Healthcare

HIPAA-governed AI for revenue cycle, prior authorization and clinical operations

Erbis builds clinical and operational systems that handle protected health information, and adds AI where the return is measurable: claims, prior authorization, documentation, EHR integration and trial data. Our founders did security and development engineering on laboratory systems used by the Mayo Clinic and on a Pfizer-funded clinical-trial patient management system. That is the standard we build to.

Erbis builds HIPAA-governed AI and software for healthcare providers, payers, pharma and health-tech companies: revenue cycle and prior-authorization automation, ambient clinical documentation, EHR/EMR integration over HL7 and FHIR, clinical operations analytics, telehealth and patient engagement, and laboratory and clinical-trial systems. Regulated system engineering since 2012, production AI since 2017, ISO 27001 certified.

Book a discovery call Take the AI readiness assessment
building regulated systems, including a HIPAA-compliant clinical-research EHR
2012
certified information security management
ISO 27001
straight-through accuracy for AI document processing in production, all industries
~95%
system integrations completed
4,000+
The problem

Where healthcare AI stalls: data, workflow and governance

Healthcare has moved from pilots to budgets. Bain and KLAS (October 2025, n=228) found that 70% of providers and 80% of payers now have an AI strategy, with revenue cycle management the number one investment, followed by clinical workflow. Ambient documentation has reached full rollout at one in five providers, and prior authorization, coding and clinical documentation improvement lead the use-case list. HFMA and AKASA report that 80% of health systems are exploring or piloting generative AI for revenue cycle work.

Regulation is now a forcing function. The CMS Interoperability and Prior Authorization Final Rule took operational effect on 1 January 2026, with 7-day standard and 72-hour expedited decision windows and FHIR-based prior-authorization APIs. Meeting it means moving data between payer, provider and EHR systems that were never designed to talk to each other.

The barrier is rarely the model. KLAS names data readiness the number one obstacle, and the Peterson Health Technology Institute warned in January 2026 that AI layered on flawed administrative workflows makes the underlying problems worse. Buyers are advised to build internal expertise rather than rely on vendor assurances, and to require a BAA, PHI-safe deployment and audit logs from anyone who touches the data. Erbis starts from that requirement, not from a demo.

What we build

Solutions we deliver

Automate revenue cycle and prior authorization

Document intelligence and workflow agents for claims, denials and prior-authorization requests, built on the same extraction-plus-human-review pattern that processes invoices at ~95% straight-through accuracy for Erbis clients in other industries.

  • Extract and validate claim, eligibility and clinical data from documents and faxes
  • Assemble prior-authorization requests with the supporting documentation payers require
  • Track the 7-day and 72-hour CMS decision windows and escalate before they lapse
  • Draft denial appeals from the record, for a coder or clinician to approve
  • Confidence thresholds that route uncertain cases to a person, with the audit trail intact

Capture the visit with ambient clinical documentation

Speech and language systems that turn the encounter into a structured note in the clinician's template, write it into the EHR and leave the clinician in control of what is signed.

  • Medical speech recognition with specialty vocabularies and accent handling
  • Structured notes, orders and codes proposed from the transcript
  • Clinician review and sign-off before anything reaches the chart
  • Write-back to the EHR over HL7 or FHIR, on the device the clinician already uses
  • PHI-safe deployment: audio and transcripts processed inside your environment

Integrate with the EHR and the rest of the estate

Integration engineering for health systems that run dozens of applications: EHR and EMR, laboratory, pharmacy, imaging, scheduling and billing, connected through HL7 v2, FHIR R4 and the vendor APIs that exist.

  • HL7 v2 and FHIR R4 interfaces, including SMART on FHIR applications
  • Integration with EHR platforms through their published APIs and interface engines
  • E-prescribing connections with EPCS controls: multi-factor authentication, digital signature, audit logs
  • Identity, single sign-on and role-based access across clinical applications
  • Data pipelines that produce the clean, consented datasets AI needs

Run clinical operations on evidence

Analytics and forecasting for the operational side of care: throughput, staffing, no-shows, length of stay and revenue leakage, on a governed data platform rather than another export to a spreadsheet.

