AI for Hospital 340B Compliance: AWS and Bluesight Collaboration

Amazon Web Services (AWS) has detailed how Bluesight, a healthcare technology provider, leveraged its cloud infrastructure and AI services to develop Prism, an innovative AI layer designed to unify pharmacy and compliance data across its product suite.

The Prism Assistant for ControlCheck, a key component of this initiative, has achieved general availability and is currently operational within 20 health systems. Simultaneously, a more comprehensive multi-product agent focused on 340B Group Purchasing Organization (GPO) compliance is slated for release in late 2026. This development underscores a strategic push to automate and enhance complex, data-intensive tasks prevalent in hospital pharmacy operations.

The inherent complexity of managing GPO drug purchases for 340B compliance often necessitates extensive manual review. AWS highlights that a single 340B-covered entity can dedicate over 4,000 staff hours annually to scrutinize whether GPO drug acquisitions qualify for statutory exceptions. This rigorous process involves cross-referencing purchase data with a multitude of sources, including U.S. Food and Drug Administration (FDA) shortage notices, American Society of Health-System Pharmacists (ASHP) records, internal inventory levels, machine learning-driven shortage forecasts, and back-order reports from peer hospitals. Prism aims to dramatically streamline this laborious undertaking.

ControlCheck Agent Streamlines Diversion and Compliance in 20 Health Systems

Bluesight’s journey with Prism began with ControlCheck, its established solution for monitoring controlled substances. While ControlCheck assists hospital diversion teams in identifying anomalous medication transaction patterns, compliance personnel still bore the brunt of assembling reports, analyzing dashboards, and manually correlating findings. The introduction of Prism Assistant transforms this workflow by providing a conversational interface that allows users to query ControlCheck data, generate insightful charts, and produce comprehensive report materials.

According to AWS, the initial version of Prism Assistant was developed with remarkable speed, emerging from a three-day Experience-Based Acceleration engagement in September 2025. This rapid development cycle involved a collaborative effort between eight Bluesight engineers and seven AWS specialists. The underlying technology stack leverages Strands Agents integrated with Amazon Bedrock and hosted via Amazon Bedrock AgentCore Runtime. AgentCore Gateway played a crucial role by exposing more than 10 ControlCheck APIs as tools, enabling the AI agent to dynamically discover and invoke them in response to user queries.

A critical design principle for Bluesight was to circumvent direct database access for the language model. Instead, Bluesight engineers ingeniously wrapped existing ControlCheck API endpoints within AWS Lambda functions. These functions are engineered to return structured data precisely formatted for efficient agent processing. This approach ensures that the core business logic remains encapsulated within Bluesight’s application layer, while the AI agent focuses on interpreting user questions, selecting the appropriate tools, retrieving the necessary data, and presenting the findings in a clear and actionable manner.

The impact of this architectural decision is significant, with AWS reporting a substantial reduction in query latency, dropping from an average of five minutes to a mere 10 seconds. The deployment also encompasses a robust frontend with advanced features including chart generation, comprehensive observability controls, cost attribution mechanisms, end-to-end encryption, secure authentication, and infrastructure-as-code for streamlined management.

“This is precisely what diversion program leaders have been anticipating – it accelerates their access to critical insights and eliminates the repetitive manual effort inherent in every investigation,” stated Samir Neyazi, Director of Product Management at Bluesight. “The ability to quickly drill down into complex data sets empowers our clients to make faster, more informed decisions.”

Bluesight successfully deployed the Prism Assistant service within a virtual private cloud (VPC), achieving general availability in under nine months, as confirmed by AWS. The current deployment across 20 health systems serves as tangible evidence of Prism’s operational readiness, while the more ambitious GPO compliance agent is still on track for future release.

Multi-Agent System Targets 340B GPO Purchase Compliance

The intricacies of the federal 340B program impose specific restrictions on certain hospital types – namely Disproportionate Share, Children’s, and Free-Standing Cancer hospitals. These entities are prohibited from acquiring outpatient drugs through GPO contracts if non-GPO channels can fulfill the demand. Compliance teams are therefore tasked with meticulously documenting the specific circumstances that necessitate using a GPO contract, typically when supply chain constraints prevent alternative procurement routes.

Bluesight’s planned GPO agent is architected to consolidate data from its CostCheck, ShortageCheck, and 340BCheck products. CostCheck provides granular purchase transaction details, ShortageCheck offers crucial evidence regarding drug availability, and 340BCheck verifies the eligibility status of the entity and the drug under the program’s guidelines. This integrated approach aims to create a single source of truth for 340B GPO compliance.

