Three layers make up any serious AI system in a regulated setting. The language model is rented and everyone rents the same ones. The data is the customer's and always was. What decides whether the system can be trusted is the layer in between — and that is the layer we build.
A frontier language model, accessed through a managed enterprise API on AWS rather than a consumer subscription — which is what makes the data-handling terms suitable for this work in the first place.
Deliberately swappable. Nothing above it should depend on which model is behind it, including a self-hosted open-weights model where a customer requires one.
De-identification and tokenization before inference. Versioned retrieval over an authoritative corpus. Explicit escalation rules. Access logging. Rule sets scoped to a date.
This is the whole product. It is also the part that is genuinely hard, genuinely reusable, and the reason two very different divisions can run on one substrate.
The customer's own data, in their own environment where they require it. Ingest works from an export — a report, a file drop, a scheduled dump — because most operations do not have an API to the systems their records live in.
We do not seek to own the system of record and do not want to be one.
Most AI pitches lead with the model, because the model is the impressive part. But swapping in a stronger model does not make an ungoverned system safe, does not make an uncited finding defensible, and does not make a rule applied on the wrong date correct. Those are middle-layer problems, and they are the only ones worth our engineering time.
PHI is stripped and tokenized in our layer, not at the model. The token preserves a patient's continuity across encounters so longitudinal analysis is possible, while the identity stays behind. The model receives the clinical content without the person.
Findings are drawn from a curated corpus of authoritative source material — code specifications, official billing and coding guidance, and published policy — and the passage relied on is shown with the finding. An answer without a source is treated as a failure, not an output.
Corpora and rule sets are versioned. Analysis records which version produced it, and where a rule has an effective date range the applicable set is selected by the date of service. Re-running last year's data does not silently judge it by this year's rules.
What the system may conclude alone and what it must route to a human is configuration, not model temperament. Low confidence, contradictory source material, and anything with a safety dimension escalate by rule — and the rule is inspectable.
Multi-factor authentication, and access to records logged at the level a HIPAA-aligned control environment requires. Built in from the first commit rather than added when someone asked.
Revenue Integrity and Clinical Evidence run against separate corpora with separate access control. Billing data does not inform manufacturer reporting; clinical analysis is never conditioned on reimbursement outcome.
Model access is through Amazon Bedrock, so inference runs inside the same account boundary and under the same enterprise data terms as the rest of the environment.
Two divisions use it for two unrelated purposes. It is the same layer both times, and it is the only part of this we consider proprietary.