AI development for healthcare, built around the data you cannot spill
Most AI work in healthcare stalls on one question: where does the protected health information go. We answer that first — in writing, with the data path drawn — and only then talk about models.
What changes here
Artificial Intelligence in healthcare is not the same engagement
PHI never leaves a boundary you approved
Retrieval stays inside your own store, inference runs on a deployment covered by a business associate agreement, and the data path is documented before a single record is sent anywhere.
De-identification where the use case allows it
Where the task does not need identifiers, we strip them before the model ever sees the text — the cheapest risk reduction available, and the one most projects skip.
A clinician in the loop by design
Anything that touches care gets a review step and a refusal path. The system is built to say it does not know, because in this setting a confident wrong answer is the expensive failure.
What the regime actually requires
HIPAA does not prohibit AI. It constrains who processes protected health information, under what agreement, and with what audit trail — and those constraints are design inputs, not blockers.
- A business associate agreement with any vendor that processes PHI, including the model provider
- Minimum necessary access — the retrieval scope is part of your access control, not separate from it
- Audit logging of prompts and outputs, retained under your existing record policy
- For Canadian data, PIPEDA and provincial rules such as Ontario's PHIPA, including residency expectations
The work itself
Full artificial intelligence pageLLM applications and RAG over your own data
Retrieval-augmented systems on your documents, tickets, and records — chunking, embeddings, a vector store, and citations, so answers can be traced back to a source.
Machine learning models and forecasting
Classification, scoring, and demand or churn forecasting trained on your history, with feature pipelines and retraining scheduled rather than remembered.
Document, voice, and workflow automation
Intake, extraction, classification, and summarization wired into the systems the work already lives in, with a human review step where the cost of being wrong is high.
Evaluation sets and regression testing
A scored test set built with your subject-matter experts and run on every change, so a prompt or model swap has to prove it improved things.
Guardrails, grounding, and audit trails
Input and output filtering, retrieval grounding, refusal paths, and logged prompts and responses — the record you need when someone asks why it said that.
Latency, token cost, and model routing
Caching, batching, and routing cheap work to smaller models, with spend and p95 latency on a dashboard rather than a surprise invoice.
Healthcare questions we get asked
Something more specific? Send us the situation and we’ll answer it straight.