// INDUSTRY
AI for Healthcare
Cloud AI APIs are a compliance problem for protected health information — and "our vendor is SOC 2" doesn't fix it. We build private AI systems that run entirely on healthcare organizations' own infrastructure, where PHI never leaves the network boundary.
The compliance reality
HIPAA doesn't just require encryption and access control. It requires a Business Associate Agreement with every third party that touches PHI, and it requires the Covered Entity to verify that the BA's handling of that data meets the regulation. For most cloud LLM APIs in 2026, the BAA either doesn't exist, carves out the training-data question, or leaves the Covered Entity with unresolved audit risk.
The cleanest way through this is architectural: don't send PHI to third-party inference in the first place. Run the model on-premise, inside the same compliance boundary as the rest of the EHR stack.
What we build for healthcare
Clinical documentation assistance
Ambient scribe and structured-note generation from clinical encounters, with output reviewed by the clinician before it enters the EHR. Runs on local GPUs; audio and transcripts never leave the hospital network. Integrates with Epic, Cerner, Athena, and open-source EHRs via FHIR.
Protocol and guideline lookup
RAG over your internal clinical protocols, facility-specific order sets, drug interaction databases, and regulatory guidance. A clinician asks a question, the system answers with citations to the exact protocol section — auditable, source-grounded, no hallucinated recommendations. See our RAG pipeline service.
Patient communication drafting
Patient-portal message drafting, discharge instruction generation, and education-material personalization — drafted by AI, always reviewed by a clinician before send. The AI handles the boilerplate; the human handles the judgment.
Research literature synthesis
Evidence retrieval across your internal literature database and external sources (PubMed, ClinicalTrials.gov) with structured, cited summaries. Speeds up systematic reviews without outsourcing the judgment to a black box.
Operational and administrative workflows
Prior auth drafting, claims denial triage, revenue-cycle document classification, credentialing workflow automation. Not glamorous, but often the highest-ROI starting point for AI in a healthcare organization.
Hardware and deployment model
Most healthcare deployments we ship run on a small GPU cluster inside the hospital's existing data center or private cloud — usually 2–4 workstations or servers with NVIDIA A100 or consumer 4090 GPUs. Models range from 7B to 70B parameters depending on workload. Inference stays entirely on-network. Logs, prompts, and completions live in the hospital's existing SIEM, not a vendor's analytics stack. See our local AI deployment and hardware guide.
Model selection for clinical use
We default to open-weight medical-tuned models when available (Meditron, BioMistral, Medalpaca) and general-purpose models (Llama, Qwen, DeepSeek) for non-clinical workflows. No model used in a clinical-adjacent workflow is deployed without a validation set scored against ground truth from your clinicians — we don't ship leaderboard optimists.
What we won't do
- We don't build diagnostic AI. That's an FDA regulatory path, not a consulting engagement.
- We don't build systems that autonomously write to the EHR without clinician review. Every AI-drafted note is human-approved before it enters the record.
- We don't claim a local deployment is automatically HIPAA-compliant — HIPAA is about your policies, access controls, BAAs, and audit posture, of which the AI system is one component. We build the component correctly and document it so your privacy officer can sign off.
Where to start
Most healthcare organizations start with a free AI Readiness Assessment to scope out which workflow is highest-value and lowest-risk for a first deployment. For larger engagements involving IT, compliance, and clinical stakeholders, Tier 02 Deep Discovery ($7,500, two weeks) delivers a written implementation roadmap with cost, risk, and timeline — credited toward any subsequent build.
Frequently asked questions
Is local AI deployment actually HIPAA-compliant?
HIPAA compliance is a property of your overall environment — policies, access controls, BAAs, audit logging, breach-notification procedures — not of any single component. What local deployment gives you is the architectural foundation: PHI doesn't leave your network, you don't need a BAA with an inference vendor, and the audit trail lives in your existing SIEM. We build and document the system to support a clean compliance review; your privacy officer signs off on the overall posture.
Can we integrate with Epic or Cerner?
Yes. Integration happens through FHIR APIs for most modern EHRs (Epic, Cerner, Athena, Meditech). For legacy or custom systems, we integrate through HL7 v2, direct database reads (with appropriate controls), or RPA for screens that have no API. The AI layer is EHR-agnostic — it sits alongside the EHR, not inside it.
What hardware do we need in the data center?
For a first deployment supporting documentation assistance and protocol lookup for a mid-size hospital, one or two servers with NVIDIA A100 (40GB or 80GB) or consumer 4090 GPUs typically handles real production load. For larger clinical loads running 70B-class models or serving many concurrent users, expect 3–6 GPU nodes. We size in discovery based on actual projected QPS and latency targets. See local LLM hardware guide.
Do you build clinical decision support or diagnostic AI?
No. Diagnostic and clinical decision support software is regulated as a medical device by the FDA — different regulatory path, different engineering rigor, different insurance posture. We build documentation, operational, and knowledge-retrieval systems that support clinicians without making clinical judgments. If your project is diagnostic, we'll tell you that in the readiness assessment and point you at appropriate FDA-regulated vendors.
How do we evaluate accuracy for clinical workflows?
Every clinical-adjacent deployment ships with a validation set of real tasks (de-identified) scored against ground truth by your clinicians. We measure on every model or prompt change and publish the numbers. We don't ship systems whose error behavior we can't measure.
Ready to start?
Book a free 30-minute AI Readiness Assessment. No pitch deck. No retainer ask. Just a working session to map your stack and surface the two or three highest-ROI AI interventions for your situation.