Every AI vendor. One Command Center.
Hospitals are adding more AI tools every year, from many different vendors. HACC gives you one place to see all of them, prove what they did, watch how well they are working, and shut any of them off if you need to.
HACC does not run AI models of its own. It sits over the AI tools you already use and keeps them governed, safe, and accountable.
The plane the rest of your AI runs on
You are going to be running eight to twelve AI vendors within two years. Where do you see them all? Where do you prove what they did? Where do you turn one off when something goes wrong? HACC is the answer to those three questions.
Vendor-agnostic by architecture
Every AI vendor in your environment connects through one governed interface. Swap a vendor without disturbing your governance.
A governance plane, not an AI tool
Zero inference inside HACC. No model weights, no reasoning, no recommendations. It governs the vendors; it does not compete with them.
Standards as architecture
HIPAA, 42 CFR Part 2, Section 1557, HTI-1, ISO/IEC 42001, and the NIST AI Risk Management Framework shaped every screen, API, and log.
Your framework, as configuration
Your AI steering committee’s domain weights, blockers, and hard stops run as settings. We operationalize your program; we do not replace it.
Separation built into the design
Each hospital has its own account and its own security keys. The separation is engineered in, not promised in a contract.
Certification-ready from day one
Engineered against SOC 2, HITRUST, and ISO 42001 controls now, so certification confirms what is already in place.
One platform across the whole AI lifecycle
From the moment a vendor sends an intake email to the moment a regulator sends a records request. Statuses below are current as of our latest client-facing snapshot and we keep them honest: anything marked available we can show you live.
- Available now
- Works in the platform today; we can show it live.
- In development
- Core is in place and being readied for full use.
- On the roadmap
- Planned and designed, not yet built.
Before deployment: deciding what AI to allow in
Turn a six-week vendor review into a few days, and keep one current record of every AI tool and use case in the building.
AI vendor risk intake and scoring
Available nowEach vendor fills out a simple online form. HACC scores the risk automatically using your own committee’s rules and hands back a ready-to-review summary.
AI and agent registry
Available nowOne always-current list of every AI tool: what it is, what it does, who approved it, and whether it is cleared to run.
Use case registry
Available nowA running record of every way AI is used, from first request through approval, go-live, and retirement, following your committee’s process at every step.
Evidence vault
Available nowA secure place for every document a vendor gives you. Files are scanned and locked so they cannot be changed or deleted.
Your own governance framework
Available nowSet up your review committee’s standards and scoring rules directly in the platform, so HACC runs your program the way you designed it.
Policy management
Available nowWrite, test, and manage the rules for what AI may and may not do. Sensitive changes require a second person to approve them.
Configuration and settings
In developmentAdjust which compliance rules and which state’s requirements apply, without software changes.
In operation: governing AI as it runs
Every AI request passes through one checkpoint that enforces your rules and records what happened, and AI tools never reach into your systems directly.
Central AI checkpoint
Available nowWatches for protected health information, confirms only the minimum data needed is used, blocks anything that breaks your rules, and keeps a complete record.
Secure entry for AI tools
Available nowOne secure front door for any outside AI tool. Every request arrives with a clear record of who is asking and what they are allowed to do.
Governed access to hospital data
Available nowAI tools go through a controlled path that checks every request against your rules first. Your medical record system is connected during onboarding.
Multi-step task control
In developmentRuns longer AI tasks and checks every tool an AI reaches for against your rules first.
Emergency stop for AI
In developmentPause, limit, or completely stop any AI tool or task that is not behaving the way it should, at any moment.
After deployment: confirming AI keeps working
See how each tool performs against reality, not against the vendor’s validation deck, and what each one is costing you.
AI performance monitoring
Available nowCompare what the AI expected against what really happened, so problems show up early instead of after they cause harm.
Fairness monitoring
Available nowScheduled checks on whether an AI tool works equally well for different groups of patients, with the evidence regulators ask for.
Cost and usage tracking
Available nowExactly what each AI tool costs, by vendor and by how it is used, on real data.
Health and status view
Available nowOne screen that shows whether every AI tool and task is healthy and running as expected.
Side-by-side comparison
On the roadmapTry the same task with two AI tools at once and compare answers, speed, cost, and results before you commit.
Audit and compliance: proving what happened
If a regulator or attorney ever asks, the record is already there, and it can be trusted.
Tamper-proof record keeping
Available nowEvery AI action is recorded before it is allowed to happen and stored so no one can edit or delete it, including us, for six to seven years.
Full interaction replay
Available nowReplay any AI interaction from start to finish: who was involved, what information was used, what the AI decided, and what happened next.
Source transparency for clinicians
Available nowShows clinicians, where they work, where an AI tool’s information came from so they can judge how much to trust it.
One-click compliance reports
On the roadmapReady-made evidence packages for auditors and regulators.
