🏥 AI Pharmacy: Streamlining Compliance Now! ✨

PRISM: A Conversational Approach to 340B Compliance
The development of Prism, an AI layer connecting hospital pharmacy and compliance data, represents a significant advancement in streamlining 340B drug purchasing processes. Bluesight, in partnership with AWS, has created a system designed to reduce manual effort and improve accuracy in a data-intensive field.

THE LEAK: Addressing Manual Data Review
Hospital pharmacy teams frequently spend over 4,000 staff hours annually reviewing 340B drug purchases for exceptions. This process involves comparing purchase data with FDA shortage notices, American Society of Health-System Pharmacists records, days-on-hand inventory, machine learning shortage forecasts, and back-order reports. This manual approach is prone to human error and inefficiencies.

CONTROLCHECK: The Foundation of the Solution
Bluesight’s ControlCheck product, a controlled-substance monitoring tool, was initially used to identify unusual medication transaction patterns. However, compliance staff still needed to assemble reports, review dashboards, and correlate findings manually. The need for a more intelligent and efficient solution prompted the development of Prism Assistant.

PRISM ASSISTANT: A Conversational Interface
Prism Assistant introduces a conversational interface to ControlCheck data, allowing users to query data, produce charts, and generate reports. This shift from manual data manipulation to a natural language interaction dramatically improves the speed and accessibility of information. AWS claims a five-minute query latency was reduced to just ten seconds with the deployment of Prism Assistant.

TECHNOLOGY & ARCHITECTURE: A Rapid Development Cycle
The initial version of Prism was developed during a three-day Experience-Based Acceleration engagement in September 2025, involving eight Bluesight engineers and seven AWS specialists. The system utilizes Strands Agents with Amazon Bedrock and is hosted through Amazon Bedrock AgentCore Runtime. Key components include AgentCore Gateway, which exposes ControlCheck APIs, and Lambda functions for data processing, allowing the agent to interpret questions, gather records, and present results.

AGENTCORE RUNTIME: Orchestrating Data Retrieval
AgentCore Runtime executes the agents within a virtual private cloud (VPC) with private subnets, ensuring secure data processing. The Gateway connects Lambda-backed tools to the three Bluesight product systems, creating a coordinated workflow. This architecture allows for a specialized data worker to retrieve purchase records, another to gather supply evidence, and a third to check 340B eligibility, ultimately assembling an audit-oriented report.

NEXT STEPS: The GPO Agent Project
Bluesight is developing a multi-product agent targeting 340B Group Purchasing Organisation (GPO) compliance. This agent will integrate records from CostCheck, ShortageCheck, and 340BCheck, bringing together a more comprehensive view of 340B-eligible purchases. The architecture utilizes Anthropic Claude Sonnet 4.6 and Claude Haiku 4.5 models via Amazon Bedrock, with AgentCore Runtime executing the agents within the VPC.

DATA INTEGRATION: A Multi-Agent Approach
The GPO agent employs a coordinating agent that directs specialist data workers. Each worker focuses on a specific task – retrieving purchase records, gathering supply evidence, and checking 340B eligibility – ultimately producing a detailed audit report. The team conducted synthetic testing, achieving a 100 percent invoice discovery rate and 93 percent evidence justification accuracy, exceeding their 85 percent target.

HIPAA COMPLIANCE & SECURITY: A Robust Framework
Bluesight’s deployment adheres to stringent HIPAA controls, utilizing Amazon Bedrock for HIPAA eligibility and employing Business Associate Agreements with AWS. Authentication is managed through Amazon Cognito, and data is encrypted at rest and in transit using AWS Key Management Service and Secrets Manager.

SCORING & POLICY: Human Oversight Remains Crucial
Crucially, Bluesight avoids direct database access for the language model, wrapping existing ControlCheck API endpoints in AWS Lambda functions. The company retains business logic within its application layer, while the agent interprets questions, selects tools, gathers records, and presents results. A deterministic scoring service calculates the compliance determination, evaluating 13 evidence inputs and applying configurable time windows. However, it’s important to note that policy settings, such as supplier shortage thresholds, require manual configuration and approval by the customer.

MEASUREMENT & VALIDATION: Synthetic Testing and Real-World Deployment
Initial testing involved synthetic data, demonstrating the agent’s capabilities. However, Bluesight acknowledges that these synthetic figures do not represent production performance across hospital customers, emphasizing the need for real-world validation. The 20 health systems using Prism Assistant represent the active deployment evidence in the AWS account, while the larger GPO agent is scheduled for release later in 2026.