Grema New service Book an audit

Healthcare AI Readiness Audit

Get your healthcare AI ready for the hospital security review.

Five business days. USD 2,500, fixed.

A fixed-scope engineering review for companies building AI products for healthcare: the privacy and security gaps, where patient data goes and which agreement covers it, and what your LLM and cloud bill should be.

Book an audit Trace a sample record

Do not send patient data or credentials by email. The audit is designed so we do not need or view production patient data.

Follow one patient record through a made-up AI scribe.

Part of what you get is a data-flow and contract map: every hop patient data takes, the region it lands in, and the agreement that covers it. This is an excerpt.

Illustrative example, not a real client

  1. Cloud hostingCovered
  2. Model APIGap: verify
  3. Log serviceGap
  4. AnalyticsGap
  5. Error trackingGap
Illustrative example, not a real client 1 covered1 to verify3 gaps

  1. Start

    A clinician records a visit.

    The made-up product turns the audio into a transcript and a note. From here the record moves, and every hop gets the same three questions: what data, which region, which agreement.

  2. Hop 1 of 5

    Cloud hosting: app, database, file storage

    Data
    Audio, transcripts, notes
    Region
    Canada
    Agreement
    Cloud provider BAA accepted
    Status
    Covered

  3. Hop 2 of 5

    Model provider API: transcription and summary

    Data
    Audio, transcripts with identifiers
    Region
    United States
    Agreement
    BAA signed; zero-retention setting not confirmed
    Status
    Gap: verify

  4. Hop 3 of 5

    Log management service

    Data
    Full prompts and outputs at debug level
    Region
    United States
    Agreement
    None found
    Status
    Gap

  5. Hop 4 of 5

    Product analytics

    Data
    User IDs, page URLs containing patient IDs
    Region
    United States
    Agreement
    Data processing terms only, no BAA
    Status
    Gap

  6. Hop 5 of 5

    Error tracking

    Data
    Request payloads in stack traces
    Region
    European Union
    Agreement
    None found
    Status
    Gap

  7. Result

    5hops traced
    1covered
    1to verify
    3gaps

    In this made-up example, one hop is covered and four need work. The fix list says what to do about each.

Then the findings, ranked, each with a fix.

Five example findings for the same made-up product, written the way the report writes them.

Illustrative example, not a real client

  1. High

    Prompts and outputs are copied to a log service with no agreement

    Debug logging in production sends full transcripts to a third-party log service that has not signed a BAA.

    FixRedact bodies at the logger, drop production log level to info, purge retained logs, then decide whether this vendor needs a BAA at all.

  2. High

    Ontario tenants are processed in a US region

    Sales material says data stays in Canada, but the model endpoint used for all tenants is in the US.

    FixRoute Canadian tenants to a Canadian-region endpoint, or correct the claim before the next review.

  3. Medium

    CI deploys with long-lived admin keys

    One access key with administrator rights is stored in CI and shared by three pipelines.

    FixSwitch to short-lived credentials via OIDC federation, scoped per pipeline.

  4. Medium

    No audit trail for staff access to transcripts

    Support staff can open any transcript, and access is not logged.

    FixAdd an append-only access log and a just-in-time access request for support.

  5. Savings

    Every call goes to the largest model

    Most requests are short classification calls that a smaller model handles. The same long system prompt is resent on every call.

    FixRoute classification to a smaller model and enable prompt caching. The estimate in this made-up example, with its assumptions written down: about 40% of monthly LLM spend.

Four deliverables, written for your engineers.

And usable in your next customer security review.

  1. Privacy and security gap check

    Your AI stack checked against what hospital and clinic security reviews ask about: access control and sign-in, encryption, audit logging, secrets, network exposure, backups, incident response, and how prompts and outputs are stored. Mapped to HIPAA Security Rule safeguards for US buyers and PHIPA expectations for Ontario buyers.

    SourceThe HIPAA Security Rule sets out administrative, physical and technical safeguards that covered entities and business associates must put in place to protect electronic protected health information. HHS: Summary of the HIPAA Security Rule

  2. Data-flow and contract map

    Every place patient data goes: model provider, cloud, logging, analytics, error tracking, support tools and other sub-processors. For each hop: what data, which region it sits in, and which agreement covers it, such as a business associate agreement. Gaps are flagged.

    SourceUnder HIPAA, a covered entity may disclose protected health information to a business associate when it obtains satisfactory assurances in a written agreement, the business associate agreement. HHS: Business associates FAQ

    SourceIn Ontario, PHIPA section 10(4) requires a person who provides goods or services that enable a health information custodian to use electronic means to handle personal health information to comply with the prescribed requirements. e-Laws: Personal Health Information Protection Act, 2004

  3. LLM and cloud spend teardown

    Where the money goes, by model, feature and environment. Where it could come down: routing simple calls to smaller models, prompt caching, batching, trimming context, right-sizing compute and storage, and removing idle resources. Each item comes with an estimate, the assumptions behind it, and the effort to get it.

