AI in healthcare

    AI in healthcare, built to run inside real clinical workflows

    Most healthcare AI pilots stall between the demo and the clinic: no EHR connection, no review step, no answer for the security team. Agnotic Technologies builds AI that clinicians and staff can use every day, with human review and an audit trail.

    15-Minute Scoping Call
    AI in healthcare software development mockup by Agnotic: a review queue where AI drafts wait for clinician sign-off, next to a guardrails checklist

    Trusted by global innovators

    Benchmark
    Chibasco
    Fundency
    Lantimer
    Lauren
    Lera
    One Minute
    Pento Pix
    TAP
    Xtrium
    Healthevolve
    Benchmark
    Chibasco
    Fundency
    Lantimer
    Lauren
    Lera
    One Minute
    Pento Pix
    TAP
    Xtrium
    Healthevolve
    Benchmark
    Chibasco
    Fundency
    Lantimer
    Lauren
    Lera
    One Minute
    Pento Pix
    TAP
    Xtrium
    Healthevolve
    Benchmark
    Chibasco
    Fundency
    Lantimer
    Lauren
    Lera
    One Minute
    Pento Pix
    TAP
    Xtrium
    Healthevolve

    What is AI in healthcare software development?

    AI in healthcare software development is building AI features into clinical and administrative workflows so their output can be trusted and used. Agnotic Technologies connects models to the EHR through HL7 FHIR, grounds them in the patient's record, adds automated checks and a human review step, and keeps an audit log of every prompt and output.

    How do guardrails, evaluation and human review work?

    Every output goes through the same loop before it reaches a chart, a claim or a patient.

    Diagram of the human review loop for healthcare AI: inputs, grounding through FHIR, model draft, automated checks, human review, then write-back and audit, with edits and rejections feeding the evaluation set
    Grounding
    The model works from the patient's record and your documents, retrieved at request time, so answers can cite their source.
    Automated checks
    Each output is checked for missing sources, PHI in places it should not be and your own rules before anyone sees it.
    Human review
    A clinician or staff member approves, edits or rejects the output. Nothing is written to the EHR without that step.
    Evaluation set
    Edits and rejections become test cases, and the full set runs before each release to catch regressions and drift.
    Audit trail
    Prompts, sources, outputs and reviewer decisions are logged, so you can answer what the AI did and who approved it.

    Where does FDA clinical decision support guidance apply?

    The answer depends on what the software does and who relies on it. These are the common patterns we see in healthcare AI projects.

    Where FDA clinical decision support guidance applies, by type of AI function
    What the AI doesLikely statusWhat we do in the build
    Drafts notes, letters or messages that a person reviewsUsually not a device functionHuman review, audit logging and a documented intended use
    Summarizes the record and shows its sources to a clinicianOften non-device CDS, if the clinician can review the basisShow sources and reasoning so the clinician can check them
    Flags patients for follow-up based on a risk modelDepends on intended use and how output is presentedRegulatory assessment before build, validation on your data
    Diagnoses, or drives treatment without clinician reviewLikely a device software functionPlan for FDA requirements and a documented software lifecycle

    This table is a planning guide, not a regulatory determination. Your regulatory counsel decides the status of each function.

    Should you build or buy healthcare AI?

    Buy where a product already fits the workflow. Build where your workflow, data or integration is what makes the AI useful.

    • Workflow

      Usually buy
      A standard workflow that a product already covers
      Usually build
      A workflow specific to your organization or specialty
    • EHR fit

      Usually buy
      The vendor already works inside your EHR
      Usually build
      You need write-back, CDS Hooks or a SMART on FHIR app
    • Data

      Usually buy
      General documents or public knowledge
      Usually build
      Your own records, policies or payer rules
    • Control

      Usually buy
      Vendor review steps and logs meet your needs
      Usually build
      You need your own review rules, audit trail and evaluation
    • Contracts

      Usually buy
      The vendor signs a BAA for the exact service
      Usually build
      You want models hosted in your own cloud account

    Which healthcare standards does our AI work follow?

    01HIPAA logo

    HIPAA

    Health Insurance Portability and Accountability Act

    Protect PHI with privacy-first architecture, encrypted storage and transmission, strict access controls, and traceable audit logs.

    02GDPR logo

    GDPR

    General Data Protection Regulation

    Implement lawful consent flows, data minimization, retention controls, and secure processing for sensitive health data.

    03FHIR logo

    FHIR

    Fast Healthcare Interoperability Resources

    Enable standardized health data exchange across apps, care teams, and systems through standards-based FHIR APIs.

    04HL7 logo

    HL7

    Health Level Seven International

    Support enterprise-grade interoperability with HL7-based integrations for records, events, and clinical messaging workflows.

    05HITRUST logo

    HITRUST

    Health Information Trust Alliance

    Align security programs to healthcare-specific control and risk management practices trusted by providers and ecosystem partners.

    06HITECH logo

    HITECH

    Health Information Technology for Economic and Clinical Health Act

    Design with breach notification readiness, digital record safeguards, and operational controls that support regulated care programs.

    07SaMD logo

    SaMD

    FDA Software as a Medical Device

    Plan software quality, traceability, and documentation pathways for products that may require SaMD review and submission.

    08MDR (EU) logo

    MDR (EU)

    Medical Device Regulation (European Union)

    Prepare EU market-ready processes for risk classification, evidence tracking, and lifecycle governance under MDR expectations.

    09SAMHSA logo

    SAMHSA

    Substance Abuse and Mental Health Services Administration

    Apply confidentiality controls and consent-aware sharing models for behavioral and mental health data experiences.

    • A business associate agreement with every model or AI vendor that processes PHI
    • Prompts, outputs and retrieval logs kept out of analytics and protected like the record
    • De-identified or synthetic data for development and evaluation
    • Role-based access to the AI features, with an audit log of every use
    • A documented intended use and review step for each AI function

    Which frameworks and rules shape healthcare AI?

    • The NIST AI Risk Management Framework is a voluntary framework that organizes AI risk work into four functions: Govern, Map, Measure and Manage.

      Source: NIST AI 100-1
    • FDA's Clinical Decision Support Software guidance explains which decision support functions meet the non-device criteria in section 520(o)(1)(E) of the FD&C Act and which remain device software functions.

      Source: FDA guidance, Clinical Decision Support Software
    • A HIPAA covered entity may share protected health information with a business associate, such as a software vendor, only under a business associate agreement that commits the vendor to safeguard it.

      Source: 45 CFR 164.502(e) and 164.504(e) (eCFR)
    • HIPAA allows two ways to de-identify health data: expert determination, or the safe harbor method, which removes 18 categories of identifiers.

      Source: 45 CFR 164.514(b) (eCFR)

    Frequently Asked Questions

    Yes. We use models from providers that sign a business associate agreement for the specific service, or models hosted in your own cloud account, and we add access control, audit logging and PHI handling rules around them. Compliance also depends on your policies, so we document how each control works.