Regulated clauses should never move unattended

The agreements a health system signs constantly

Most of this volume is commercially ordinary with a small number of clauses that are not. Separating those two categories reliably is the entire problem.

• Provider and staffing agreements — Physician and clinical staffing arrangements drafted from your standard form, with compensation schedules reconciled against what was actually approved.
• Payer and network contracts — Long, heavily amended agreements where the operative terms must stay knowable years after signature, not reconstructed from a folder.
• Vendor and supply agreements — High-volume commercial paper — equipment, services, software — handled inside policy, with the data-handling clauses gated for review.
• Research and trial agreements — Site, sponsor and material-transfer agreements where publication rights, IP and data-use terms each need their own reviewer.
• Referral and affiliation arrangements — Arrangements where the regulatory exposure lives in specific clauses. Those clauses are configured as mandatory-review and never negotiated unattended.
• Amendments and renewals — Changes attach to the clause they modify, so the operative agreement stays readable and renewal windows surface from the document itself.

Gates your compliance office owns outright

The assistant's autonomy is not a global setting here. Named clauses are configured as mandatory review, and no autonomy level — including the most permissive — can carry them past a human.

• Clause-level mandatory review — Patient-data terms, referral arrangements, data-use and publication rights are marked to always stop. The gate is a property of the clause, not of the run.
• The right reviewer, by clause — Compliance, privacy, legal and the business owner each receive the clauses that are theirs, with the deviation and your standard position attached.
• Volume handled around them — Pricing, term, service levels and the ordinary commercial body of the agreement are negotiated inside policy, so review attention is spent only on regulated terms.
• Evidence of who decided — Every approval binds to a version and an identity, and every agent action is attributed in the timeline — so the question of who accepted a term has a recorded answer.

What we do not claim

Healthcare buying decisions get made on certifications, and we will not imply one we have not completed. We hold no published compliance certification today, and you should not read anything on this page as asserting otherwise. What we can show you is the mechanism and the current state of our security documentation — ask, and we will tell you exactly where we are rather than where we intend to be.

• No certification claim appears anywhere on this site, by policy and by automated test
• What exists today: encryption in transit and at rest, scoped per-party access, timestamped tamper-evident history, attributed agent actions and an organization-wide kill switch
• Your compliance office configures which clauses can never move without a named human
• A sensible first deployment is non-regulated paper — vendor and supply agreements — while your own review of the controls runs in parallel

What exists after every agreement

In a regulated environment the record is the deliverable. None of this is assembled afterwards; it accumulates as the agreement is negotiated.

• Evidence: Every version addressable and diffable
• Evidence: Timestamped, tamper-evident agreement history
• Evidence: Approvals bound to a version and an approver identity
• Evidence: Agent actions attributed in the room timeline
• Access: Per-party visibility inside a shared room
• Access: Scoped credentials for any external agent
• Access: Encryption in transit and at rest
• Access: Organization-wide kill switch for all agents
• Afterwards: Obligations extracted from the executed agreement
• Afterwards: Notice and renewal windows surfaced from the document
• Afterwards: Amendments resolved against the clauses they change
• Afterwards: Complete record exportable as a single package

The questions compliance asks us directly

• What certifications do you hold? None that we publish, and we are not going to imply otherwise to win an evaluation. Ask us and we will describe our current security posture and documentation accurately. If a completed certification is a hard procurement requirement for you today, we would rather you know that now than discover it in a questionnaire.
• Can the assistant ever accept a regulated clause on its own? No, when that clause is configured as mandatory review. The gate attaches to the clause rather than to the autonomy level, so even the most permissive setting cannot carry it past the reviewer your compliance office named. Clauses you have not gated are negotiated inside the policy you wrote.
• How would we evaluate this without exposing anything sensitive? Start in shadow mode on non-regulated paper. The assistant drafts and prepares escalations, nothing reaches a counterparty, and you read the transcripts against what your team would have done. Expand only to the paper you are satisfied it handles.
• Who is accountable for a term the assistant negotiated? Your organization, which is why attribution is non-negotiable in the design. Every turn, approval and signature is recorded against an identity and a version, so accountability is a matter of record rather than reconstruction.