The proposed architecture for the GPO agent employs Anthropic’s Claude Sonnet 4.6 as the primary large language model, with Claude Haiku 4.5 utilized for operations requiring lower latency, both accessible through Amazon Bedrock. The AgentCore Runtime will execute these agents within a secure VPC environment, leveraging private subnets for enhanced data protection. AgentCore Gateway will act as the intermediary, connecting Lambda-backed tools to the three core Bluesight product systems.

At the heart of the GPO agent’s functionality is a coordinating agent that orchestrates a team of specialized “data workers.” Each worker is assigned a distinct function: one retrieves purchase records, another gathers critical supply availability evidence, and a third verifies 340B eligibility. The coordinating agent then synthesizes this collected evidence to generate a comprehensive, audit-ready report.

A second AWS acceleration engagement in March 2026 was dedicated to refining this GPO agent architecture. AWS reports that the development team successfully connected the system by the end of the first day and completed all planned features by the conclusion of the second day. During testing with synthetic data, the agent demonstrated an impressive 100 percent invoice discovery rate and achieved 93 percent evidence justification accuracy, significantly exceeding the internal target of 85 percent.

However, enterprise buyers should exercise a degree of caution. These impressive metrics derived from synthetic testing, while indicative of the system’s potential, do not represent real-world performance in a production environment across diverse hospital settings. Synthetic testing is invaluable for validating the mechanics of tool invocation, data matching logic, and report generation against pre-defined scenarios. Yet, it cannot fully replicate the complexities of handling actual hospital data, including potential data gaps, delayed updates on drug shortages, non-standard drug identifiers, or contentious purchasing disputes.

Maintaining Deterministic Compliance Scoring Separate from Language Models

Bluesight has strategically assigned a precisely defined and constrained role to the language model within the GPO compliance workflow. The model’s primary responsibilities are to gather the relevant records, invoke specialized product tools, and draft preliminary explanations. The critical compliance determination itself is then executed by a separate, deterministic scoring service.

This robust scoring service evaluates a comprehensive set of 13 distinct evidence inputs. It applies a sophisticated priority-based matching algorithm and utilizes configurable time windows to ensure accuracy. This architectural choice ensures a repeatable and auditable scoring process, rather than relying on a potentially opaque AI-generated judgment. Critically, it provides auditors with the ability to meticulously inspect the source records, the specific rules that were applied, and the exact sequence of tool calls that led to each compliance determination.

Despite the significant automation offered by Prism, hospital pharmacy, legal, and compliance teams retain ultimate ownership and control over policy settings. Variables such as supplier shortage thresholds, acceptable inventory holding periods, or specific purchase date windows can fundamentally alter a compliance outcome. While Bluesight’s approach provides a powerful technical mechanism for configuring these decision parameters, each healthcare organization must independently define, approve, and manage its own set of policy rules.

HIPAA Compliance and Comprehensive Audit Trails Enhance Deployment Security

Amazon Bedrock is recognized for its HIPAA eligibility, and Bluesight operates under a formal Business Associate Agreement (BAA) with AWS. AWS asserts that it does not utilize customer data processed through Amazon Bedrock for training its foundation models, a critical assurance for healthcare organizations.

For secure authentication and authorization, Bluesight employs Amazon Cognito, facilitating OAuth2 client-credential authentication and JSON Web Token (JWT) validation. AgentCore Runtime provides essential session isolation, ensuring that concurrent customer requests are processed independently and securely. AWS Key Management Service (KMS) is utilized for encrypting data both at rest and in transit, while AWS Secrets Manager diligently manages credentials for downstream services, further bolstering security posture.

Amazon CloudWatch serves as a comprehensive monitoring and logging solution, meticulously recording agent decisions, tool invocations, data access events, system alarms, and key performance metrics. This detailed audit trail is invaluable, particularly when a hospital needs to provide a transparent explanation for permitting a specific GPO purchase or for investigating a potential drug diversion pattern.

Bluesight’s internal metrics, gathered from its deployments across 20 health systems, indicate substantial efficiency gains. They report up to a 97 percent acceleration in report generation and analysis for ControlCheck workflows. Recurring report assembly, which previously consumed approximately six hours of manual effort, has reportedly been reduced to just 15 minutes – a remarkable 96 percent decrease. Pre-investigation triage time has dropped from three hours to around 10 minutes, and the analysis of controlled-substance variances now takes less than a minute, down from 30 minutes.

Healthcare organizations are advised to rigorously implement historical purchasing case reviews in parallel with their existing manual processes before entrusting agent-assisted results to inform critical compliance decisions. Thorough local testing should meticulously examine data completeness, the accuracy of drug code matching, the precise timing of shortage information, the application of exception rules, and instances where human reviewers previously held differing opinions. Every production-level finding should be accompanied by the precise version of the scoring rule utilized, the supporting source evidence, and a clear trace of the tool calls that contributed to its determination, ensuring full transparency and accountability.