  4. Prioritized fix list and walkthrough

    Every finding ranked by severity and effort, with a specific fix your engineers can pick up. Then a 60-minute walkthrough with your team to go through the findings and answer questions.

For teams selling AI into healthcare.

And about to face, or stuck in, a customer security review.

A good fit

  • Health-AI startups selling to US health systems, clinics or payers.
  • AI scribe and documentation vendors, including those selling in Ontario who need to show where patient data is stored and processed.
  • Digital health product teams adding LLM features to an existing product.
  • Teams with a security questionnaire due and no one who owns the whole picture across cloud, model provider and vendors.

Not a fit

  • Clinics and hospitals looking for a chatbot or an AI tool to use. We do not sell one.
  • Anyone who needs a compliance certificate, a SOC 2 report or a formal attestation. We do not issue them.
  • Anyone looking for legal advice. Take the report to your counsel.

Five business days, kickoff to walkthrough.

The clock starts once intake and access are complete. You choose what we can see; all access is read-only and removed at the end.

  1. Before day 1

    Agree and schedule

    Short call to confirm scope. We sign an NDA and a statement of work. A USD 500 deposit reserves the start date.

  2. Day 1

    Kickoff and access

    A 45-minute kickoff. You share architecture docs, vendor list and agreements, and read-only access to the cloud accounts, repos or dashboards you choose.

  3. Days 2 and 3

    Review

    We review configuration, infrastructure code, logging, vendors and billing, and map every data flow. Questions go to one named contact.

  4. Day 4

    Report

    The written report: gap check, data-flow and contract map, spend teardown and the ranked fix list.

  5. Day 5

    Walkthrough

    A 60-minute walkthrough with your team. Balance is due on delivery, and we remove our access.

Read-only access to what you choose, day 1 to day 5. Removed at the end.

Fixed prices, in US dollars.

Applicable taxes extra.

Healthcare AI Readiness Audit

USD2,500

Fixed, 5 business days

  • Privacy and security gap check (HIPAA Security Rule safeguards, PHIPA expectations)
  • Data-flow and contract map
  • LLM and cloud spend teardown
  • Prioritized fix list and 60-minute walkthrough
Book an audit

LLM spend teardown

USD1,000

Fixed, 3 business days

  • Spend by model, feature and environment
  • Routing, caching, batching and context savings, each with an estimate and its assumptions
  • Written report and a walkthrough call
Ask about a teardown

DepositA USD 500 deposit reserves a start date, and the balance is due on delivery. We send payment details once the statement of work is signed.

TimingThe business days count from kickoff, once intake and access are complete.

After the auditIf you want help with the fixes, we do hands-on infrastructure work at an hourly rate. Ask for a quote.

Questions

Is this a certification?

No. It is an engineering review. It is not legal advice, not a HIPAA or PHIPA certification, and not a SOC 2 report or any other formal compliance attestation. It prepares you for customer security reviews and gives your counsel a clear technical picture to work from.

Do you need our patient data?

No. The audit is designed so we do not need or view production patient data. We work from architecture docs, configuration, infrastructure code, vendor agreements and read-only access you choose to grant. If a system holds patient data, we look at how it is configured, not at the records in it.

Do you sign an NDA, and a BAA if needed?

We sign an NDA for every engagement. We design the audit so that we do not handle patient data. If your situation would require us to have access to it, we will discuss a business associate agreement with you before any access is granted.

Who are you?

Grema is a service of FourCores Technologies Limited, a small company in Toronto, Ontario. We are an infrastructure and AI engineering practice: cloud, Kubernetes, Terraform, CI/CD, observability and deploying LLM applications. We are engineers, not lawyers or auditors. This is a new service, so we have no past healthcare audits to show you, which is why the sample above is illustrative.

Canada or US?

Both. We are based in Toronto and work with teams in Canada and the US. For US buyers we map against HIPAA Security Rule safeguards and business associate agreements. For Ontario buyers we map against PHIPA expectations, including where data is stored and processed. Other provinces have their own health privacy laws; we flag where they may differ and leave the legal reading to your counsel.

What happens after?

You keep the report and the fix list. You can fix the high-severity items yourselves and use the report to prepare for your next security questionnaire. If you want hands-on help, we can do the infrastructure work at an hourly rate; ask for a quote.

Book an audit

One email starts it. Tell us what you are building and who you sell to.

Book an audit

Or write to hello@grema.io

Do not send patient data or credentials by email. The audit is designed so we do not need or view production patient data.