not sure if that's what's most effective here. My gut instinct in first approaching the task would be to throw a bunch of models at it, mixed-methods, with one-class SVM as a fall back. But I'm also way out of my depth on medical diagnostics ML so that's just a generalist's guess.