Patient and clinician notices
On the roadmapThe right notices about AI use, matched to the rules of your state.
The foundation: what keeps it trustworthy
Separation between hospitals, least privilege everywhere, and protected health information guarded at several independent layers.
Complete separation between hospitals
Available nowEach hospital has its own account and its own security keys. The separation is built into the design, not promised in a contract.
Right people, right access
Available nowPeople can only see and do what their role allows, everywhere in the platform.
Safe by default
Available nowEvery action is checked against who is asking and what they are allowed to do. If anything is unclear, the answer is no.
Layered patient-data protection
Available nowProtected health information is guarded at several independent layers, so a gap in any one does not expose patient data.
Controlled emergency access
Available nowEmergency access requires a second approver, expires on its own, and is fully recorded.
Central settings control
In developmentAll of a hospital’s settings in one place, with sensitive changes requiring a second approver.
Built for your state’s rules
In developmentBuilt to the strictest rules by default. Federal substance-use privacy rules (42 CFR Part 2) are supported today.
Which standard maps to which screen
Most AI platforms say they are compliant. We show you which obligation each part of the platform satisfies, so when your compliance committee asks for evidence, you know where it comes from.
| Standard or regulation | HACC surface that delivers it |
|---|---|
| ISO/IEC 42001 — assessing impacts of AI systems | AI vendor risk intake and scoring |
| ISO/IEC 42001 — use of AI systems | AI performance monitoring and fairness monitoring |
| ISO/IEC 42001 — third-party relationships | AI registry, evidence vault, and agreement tracking |
| HIPAA §164.312 — audit controls | Tamper-proof record keeping and full interaction replay |
| 42 CFR Part 2 — patient-specific consent | Part 2 policy templates and consent handling |
| Section 1557 — mitigate discrimination risk | Fairness monitoring with subgroup drill-down |
| HTI-1 — source attributes per predictive DSI | Captured at intake, shown to clinicians as source transparency |
| NIST AI RMF — Measure | AI performance monitoring and fairness monitoring |
Certifications we are pursuing
HACC is being built to meet these standards now, so earning the certifications confirms what is already in place rather than requiring us to start over. Listed in the order we are pursuing them. None is held yet.
The security review most organizations require before they buy. Clears the standard checks in hospital purchasing.First priority
The healthcare industry’s most demanding security certification, expected by large hospital networks.Second priority
The international standard for managing AI responsibly, and a differentiator as global AI rules arrive.Third priority
Capabilities that plug into the governance plane
HACC governs AI from any vendor, including ours. These products are built to attach to the platform so a hospital can add capability without adding ungoverned risk.
Governed staff assistant
Available nowA chat assistant for staff with role-based model access. Every prompt routes through HACC for protected-health-information scanning and policy checks before it reaches a model.
Prepackaged operational agents
In developmentAgents for high-volume administrative work such as prior authorization and claims denial follow-up, built to attach to HACC so they inherit its governance from day one.
Voice agent
In developmentOutbound patient calls for scheduling and follow-up, speech to speech, with dial authorization, tool brokerage, and call capture governed through HACC.
Common questions
The ones CIOs, compliance officers, and CMIOs ask in the first fifteen minutes. Ask us the rest.
No. There is zero inference inside the platform: no model weights, no reasoning, no recommendations. HACC governs the AI tools you already use, from any vendor, and never competes with them.
No. Each vendor connects through one governed interface. Register what is already running, bring new vendors in through risk intake, and swap a vendor later without disturbing your governance.
Yours. Your AI steering committee’s standards, domain weights, blockers, and hard stops are set up as configuration. We operationalize the program you own; we do not replace it with ours.
It works in the platform today and we can show it to you live. “In development” means the core is in place and being readied for full use. “On the roadmap” means planned and designed, not yet built. We mark the difference on every capability and every certification claim.
Not yet. HACC is engineered against SOC 2, HITRUST, and ISO/IEC 42001 controls now, and we are pursuing the certifications in that order. We will not describe a certification as held until it is.
Each hospital has its own account and its own security keys. Protected health information is guarded at several independent layers, AI tools reach hospital data only through a controlled path that checks every request against your rules, and every action is recorded before it is allowed to happen.
Pick the one that fits your committee’s cadence
The walkthrough is the most useful first step for most CIOs.
Architecture walkthrough
Fifteen minutes for the CIO, compliance officer, and CMIO together. Bring the people who would write the security review.
Risk intake portal demo
A five-minute live demo on a sample vendor of your choice, scored against a reference framework or your own.
Security review package
Pre-built responses to standard healthcare procurement and security questionnaires, ready to send to your team.
Ready to see the Command Center?
One of the founders reads every message and replies within two business days. We will tell you honestly whether a platform walkthrough, a leadership partnership, or a focused engagement is the right first step.