Decide what's safe to build before you build it.

• 01

  Use-case risk triage

  Sort candidates by clinical exposure and evidentiary burden. Some of the most requested ideas are the last ones anyone should build, and it's cheaper to learn that in a workshop.

• 02

  PHI data-flow mapping

  Where identifiers travel, where they're stripped, what's retained and for how long — per use case, diagrammed, and checked against the running system.

• 03

  Clinical oversight design

  Who reviews, what they see, how disagreement is recorded, and what triggers a rollback. Written so a governance committee can sign it.

• 01

  PHI does not go in a prompt by default

  We de-identify at the boundary and re-associate after, so the model sees the clinical question without the identity attached. Where full context is unavoidable, it runs under a BAA or inside your own infrastructure.

• 02

  The system drafts; a clinician decides

  Nothing reaches a patient without review on any pathway that touches clinical content. That gate is a hard architectural boundary, not a configuration toggle someone can turn off later.

• 03

  Refusal beats a plausible answer

  Out-of-scope questions get an explicit hand-off to a human with a callback, not a hedged paragraph. We test the refusal path as carefully as the answer path.

1. 1

   Stakeholder interviews

   30–45 minutes with each executive and team lead. We surface the real bottlenecks (not the ones the deck says).

2. 2

   Use-case pipeline

   Score 20–40 candidate AI use cases on impact × feasibility × strategic fit. Pick the top 3 with quantified ROI.

3. 3

   Build vs buy

   Honest answer for each pillar — sometimes the right move is Notion AI or a Zapier flow, not a bespoke build.

4. 4

   Governance framework

   Policy, approval workflow, prompt-injection / PII / IP guardrails. Aligned with your compliance posture.

5. 5

   90-day plan

   Quarter-by-quarter roadmap, hiring plan, budget, vendor selection, and KPIs the CFO will actually accept.

• Epic & FHIR APIs
• Athenahealth
• HL7 v2 feeds
• Twilio & WhatsApp Business
• Zendesk
• Snowflake
• S3 with encryption at rest
• Practice-management and RCM systems

FAQ

Healthcare AI governance and readiness: your questions.

• We already have an AI policy. Do we need this?

  Maybe not the policy — but bring the running systems. Most policies we read are sound and unenforced; the value is in the gap between the document and the deployed prompt.

• Who from our side needs to be involved?

  A clinical lead, a privacy or compliance owner, and whoever runs the system the AI would touch. Three people for two half-days beats a twelve-person steering group over two months.

• Is this just a deck?

  No. Every strategy engagement ships at least one working artifact — a costed roadmap, a governance template ready for legal, or a vendor negotiation outcome. Decks alone are useless.

• Do you work with non-technical executives?

  Yes — most of our strategy work starts with non-technical leaders. We translate between board-room and engineering-room.

• RAG for healthcare and clinical documentsRetrieval over clinical guidelines, payer policy and internal SOPs — with the citation, the version, and an explicit refusal when the library doesn't cover the question.Read
• AI agents for healthcare operationsAgents that handle scheduling, reminders, insurance verification and document chase across voice and messaging — escalating anything clinical to a person immediately.Read
• 30-day AI sprint for healthcarePick the administrative workflow that hurts most. In 30 days you get working software, an eval score, and an honest recommendation — including the recommendation not to proceed.Read

• AI governance for financial servicesModel inventories, risk classification, evaluation policy and human-oversight design — written to survive an internal audit rather than a conference talk.Read
• AI governance for insurersRisk classification, model documentation and oversight design for insurance use cases — built around what a complaint, an audit or an ombudsman review will ask for.Read
• AI governance for legal teamsAcceptable-use policy, confidentiality controls, and an approval process for AI tools that lawyers are already using with or without permission.Read