AWS and Bluesight Launch AI Platform for Enhanced Hospital 340B Compliance
# AWS and Bluesight Develop AI for Hospital 340B Compliance
Amazon Web Services (AWS) has detailed the rollout of Bluesight's Prism, an artificial intelligence platform designed to streamline hospital pharmacy and compliance data. This AI layer aims to enhance the efficiency of compliance procedures connected to the 340B Drug Pricing Program.
Prism Assistant for ControlCheck has been widely adopted, now functioning across 20 health systems, as revealed by AWS information. In addition, a forthcoming multi-product agent for compliance with Group Purchasing Organizations (GPO) is anticipated for launch in late 2026.
The initiative tackles a labor-intensive process that pharmacy teams typically handle manually. According to AWS, a single 340B covered entity may spend over 4,000 hours annually verifying which GPO drug purchases meet exception criteria. This verification process requires staff to cross-reference purchase data with FDA shortage notices, records from the American Society of Health-System Pharmacists, inventory data, machine learning forecasts for shortages, and reports of back-order situations from various hospitals.
**ControlCheck Agent Reaches 20 Health Systems**
Bluesight's ControlCheck product was the initial focus of the effort. It enables hospital diversion teams to identify suspicious transaction patterns regarding controlled substances. However, compliance staff still needed to compile reports and analyze data manually.
The Prism Assistant affords users a conversational interface capable of querying ControlCheck data, generating charts, and creating reports. The project progressed rapidly, with the first version created during a three-day Experience-Based Acceleration engagement in September 2025. Eight Bluesight engineers collaborated with seven AWS experts to develop this version. TechForge Media notes that while these quick development timelines showcase the tools' agility, they await independent verification from the participating health systems.
To implement this project, the team utilized Strands Agents in conjunction with Amazon Bedrock, hosting the application through Amazon Bedrock AgentCore Runtime. This setup allowed access to more than ten ControlCheck APIs, making it easier for the agent to utilize them during user inquiries.
Bluesight effectively eliminated direct database access for the language model, wrapping existing ControlCheck API endpoints with AWS Lambda functions. This arrangement ensured that only structured data suitable for agent processing was returned. The business logic remained contained within Bluesight’s application layer, while the agent was able to interpret queries, select tools, retrieve records, and display the results.
As a result, AWS reports that query response times improved significantly, decreasing from five minutes to just ten seconds. The deployment also featured a frontend equipped with tools for chart creation, observability controls, cost tracking, encryption, authentication, and infrastructure-as-code.
"This is exactly what diversion program leaders have been waiting for—it gets them to answers faster and takes the manual grind out of every investigation," stated Samir Neyazi, Director of Product Management at Bluesight.
Bluesight launched the service within a virtual private cloud, achieving general availability in under nine months, as noted by AWS. The 20 health systems currently employing the Prism Assistant represent real-world evidence of its deployment, while the larger GPO agent is still in development.
**Multi-Agent 340B Compliance Targets GPO Purchases**
Under federal 340B regulations, certain hospitals, including Disproportionate Share, Children’s, and Free-Standing Cancer hospitals, are prohibited from acquiring outpatient drugs through GPO contracts when alternative supply channels are available. Compliance teams are required to document exceptions whenever supply conditions necessitate this purchase pathway.
The planned GPO agent by Bluesight will merge data from CostCheck, ShortageCheck, and 340BCheck. CostCheck handles purchasing information, ShortageCheck tracks drug availability, and 340BCheck validates eligibility data.
The designed architecture will utilize Anthropic Claude Sonnet 4.6 as the primary model, along with Claude Haiku 4.5 for quicker operations via Amazon Bedrock. AgentCore Runtime will execute the agents within a private VPC using separate subnets. Meanwhile, AgentCore Gateway will link Lambda-driven tools to the three Bluesight product systems.
The GPO agent will coordinate tasks among specialized data workers. One worker will retrieve purchase histories, another will collect supply evidence, and a third will verify 340B eligibility. The coordinator will compile this information into a report suitable for audits.
A second AWS acceleration engagement occurred in March 2026, focusing on this architecture. AWS reported that the team effectively linked the system by the close of the first day, with all planned features finished by the end of the second day. Testing against synthetic data yielded a 100 percent invoice discovery rate and a 93 percent accuracy rate for evidence justification, exceeding the 85 percent target set.
However, enterprise clients are urged to remain cautious: these metrics do not capture actual performance across the hospitals. While synthetic tests validate whether the system performs correctly against controlled scenarios, they cannot guarantee how it will respond to real-world data gaps, delayed shortage notifications, unusual drug identifiers, or disputed purchasing cases.
**Keeping Compliance Scoring Outside the Language Model**
In the GPO workflow, Bluesight has limited the role of the language model. It handles record gathering, invokes product tools, and drafts explanations, while a deterministic scoring service determines compliance.
This service assesses 13 pieces of evidence, applies priority-based matching, and utilizes configurable time frames. This setup allows compliance teams a systematic approach for scoring rather than relying on decisions generated by the language model. Auditors are able to inspect the source records, applied rules, and the sequence of tool calls used in each evaluation.
Despite the automation, pharmacy, legal, and compliance teams must retain definitive control over policy settings. Variables such as a supplier shortage threshold, acceptable inventory duration, or purchase date parameters can significantly influence compliance outcomes. Bluesight’s mechanism allows customers to define these decisions, but organizations must develop and approve their own policy regulations.
**HIPAA Controls and Audit Traces Shape the Deployment**
Amazon Bedrock is HIPAA-compliant, and Bluesight has entered a Business Associate Agreement with AWS. AWS confirms it does not use customer data processed through Amazon Bedrock in training foundational models.
Bluesight employs Amazon Cognito for OAuth2 authentication and JSON Web Token validation. The AgentCore Runtime ensures session isolation for simultaneous customer requests, while AWS Key Management Service secures data both in storage and transit, with AWS Secrets Manager managing credentials for additional services.
Additionally, Amazon CloudWatch logs agent decisions, tool calls, and data access events, ensuring traceability when hospitals need to justify a GPO purchase or escalate drug diversion concerns.
Bluesight's internal evaluations across the 20 health systems indicate that report generation and analysis times in ControlCheck workflows improved by up to 97 percent. Manual assembly of recurring reports shrank from approximately six hours to just 15 minutes, representing a 96 percent reduction. Likewise, pre-investigation assessments reduced from three hours to about ten minutes, while analysis of controlled substances dropped from 30 minutes to under one minute.
Teams are advised to conduct historical purchasing assessments simultaneously with existing review processes before allowing agent-assisted results to influence compliance decisions. Local testing should thoroughly evaluate data integrity, drug-code alignment, timing for shortages, exception rules, and cases of previous reviewer discrepancies. Each production finding must document the scoring rules, source evidence, and the analysis trail that produced the outcome.
