AWS and Bluesight: AI for 340B Hospital Compliance

AWS and Bluesight: A New Era for Hospital Compliance

Amazon Web Services (AWS) and Bluesight have joined forces to develop an innovative solution called Prism. This artificial intelligence technology aims to transform the way hospital pharmacy and compliance data are managed, seamlessly integrating them across a suite of products. Prism represents a significant advancement in the field of hospital data management.

A Promising Initial Deployment

The tool Prism Assistant for ControlCheck has already found its place in 20 healthcare systems. According to AWS, this rapid adoption reflects the effectiveness and relevance of the solution. Additionally, a multi-product agent designed to ensure compliance with the 340B group purchasing program is currently under development, with a planned launch in 2026.

Automating a Time-Consuming Process

The project aims to automate a traditionally data-heavy process that hospital pharmacy teams previously had to manage manually. AWS emphasizes that a single entity covered by the 340B program can spend over 4,000 hours per year verifying whether drug purchases through Group Purchasing Organizations (GPOs) can qualify for exceptions. This work involves comparing purchasing data with shortage notices from the Food and Drug Administration (FDA) of the United States, records from the American Society of Health-System Pharmacists, available inventories, as well as shortage forecasts based on machine learning and pending order reports from other hospitals.

ControlCheck: An Advancement in 20 Healthcare Systems

Bluesight initially introduced ControlCheck, a product for monitoring controlled substances. Hospital diversion teams rely on ControlCheck to detect unusual drug transactions. However, compliance staff still had to manually assemble reports, review dashboards, and correlate results.

With Prism Assistant, users now have a conversational interface capable of querying ControlCheck data, producing graphs, and generating reports. AWS notes that the first version of this tool was developed during a three-day acceleration engagement in September 2025, involving eight engineers from Bluesight and seven specialists from AWS. While these rapid development timelines demonstrate the agility of the tools, they require independent verification by active healthcare systems.

A Robust Technical Architecture

The team utilized Strands Agents with Amazon Bedrock to host the application via Amazon Bedrock AgentCore Runtime. AgentCore Gateway made over 10 ControlCheck APIs accessible as MCP tools, allowing the agent to discover and use them during a user query.

It is important to note that Bluesight avoided granting direct access to the database for the language model. Engineers encapsulated existing ControlCheck API endpoints within AWS Lambda functions, which return structured data suitable for processing by the agent. Business logic was maintained within the application layer, while the agent interpreted questions, selected tools, gathered records, and presented results.

Significant Latency Reduction

AWS reports that this design has reduced query latency from five minutes to 10 seconds. The deployment also includes a frontend with graph generation, observability controls, cost attribution, encryption, authentication, and infrastructure as code.

According to Samir Neyazi, Director of Product Management at Bluesight, “This is exactly what diversion program managers were looking for — it allows them to get answers faster and eliminates the manual work of each inquiry.”

Bluesight deployed the service in a virtual private cloud and achieved general availability in less than nine months, according to AWS. The 20 healthcare systems using Prism Assistant testify to the active deployment in the AWS account, although the broader GPO agent has not yet reached this milestone.

Multi-Agent 340B Compliance: An Ambitious Goal

Federal 340B rules prohibit certain hospitals, such as those with disproportionate share, children's hospitals, and freestanding cancer hospitals, from purchasing outpatient drugs through GPO contracts when non-GPO channels can provide the drug. Compliance teams must document the exception when supply conditions prevent this purchasing route.

The GPO agent planned by Bluesight gathers records from CostCheck, ShortageCheck, and 340BCheck. CostCheck provides purchasing information, ShortageCheck contributes evidence of drug availability, and 340BCheck validates eligibility data.

An Advanced Technical Architecture

The proposed architecture uses Anthropic Claude Sonnet 4.6 as the primary model and Claude Haiku 4.5 for low-latency operations via Amazon Bedrock. AgentCore Runtime executes agents in a VPC with private subnets. AgentCore Gateway connects Lambda-supported tools to the three Bluesight product systems.

A coordinating GPO agent directs specialized data workers. One worker retrieves purchasing records, another gathers supply evidence, and another verifies 340B eligibility. The coordinator assembles the evidence and produces an audit-oriented report.

In March 2026, a second AWS acceleration engagement focused on this architecture. AWS states that the team connected the system by the end of its first day and completed all planned features by the end of the second day. The company tested the agent against synthetic data, where it reported a 100% invoice discovery rate and a 93% evidence justification accuracy, exceeding its 85% target.

However, enterprise buyers must exercise caution: these figures do not represent production performance with hospital clients. Synthetic tests can demonstrate whether tool calls, matching logic, and report generation work against prepared scenarios, but cannot establish how the system handles local data gaps, delayed shortage updates, unusual drug identifiers, or disputed purchasing cases.

Maintaining Compliance Assessment Outside the Language Model

Bluesight assigns a constrained role to the language model within the GPO workflow. The model gathers records, calls product tools, and drafts the explanation. A deterministic scoring service calculates the compliance determination.

This service evaluates 13 evidence entries, applies priority-based matching, and uses configurable time windows. The design offers compliance teams a repeatable scoring process rather than a judgment generated by an LLM, allowing an auditor to inspect source records, applied rules, and the sequence of tool calls behind each determination.

Despite the automated assistance, hospital pharmacy, legal, and compliance teams must still maintain absolute ownership of these policy parameters. A supplier shortage threshold, an acceptable inventory period, or a purchase date window can alter a compliance outcome. Bluesight's approach provides clients with a technical mechanism to configure these decisions, but each organization must define and approve its own policy rules.

HIPAA Controls and Audit Trails Shape Deployment

Amazon Bedrock holds HIPAA eligibility, and Bluesight operates under a Business Associate Agreement with AWS. AWS asserts that it does not train base models on customer data processed via Amazon Bedrock.

Bluesight uses Amazon Cognito for client-credential OAuth2 authentication and JSON Web Token validation. AgentCore Runtime provides session isolation for simultaneous client requests. AWS Key Management Service encrypts data at rest and in transit, while AWS Secrets Manager manages credentials for downstream services.

Amazon CloudWatch logs agent decisions, tool invocations, data access events, alarms, and performance metrics. This audit trail is crucial when a hospital needs to explain why it allowed a GPO purchase or escalated a drug diversion model.

Bluesight's internal measures across 20 healthcare systems report up to 97% faster report generation and analysis in ControlCheck workflows. Recurring reports would have gone from about six hours of manual assembly to 15 minutes, representing a 96% reduction. Pre-investigation triage has decreased from three hours to about 10 minutes, while analysis of controlled substance variations has dropped from 30 minutes to under a minute.

Teams should strictly execute historical purchase cases in parallel with existing review processes before allowing an agent-assisted outcome to affect compliance decisions. Local tests should rigorously examine data completeness, drug code matching, shortage timing, exception rules, and cases where human reviewers have previously disagreed. Each production finding should retain the version of the scoring rule, source evidence, and the trail of tools that produced it.