Healthcare software, under a signed BAA

At least 43,900 hours across healthcare products, and about a tenth of everything we are delivering right now. Four are active: an AI intelligence layer over the EMR for specialty practices, a patient education platform, a telemedicine product scaling through 2026, and an applied AI product. Two of those four have been running for years rather than months.

Yes, as a matter of course and before access rather than after. In practice the harder part is what happens after signature: keeping PHI out of logs, analytics and model prompts, scoping access per role, and making the audit trail something you could hand to a regulator rather than reconstruct afterwards. Ask any vendor how PHI reaches their error tracker — the answer tells you how they work.

Retrieval over the material the organisation already owns, not a general model answering from memory; evaluation that a clinician trusts; and boundaries a compliance officer will sign off. Our largest healthcare product is exactly this, and it is being reviewed by a client committee whose job is to evaluate AI products. That review is the real deadline on projects like these, not the sprint.

That is how most of these start. The first two days go on where PHI travels, which flows exist, and what happens on failure. We publish what we find as a score out of ten across ten dimensions — across 61 client repositories we have audited, the average came out at 3.9, and testing is consistently the weakest of the ten.

We have not taken a product through FDA clearance and we are not a regulatory consultancy. If your path runs through a submission, hire someone who has done that and bring us in for the software. We are also the wrong answer if you want a team assembled this week: healthcare engagements start with paperwork, and we would rather say so now.