Healthcare AI development for US hospital networks, healthtech, payers, and providers.

There is no HIPAA certification badge to check — the framework does not have a third-party vendor certification scheme, so any AI vendor claiming to be 'HIPAA certified' is describing a credential that does not exist. What you can actually verify, as a clinical product team, is the engineering: a signed BAA before any PHI moves (the next question covers what it includes and when it lands), inference pinned to a US region so your EHR-connected agents never route patient data offshore, audit logs on every model and tool call that your clinical informatics or IT security team can cross-reference against your existing Epic or Cerner audit trail, least-privilege access through your own identity provider rather than a shared vendor login, and PHI masked by default in staging so your QA and clinical review teams can validate ambient scribing or RAG accuracy without real patient data sitting in a lower environment. That last point matters more than it sounds — it is what lets your team run clinical validation on synthetic or de-identified data before the BAA-gated production rollout, so a compliance review does not stall the parts of the six-week timeline that do not touch PHI yet.

The BAA is a sequencing gate for your build, not a legal footnote parked in week six. Nothing touches real patient data — no EHR write-back, no ambient scribing session, no clinical RAG index over your live guideline corpus — until it is signed, so we structure the six-week build so that gate never stalls progress: FHIR sandbox wiring, UI work, and synthetic-record testing start on day one while your legal team and ours finalize the BAA in parallel, typically closing before or right at kickoff. Once it is signed, the system is cleared to touch live PHI and we move straight into production-data testing with no second compliance gate appearing later in the sprint. For a clinical product team, the practical translation is this: the signature date is what determines when Epic or Cerner write-back can run against a real chart, when ambient scribing can transcribe an actual patient encounter instead of a synthetic one, and when clinical RAG can index your production guideline corpus instead of a redacted sample — so it shapes your sprint calendar more than it shapes the legal risk conversation, which your compliance officer already owns and which we cover clause by clause on our HIPAA-specific compliance page.

Epic, Cerner Oracle Health, Athenahealth, NextGen, eClinicalWorks, and Meditech via the standards your team already operates. FHIR R4 is the default modern surface — patient, encounter, observation, medication, condition, allergy, document reference resources read and written through standard endpoints. SMART on FHIR for in-EHR app launch where the workflow embeds inside the clinician's Epic or Cerner session. HL7 v2 ADT and ORU feeds for legacy interfaces. DICOM for imaging where the workflow requires it. We do not screen-scrape, we do not maintain a parallel patient database, and we do not require the customer to grant us a tenant-wide Epic App Orchard or Cerner Code account — we work inside your existing EHR integration posture.

It depends on which clinical workflow is touching the data, not on a single blanket policy. Patient records pulled through FHIR R4 (encounters, medications, allergies, problem lists) and HL7 v2 ADT feeds stay inside your AWS, Azure, or GCP account, pinned to a US region — us-east-1 or us-west-2 are what we deploy most for EHR-integrated builds. Ambient scribing is the workload where the inference choice actually shows up in the clinical experience: real-time transcription needs sub-second round-trip, so we run self-hosted Llama 3 on vLLM on GPU instances inside the same VPC as the audio-capture pipeline rather than round-tripping the conversation to a third-party endpoint — that keeps latency down and keeps the encounter off any external log. Clinical RAG over guidelines, drug-interaction tables, or DICOM-sourced imaging reports can run on managed Claude or GPT-4o through Bedrock or Azure OpenAI once your privacy officer has cleared that pattern, or on the same self-hosted Llama stack when they have not. For most Epic and Cerner integrations we build, that split — self-hosted for anything latency-sensitive or PHI-heavy at the point of capture, managed inference for retrieval-only workloads once cleared — is what actually ends up in the architecture diagram your EHR integration timeline is built around, not a single one-line answer. The underlying BAA and region-pinning mechanics are the same ones we document in full on our HIPAA-specific compliance page.

Five layers, applied together. Hybrid retrieval grounds every answer in your clinical corpus. Required inline citations link every claim to a source document — answers without retrievable citations are blocked at generation time. A refusal layer activates explicitly on safety-critical categories — drug dosage, contraindications, triage acuity, pediatric weight-based dosing — saying 'I cannot answer this — escalating to a clinician' rather than guessing. Confidence scoring routes low-confidence answers to a human review queue. An eval harness blocks any prompt or model change that regresses safety-critical accuracy against a clinician-reviewed reference set. The reference deployment lands 98.4% citation accuracy and zero policy-violating answers across 90 days of production traffic.

We will build systems that assist clinicians — ambient scribing, document intelligence, patient inquiry, clinical RAG, prior auth triage — without crossing into Software as a Medical Device territory. For deployments that genuinely produce a clinical diagnosis, a treatment recommendation, or a triage acuity that drives clinical action without a clinician in the loop, the build belongs inside your regulatory affairs team's FDA SaMD pathway, and we will tell you on the first call. We are happy to serve as the engineering partner inside that pathway — design controls, traceability matrices, verification and validation against your QMS — but we will not be the regulatory authority for an SaMD submission, and we will not pretend the FDA's 510(k), De Novo, or PMA pathways are paperwork your AI vendor handles on the side.

Yes, and the question we actually get asked is different from the compliance version of this question — it is usually 'can you pick up where the last vendor left off without resetting our EHR integration timeline back to zero.' Step one is reading what exists: the FHIR or HL7 integration code, the ambient scribing or RAG pipeline, whatever eval harness is in place, and the actual state of the Epic or Cerner connection — sandbox-only, or already touching production data. Step two is shipping the smallest change that proves the system works end-to-end on your real clinical workflow inside the first one to two weeks: a scribing session that writes a correct SOAP note back to the chart, a RAG query that returns a cited answer against your live guideline corpus — so your clinical stakeholders see forward motion instead of another audit report. Step three is the roadmap decision: keep the existing architecture and build forward, replace only the piece that is actually broken (usually the EHR write-back layer or the eval harness), or restart clean if the foundation will not hold the next six months of features. Most stalled healthcare AI projects we take over are closer to done than the last vendor's status reports suggested — the gap is typically a missing BAA or an inference-region issue we can close inside week one, not a reason to throw away six months of EHR integration work.

Senior engineering rates at Aiinfox land roughly 30 to 50 percent below equivalent US healthcare AI consultancies — real, but it is not what actually moves your budget. What moves it is EHR integration depth: a patient-facing chatbot with read-only FHIR access costs meaningfully less than an ambient scribing pipeline writing structured SOAP notes back to Epic, which costs less again than a multi-EHR deployment spanning Epic, Cerner, and Athena for a hospital network built through regional acquisitions. Most v1 US healthcare AI engagements land between $40,000 and $180,000 fixed-price, and where an engagement sits inside that range is set by EHR write-back complexity and clinical scope, not by compliance overhead — the BAA and audit logging are part of every engagement regardless of price point. The delivery model is the other half of the cost story: senior engineers only, fixed-price six-week scope, overrun cost on us if we miss for reasons on our side. Most US healthcare AI consultancies bill timesheets, run multi-month discovery before your clinical stakeholders see a working feature, and either churn senior staff onto bigger accounts or staff a junior pool behind a senior nameplate. We bill shipped systems; the engineer on your kickoff call writes your code through launch.