  • Governed data platform on AWS or Databricks with PHI controls and lineage
  • Forecasts for demand, capacity, staffing and no-shows by site and service line
  • Denial, underpayment and coding-variance analytics for finance
  • Natural-language questions over operational data for managers
  • Dashboards embedded in the tools staff already open

Engage patients and deliver care remotely

Telehealth, patient portals and remote monitoring built as HIPAA-compliant products: encrypted video, secure messaging, device data and EHR integration, with AI assistants that handle intake, scheduling and follow-up questions inside guardrails.

  • Telehealth with 256-bit AES encryption in transit and at rest, workable on low bandwidth
  • Patient portals and apps with appointments, records and messaging
  • Remote patient monitoring feeds with clinician alerts on deviation
  • AI intake and follow-up assistants that hand off to staff on anything clinical
  • Consent capture and preference management built into the flow

Build laboratory and clinical-trial systems

Systems for pharma, CROs and laboratories that collect, aggregate and analyze clinical data. Erbis built a HIPAA-compliant EHR for a French pharmaceutical company's clinical research: patient data, dosage charts and billing, with unique user identification, emergency access procedures, automatic logoff and encryption.

  • Electronic data capture and trial patient management with full audit trails
  • Laboratory system integration and results routing
  • HIPAA safeguards and, where required, 21 CFR Part 11 electronic records and signatures
  • AI-assisted data quality checks and adverse-event extraction, reviewed by people
  • Export and reporting for investigators, sponsors and regulators
In production

How AI fits the systems you already run

Healthcare AI succeeds or fails on the plumbing: where PHI lives, which system is the source of truth, and who signs off. Erbis builds the AI as a layer on your EHR, revenue cycle and data platforms, with governance designed in from the first sprint.

01

Integration map

EHR and EMR (HL7 v2, FHIR R4, SMART on FHIR, vendor APIs and interface engines), practice management and scheduling, revenue cycle and clearinghouse connections (X12 837, 835 and 278), laboratory and pharmacy systems, e-prescribing networks, telehealth and device data, and identity providers for single sign-on. AI services sit behind those interfaces and write back only through them.

02

Data governance and HIPAA

Erbis signs a business associate agreement and builds to the HIPAA Security Rule: unique user identification, role-based access, emergency access procedures, automatic logoff, encryption at rest and in transit, and audit logs on every access to PHI. PHI stays in your environment (AWS, Azure or on-premises); models are deployed inside it, not called across the internet. Erbis is ISO 27001 certified and follows a secure development lifecycle.

03

Evaluation and human-in-the-loop

Every AI component ships with an evaluation set from your own records and a named reviewer: coder, nurse, clinician or finance analyst. Low-confidence outputs route to that person; nothing clinical is signed by a model. We align governance to the NIST AI Risk Management Framework and document intended use, limitations and monitoring so your compliance team can defend the system.

04

Run and support

Production monitoring for accuracy drift, interface failures and turnaround times against the CMS windows. Erbis retrains, extends and documents the system, and you own the code, models and runbooks from the first day. 89% of Erbis clients stay longer than 12 months.

Proof

What we have built

All case studies

How it works

How we work with you

  1. 01

    Discovery and readiness

    Two to three weeks. We map PHI flows, systems and the metric that matters (days in A/R, denial rate, prior-auth turnaround, documentation time per encounter), assess data readiness, and pick a first use case with a baseline and a go/no-go criterion.

  2. 02

    Design and build

    AI and application engineering inside your environment under a BAA. Clinicians and revenue-cycle staff review working software within 2 weeks; a production-grade pilot is typically ready in 4.

