A US regional healthcare provider operating across approximately 12 hospital and outpatient facilities, with around 2,800 clinicians on staff. Internal clinical guidelines, drug-interaction references and institutional protocols were spread across a SharePoint estate, three legacy intranets and a clinical reference vendor library. Clinicians routinely searched two or three systems to answer a single question; the average resolution time was tracked at 4-7 minutes for a protocol query, which compounded into significant cognitive load during shifts.
The provider's CIO and Chief Medical Information Officer wanted to evaluate whether a controlled AI assistant could replace ad-hoc search with a single grounded query interface. The non-negotiable constraint was HIPAA: no patient data could reach the LLM, no PHI could enter logs, no vendor SaaS could process the underlying corpus without a Business Associate Agreement covering it.
The clinical-knowledge corpus itself was not PHI, but clinician queries could and did contain patient identifiers (case-specific questions). The system had to keep PHI out of the LLM context entirely while still understanding case-specific intent.
Clinicians do not adopt AI assistants that produce confident wrong answers, full stop. Source attribution and uncertainty handling had to be central to the response schema, not added later.
The retrievable knowledge base spanned PDFs, intranet HTML, scanned policy documents, and a third-party clinical-reference API. Document refresh cadence varied from daily (drug interactions) to monthly (institutional protocols).
The four-phase Slavin AI methodology was applied; total engagement duration was 14 weeks across Phases 1-3 plus Phase 4 oversight through implementation.
Scope was narrowed to non-emergency protocol queries (i.e., not real-time clinical decision support, which would have triggered high-risk classification under any sensible interpretation). Baseline: 4-7 minute average time-to-answer measured via a sample of 40 clinician shadowing sessions. Risk classification: limited-risk under the EU AI Act framework (provider also operated EU facilities), HIPAA-regulated under US law.
Retrieval-augmented generation with private vector store hosted in the provider's own cloud tenant. LLM: vendor-hosted but under a Business Associate Agreement covering the data path. PHI redaction at the query gateway: any query containing patterns matching MRN, DOB, SSN, or named-entity patient identifiers was redacted before reaching the LLM, with the redacted tokens preserved as opaque IDs in case the clinician wanted case-specific follow-up handled by a separate human workflow.
Twelve-control baseline was tailored to HIPAA. Specifically: every query, response and retrieval-source was logged in a HIPAA-eligible log store separate from production logs. Rollback was a feature flag with a 30-second activation time. The accountable owner was the CMIO, with the security CISO as escalation. Monitoring included a low-confidence rejection rate (target: above 5% on out-of-domain queries to prove the system was refusing rather than hallucinating).
Engineering was led by the provider's own platform team, with weekly architecture reviews. Two governance gates were enforced: one at week 4 (data and PHI redaction validation), one at week 7 (monitoring and rollback validation). Production readiness sign-off was issued at week 8 with two residual risks documented: model-vendor version pinning (vendor did not yet support stable versioning at the time, mitigated by weekly regression testing) and corpus-update latency for the clinical-reference vendor API (latency accepted as below clinical impact threshold).
42% reduction on protocol queries (from 4-7 minute baseline to 2-4 minute median). Measured against the same 40-clinician shadowing protocol used in Phase 1 baseline.
Zero incidents in 9 months of production use. Redaction rate measured at gateway: roughly 11% of queries triggered at least one redaction (validated as a high signal of clinical relevance, not a false-positive rate to suppress).
67% of target clinicians active monthly within 90 days of pilot launch. Voluntary adoption (not mandated).
Passed on first attempt. The auditor specifically noted the data-lineage and rollback documentation as exemplary.
7% steady-state. Above the 5% target, indicating the system was refusing rather than hallucinating on edge cases.
100% of answers shipped with at least one source citation linkable in the corpus. Citation accuracy spot-checked at 96%.
The Phase 2 evaluation harness used a clinician-curated golden set built in week 3 of Phase 2. In hindsight, that work should have started in Phase 1 - the evaluation harness was the most expensive Phase 2 deliverable and the schedule pressure compressed clinician review windows. Future engagements: golden set drafting begins in Discovery.
The vendor did not support stable model versioning at the time, and we accepted a weekly regression-test mitigation. Three months in, a vendor model update degraded performance on a specific drug-interaction query class. Detection was within 24 hours via the regression suite, but the incident validated that model pinning would have been worth a vendor switch.
Daily, weekly and monthly refresh cadences across different sources produced a vector store that occasionally returned slightly stale content. Clinical impact threshold was not breached, but documentation of the staleness window per source should have been a Phase 3 deliverable rather than an after-the-fact addition.
Mid-tier asset manager, AI assistant for compliance officers, 3.1x review throughput with audit-grade source attribution.
Read this case study
European industrial manufacturer, supplier QA document extraction, 78% auto-processed end-to-end, 8-month payback.
The four-phase engagement model that drove this case study.
Read the Methodology page
An Architecture Review will identify the regulatory tier, the highest-risk architecture decision, and whether to proceed past Discovery.