In the complex healthcare ecosystem, regulatory compliance represents one of the biggest operational and financial challenges for hospitals. In particular, the 340B program, which allows certain health facilities to purchase outpatient medications at reduced prices, requires extensive documentation and manual processes that consume thousands of hours per year. The recent collaboration between AWS and Bluesight has resulted in an AI-based solution that promises to transform this reality. This article discusses the context, technical architecture, lessons for the industry, and how companies like Q2BSTUDIO can help organizations adopt similar technologies.
The 340B program, created by the U.S. government, prohibits certain hospitals—such as disproportionate population care (DSH), children's hospitals, and cancer hospitals—from purchasing outpatient medications through group purchasing organizations (GPOs) unless there is a documented exception for supply shortages. To comply, pharmacy teams must compare purchasing data with FDA stockout lists, American Society of Health Systems Pharmacists records, available inventories, AI-generated shortage forecasts, and reports from other hospitals. A single covered entity can invest more than 4,000 hours per year in these reviews. Bluesight, a company specializing in pharmaceutical compliance, decided to attack this problem through a layer of AI agents that automate the collection, correlation, and presentation of evidence.
The first product, Prism Assistant, is now available for 20 health systems. Integrates with ControlCheck, Bluesight's controlled substance monitoring tool. Traditionally, medication diversion teams had to manually assemble reports, review dashboards, and correlate findings. Now, a conversational interface allows you to perform natural language queries, generate graphs, and produce report material in a matter of seconds. The architecture uses AWS and Azure cloud services, with a design that prevents direct access of language models to databases. Instead, engineers created Lambda functions that expose existing ControlCheck APIs as MCP (Model Context Protocol) tools. This keeps the business logic within the application and reduces query latency from five minutes to ten seconds. The deployment includes encryption, OAuth2 authentication, cost control, and monitoring with Amazon CloudWatch.
The second phase of the project is a multi-product agent for compliance with the 340B GPO rules. This agent gathers data from CostCheck (purchase information), ShortageCheck (evidence of availability), and 340BCheck (eligibility validation). The proposed architecture employs Anthropic Claude models hosted on Amazon Bedrock, with a coordinating agent directing specialized workers: one retrieves purchase records, another gathers evidence of supply, and a third verifies 340B eligibility. The coordinator assembles the evidence and generates an audit-oriented report. During a two-day ramp-up, the team managed to connect the system and complete all the planned functionalities. Tests conducted with synthetic data showed a 100% invoice discovery rate and 93% accuracy in justifying evidence, exceeding the 85% target. However, these results do not represent the performance in production with real data from hospitals, where there may be local gaps, atypical drug identifiers or disputed cases.
A crucial aspect of the design is that Bluesight assigns the language model a limited role: collecting logs, calling tools, and drafting explanations, but not determining compliance. A deterministic scoring service evaluates 13 evidence entries by applying configurable rules with time windows and priorities. This provides compliance teams with a repeatable and auditable process, allowing auditors to inspect the original records, applied rules, and sequence of tool calls behind each determination. The final policy decision—such as shortage thresholds, acceptable inventory periods, or purchase date windows—remains the sole responsibility of each hospital's pharmacy and legal teams.
On the security side, Amazon Bedrock is HIPAA eligible, and Bluesight operates under a business partnership agreement with AWS. AWS does not train foundational models on customer data processed in Bedrock. Amazon Cognito is used for authentication, AWS Key Management Service for encryption at rest and in transit, and AWS Secrets Manager for managing credentials. The platform records all agent decisions, tool invocations, data access events, and performance metrics, providing a comprehensive audit trail that is critical when a hospital must justify why it allowed a GPO purchase or escalated a drug diversion pattern.
Results measured internally across 20 health systems indicate a 97% reduction in reporting and analysis time in ControlCheck flows. Recurring reports that previously required six hours of manual work are now completed in 15 minutes. Pre-research triage was reduced from three hours to about ten minutes, and analysis of variance of controlled substances was reduced from 30 minutes to less than one minute. However, it's critical for teams to run parallel tests with historical cases before allowing agent-assisted results to impact compliance decisions. Local tests should examine data integrity, drug code matching, shortage timing, and exception rules, especially in cases where human reviewers previously disagreed. Each finding in production must preserve the scoring rule version, source evidence, and tool trace that generated it.
This initiative illustrates how artificial intelligence can ease the operational burden in highly regulated sectors. However, its successful implementation requires not only technology, but also a careful focus on cybersecurity, data governance, and integration with existing systems. For companies looking to develop similar solutions – whether in healthcare, finance or logistics – having an experienced technology partner makes all the difference. Q2BSTUDIO offers AI services for companies and tailor-made software that allow you to build custom intelligent agents, tailored to the specific needs of each organization. Our team combines in-depth knowledge of AWS and Azure cloud services with cybersecurity practices and business intelligence services such as Power BI to offer complete solutions ranging from process automation to the creation of advanced dashboards.
Bluesight's architecture demonstrates that it is possible to reduce response times and improve accuracy without sacrificing human control. The use of AI agents that act as workflow assistants, combined with deterministic rules for critical decisions, is a model that can be replicated in many industries. For example, in insurance claims management, tax compliance or the validation of legal documents. The key is to design systems where artificial intelligence enhances human capacity, not completely replaces it.
For companies considering a similar transformation, we recommend starting with a pilot in a particular process, measuring the actual impact, and scaling gradually. It's essential to engage business teams from the start, define clear success metrics, and establish a continuous feedback loop. Q2BSTUDIO can accompany this process by offering both strategic consulting and technical development of tailor-made applications that integrate artificial intelligence, cloud services and cybersecurity in a robust and scalable way.
Bluesight and AWS's case is not only a milestone in 340B hospital compliance, but an example of how well-applied technology can free up thousands of hours of human labor for professionals to focus on higher-value decisions. As more healthcare organizations adopt these types of solutions, we will see a standardization of audit processes and a reduction in manual errors. And, with the support of committed technology partners, the adoption of AI agents in regulated environments will become increasingly secure and efficient.
