HIPAA is the floor, not the ceiling
BAAs, PHI handling, audit logging, role-based access, and de-identification shape the architecture from day one. State rules (CCPA, HITECH, 42 CFR Part 2) layer on top.
Industry · Healthcare
AI in healthcare: compliant, clinical,
AI in healthcare: compliant, clinical,
and actually shippable.
Patient data lives in EHRs, scanned PDFs, faxes, lab portals, and clinician notes. We build the intake, documentation, and triage workflows that read across all of it — under HIPAA, with audit trails, and with the people who already use the systems.
HIPAA-bound · BAA-ready.
—— What's different about healthcare
Healthcare doesn't reward generic AI.
The promise of AI in clinical settings is real. The path to it is narrower than in most industries — and the failure modes are louder. Here's the terrain.
Most clinical data is unstructured
Discharge summaries, lab PDFs, imaging reports, faxes, and free-text notes carry the signal. HL7/FHIR helps where it exists; the rest is parsing prose, scans, and inconsistent forms.
Clinicians won't tolerate one extra click
If AI adds steps, it dies on the floor. Anything we ship slots into the existing EHR workflow, saves time on day one, and stays auditable when something looks off.
Epic, Cerner, athenahealth — and a long tail
Integrations span FHIR APIs, HL7 v2 feeds, SFTP, Direct messaging, and legacy desktop tools. We design around what you actually have, not the vendor brochure.
—— Common challenges we see
The friction healthcare leaders bring us
Pulled from real conversations with COOs, CMIOs, and ops leaders at provider groups, payers, and digital-health companies.
Data is everywhere; answers are nowhere
Patient context is split across the EHR, imaging system, scanned referrals, secure email, and a stack of PDFs. Care teams burn hours stitching it together for every encounter.
Documentation is eating clinician time
Notes, prior auth, coding, and chart prep are the largest unbilled hours in the building. Burnout follows — and generic dictation tools haven't moved the needle.
Intake and triage still run on the phone
New-patient intake, referral routing, and triage still run through staff manually reading inbound faxes, forms, and emails. Volume is up and headcount isn't.
Compliance review kills every pilot
Promising AI pilots stall in legal, security, and IT review for six months. By the time approval comes, the team that championed it has moved on.
—— Services we deploy in healthcare
Where we typically start.
Each engagement is shaped by your data, your EHR, and your compliance posture. These are the most common entry points for healthcare clients.
AI Audit
Map the highest-value AI opportunities across your clinical, ops, and revenue-cycle workflows — with HIPAA and integration realities priced in.
Explore the audit →Intelligent Automation
Automate intake, prior-auth packaging, referral routing, fax parsing, and chart prep — the unglamorous work that drains the most hours.
See automation →AI Agentic Systems
Patient-support agents, clinical-documentation assistants, and triage routers that observe, plan, and act with auditable handoffs to humans.
See agents →AI-Native Development
For digital-health builders shipping a real product — from kiosk-first telehealth to clinical document-intelligence platforms.
See product build →AI Prototype Sprint
Three weeks to a working prototype your clinicians can react to — de-risk a use case before security review owns the next quarter.
See the sprint →—— The track most healthcare clients take
From audit to live workflow in a single arc.
Healthcare engagements almost always start with diagnosis, not building. Most provider and payer clients follow this path.
1
2–4 weeks
AI Audit
Map the highest-value AI opportunities across clinical, ops, and revenue-cycle workflows — with HIPAA and integration realities priced in.
2
3 weeks
Prototype Sprint
A working prototype your clinicians can react to — de-risk the use case before security review owns the next quarter.
3
3–12 weeks
Automation or Agents
Ship the intake, documentation, or triage workflow into production — with audit trails and auditable human handoffs.
4
Ongoing
Growth Engine
Measure adoption, expand to new workflows, and compound the wins across the organization.
—— Case studies
Healthcare work we've shipped
Two examples of what "compliant, clinical, and actually shippable" looks like in practice.
Connected device · Boston
Eyebot — vision tests in a mall
2 live · 8 rolling out · 7 moWe built the kiosk software, eCommerce flow, and telemedicine handoff that turned a clinical concept into live retail vision exams — two units live in Boston malls, eight more rolling out across New England.
Read the case →
Physician network · Global
Sermo — 1.3M doctors in 150 countries
1.3M physicians · 150 countriesA long-running partnership building and scaling the platform clinicians use to discuss cases, share evidence, and join research — with PHI-adjacent content moderation and identity verification baked in.
Read the case →—— Selected work
Work we've shipped and scaled.
Clinical AI and healthcare products we've built and shipped.
—— Compliance & security posture
What we bring to your security review.
Healthcare buyers don't read marketing — they read SOC reports, BAAs, and architecture diagrams. We come prepared.
BAA-ready, PHI-aware architectures
BAAs in place with the cloud and AI infrastructure we use. PHI is segmented, encrypted at rest and in transit, with role-based access and full audit trails on every read and write.
De-identification & minimum necessary
Data flows designed around the minimum-necessary standard. De-identified pipelines for training and analytics; PHI stays in your environment whenever the use case allows.
Secure interfaces, audit logs
SSO, MFA, secrets management, change control, and signed BAAs with every subprocessor. Integration patterns reviewed by your IT and InfoSec before code ships.
HIPAA-bound environments
BAA templates ready
—— Common questions
Healthcare leaders ask these first.
BAAs, hallucination, EHR integration, security-review timelines, non-PHI pilots, and who owns the IP.
Can you sign a BAA?
Yes. We sign Business Associate Agreements on any engagement that touches PHI, carry BAAs with the cloud and AI infrastructure we deploy on, and maintain a subprocessor list we can share with your security team during diligence.
Will the AI hallucinate clinical content?
No model is perfect. The mitigation isn't a better model — it's an architecture that constrains it to retrieve, summarize, and cite source documents rather than generate from memory, plus a human-in-the-loop step on anything that affects care. We design for "show your work" by default in clinical contexts.
Do you integrate with our EHR?
We've worked with FHIR APIs (Epic, Cerner, athenahealth), HL7 v2 feeds, Direct messaging, and the SFTP-and-PDF reality of smaller systems. The right pattern depends on your read/write needs, your EHR vendor's API maturity, and what your IT team will actually approve.
How long does security review usually take?
Faster than you'd expect — because we come pre-packaged for it. Architecture diagrams, data-flow maps, BAAs, and our subprocessor list are ready on day one. Most provider security reviews close in 4–8 weeks; payer reviews take longer.
Can you start with a non-PHI pilot?
Often the right move. We'll scope a first phase against synthetic or de-identified data so you can validate the approach before legal review owns the timeline. Once the pattern works, we move into the PHI environment with the full compliance scaffold in place.
Who owns the IP and the model artifacts?
You do. All code, prompts, fine-tunes, embeddings, and trained artifacts are yours by default. We retain no rights to your data, your derivatives, or anything we build for you under the engagement.
—— Field notes
What we’re writing about.
Field notes from the studio — what we’re learning about AI products, agent UX, and the messy reality of shipping software in 2026.