  3. 03

    Integration and validation

    HL7/FHIR and clearinghouse interfaces, identity and audit logging, then validation against held-out records with your reviewers before anything touches a live chart or claim.

  4. 04

    Deployment and support

    Phased rollout by department or site, monitoring against the operating metric, retraining as coding rules and payer policies change, and documentation your compliance team can audit.

Stack

Systems and technologies we work in

Healthcare standards and systems

  • HL7 v2
  • FHIR R4
  • SMART on FHIR
  • X12 837/835/278
  • NCPDP SCRIPT
  • ICD-10
  • CPT
  • SNOMED CT
  • LOINC
  • EHR/EMR APIs and interface engines

Compliance and security

  • HIPAA Security Rule
  • Business associate agreements
  • ISO 27001
  • NIST AI RMF
  • GDPR
  • Secure development lifecycle
  • Keycloak
  • AWS KMS
  • AWS HIPAA-eligible services

AI and data

  • Amazon Bedrock
  • Amazon SageMaker
  • Amazon Textract
  • Amazon Transcribe Medical
  • Amazon Comprehend Medical
  • Databricks
  • Anthropic Claude
  • OpenAI
  • LangGraph
  • PyTorch

Application engineering

  • Java
  • Spring
  • Python
  • React
  • PostgreSQL
  • MongoDB
  • AWS Lambda
  • Kubernetes
  • Terraform
FAQ

Healthcare: questions we get asked

Is Erbis HIPAA compliant, and will you sign a BAA?

Yes. Erbis signs a business associate agreement and builds to the HIPAA Security Rule, with technical safeguards (unique user identification, role-based access, emergency access, automatic logoff, encryption, audit logs) designed into the system rather than added at the end. Erbis is ISO 27001 certified and has built HIPAA-compliant systems since 2012, including a clinical-research EHR for a pharmaceutical company.

Which healthcare AI use cases have the best return right now?

Revenue cycle and prior authorization, because the work is document-heavy, rules-based and measured in dollars and days: denial rate, days in A/R, turnaround against the CMS windows. Ambient documentation follows, measured in clinician time per encounter. Bain and KLAS found revenue cycle is the number one AI investment for providers. We recommend starting where you already have a baseline to beat.

Can you integrate with our EHR?

Yes. Erbis integrates with EHR and EMR platforms through HL7 v2 and FHIR R4 interfaces, SMART on FHIR, vendor APIs and interface engines, and connects laboratory, pharmacy, e-prescribing, scheduling and clearinghouse systems around them. Integration is the majority of the engineering in most healthcare AI projects, and it is where Erbis has the most experience: 4,000+ integrations completed across industries.

Where does our patient data go when you use large language models?

It stays in your environment. Models are deployed inside your cloud account or on-premises (for example Amazon Bedrock or a self-hosted model within your VPC) under your keys and audit logging. No PHI is sent to public consumer AI services. We document the data flow so your privacy officer can review it before the first record is processed.

How do you keep AI from making clinical or billing errors?

By design, a model never signs anything. Each AI component has an evaluation set from your records, a confidence threshold, and a named reviewer who approves low-confidence outputs. In document processing this pattern gives Erbis clients ~95% straight-through accuracy with the remaining cases reviewed by people. Monitoring in production catches drift when coding rules, payer policies or templates change.

Do you work with health-tech companies as well as providers?

Yes. Providers and payers, pharmaceutical companies and CROs, laboratories, and health-tech product companies that need a regulated system built or an AI feature added. For product companies we bring the same governance plus product engineering: multi-tenant architecture, single sign-on, and the security posture enterprise health systems ask for in procurement.

Related
Security & ComplianceAI Automation & IntegrationProduct EngineeringLegal & Compliance

Start with the workflow you can measure

A 45-minute discovery call to map PHI flows, data readiness and the first use case with a baseline. Something working within 2 weeks, under a BAA.

Book a discovery call Take the AI readiness assessment

AWS partner · Databricks partner · ISO 27001 · You own the code from day one