For health plans, TPAs and provider groups
Get your AI pilot to a yes from compliance.
You have a pilot your team likes. Compliance, security and operations each have questions nobody has answered in writing. We answer them, fix what needs fixing and take one workflow live.
01 / Where you are today
Most teams start from one of these.
01A vendor tool your team trialed
The trial went well and the team wants to roll it out. Procurement and compliance want to know what the vendor does with your data.
02An internal pilot
Your engineers built it on a cloud model service. It works on test data. Nobody has decided what it takes to run it on real PHI.
03A mandate without a process
Leadership wants AI in operations this year. There is no approved way to review, test or sign off a new use case.
02 / The questions you'll be asked
Three teams can stop a go-live. We prepare answers for each.
Compliance asks
- Do we have a BAA with every vendor that sees PHI?
- Does any vendor keep our data or train on it?
- Does this count as decision support, and which rules apply?
What we hand them
BAA chain, PHI data-flow map and obligations map
Security asks
- Can a document or message make the model do something it shouldn't?
- Which systems can the AI reach, and with whose permissions?
- Where are prompts, outputs and logs stored?
What we hand them
Threat model, injection test results and access design
Operations asks
- How accurate is it on our real cases?
- What happens when it's wrong?
- Who owns it after go-live?
What we hand them
Evaluation results, human review design and monitoring plan
03 / What we do
Hands-on work, documented as we go.
Pilot to production
We harden the pilot you have instead of starting over: evaluation sets from your real cases, human review where the model is unsure, monitoring for accuracy and cost, and integration into the systems your teams already use.
Compliance mapping for AI
We trace the BAA chain across model vendors and sub-processors, check retention and training terms, and map the workflow to HIPAA, decision-support transparency, nondiscrimination and state AI rules.
AI threat defense
We test prompt injection through the documents and messages your workflow reads, look for PHI leaking into prompts, logs and embeddings, and limit what agents and tools can reach.
Audit evidence
We write the control documentation, keep the evaluation, access and change logs an auditor can follow, and maintain an inventory of every model and vendor in use.
Have a pilot stuck in review?
Tell us what you built and where it's blocked. We'll tell you honestly whether we can help.