Hospital pharmacy compliance often depends on people assembling evidence from purchasing systems, shortage notices, inventory records and back-order reports. AWS says one healthcare organisation can spend more than 4,000 staff hours annually reviewing whether certain drug purchases qualify for exceptions under the US 340B programme.
Bluesight is building an AI layer called Prism to connect that work. One assistant is already used across 20 health systems, while a broader multi-agent compliance product is scheduled for later in 2026.
The agent works through governed application tools
Prism Assistant gives users of Bluesight’s ControlCheck product a conversational way to query controlled-substance monitoring data, create charts and prepare reports. AWS says a first version emerged from a three-day joint engineering engagement in September 2025 and reached general availability in under nine months.
The architecture is important because the language model does not receive unrestricted database access. Existing ControlCheck endpoints are wrapped in AWS Lambda functions that return structured records. More than ten APIs are exposed as tools through AgentCore Gateway, while Strands Agents and Amazon Bedrock interpret questions and coordinate calls.
Business rules stay inside the application layer. The model decides which approved tool to use, gathers the result and explains it. That separation reduces the chance that conversational flexibility silently rewrites established compliance logic.
AWS reports query latency falling from five minutes to ten seconds. Bluesight also reports report-generation improvements of up to 97%, with recurring assembly dropping from roughly six hours to 15 minutes at participating systems. These are vendor and customer measurements, not independently audited outcomes, but they describe live workflows rather than a laboratory benchmark.
A deterministic service makes the compliance decision
The planned product addresses 340B Group Purchasing Organisation rules for certain hospitals. When a normal non-GPO supply channel cannot provide a drug, staff may need to document an exception using purchase records, shortage evidence, stock levels and eligibility information.
Bluesight’s design connects CostCheck, ShortageCheck and 340BCheck. A coordinating agent directs specialist workers to retrieve purchasing, supply and eligibility records. It then assembles an audit-oriented explanation.
Crucially, a deterministic scoring service—not the language model—calculates the compliance outcome. It evaluates 13 evidence inputs using priority rules and configurable time windows. An auditor can inspect the records, rule version and tool sequence instead of accepting a model’s unsupported judgement.
The architecture uses Claude Sonnet 4.6 for primary reasoning and Claude Haiku 4.5 for lower-latency operations through Amazon Bedrock. Synthetic testing reportedly achieved 100% invoice discovery and 93% evidence-justification accuracy, exceeding an 85% target. Prepared data cannot reveal how the system will handle local gaps, delayed shortage notices, unusual identifiers or disputed cases.
Each hospital therefore retains responsibility for policy settings. A different inventory threshold or purchase-date window can change the result. Pharmacy, legal and compliance leaders must approve those parameters and preserve human escalation for ambiguous evidence.
Production trust depends on traceability and local testing
The service runs in a virtual private cloud with authentication, encryption, session isolation and managed secrets. CloudWatch records tool calls, data access, decisions and performance. Such traces are essential when a hospital must explain why a purchase was accepted or a diversion pattern escalated.
Technical safeguards do not prove operational reliability. Before an assisted decision affects compliance, teams should replay historical cases alongside their existing review process. Tests should cover missing data, code matching, timing, policy exceptions and examples where experienced reviewers disagreed.
Every finding should retain its source evidence, scoring configuration and complete tool trace. Organisations also need monitoring for data drift, latency and changes in upstream product APIs. If a source stops updating, a polished agent report must not conceal the gap.
Bluesight’s approach shows a credible pattern for regulated AI: give the model a narrow coordination and explanation role, keep final scoring deterministic and make evidence inspectable. The promise is not autonomous compliance. It is reducing the manual search burden so specialists can spend more time resolving the cases where rules, data and clinical reality do not align neatly.
