How AWS and Bluesight Use AI to Simplify Hospital 340B Compliance

AWS (Amazon Web Services) has detailed how Bluesight built Prism, an AI layer that connects hospital pharmacy and compliance data across its product suite. The platform is designed to eliminate manual data reviews that have long burdened hospital compliance and pharmacy teams.

Prism Assistant for ControlCheck has reached general availability and is now operating across 20 health systems, according to AWS vendor statements. A multi-product agent for 340B Group Purchasing Organisation (GPO) compliance remains on schedule for release later in 2026.

⏱️ Key stat: A single 340B covered entity can spend more than 4,000 staff hours per year reviewing whether GPO drug purchases qualify for an exception — a process Prism is engineered to automate.

Staff are currently required to cross-reference purchase data against US Food and Drug Administration shortage notices, American Society of Health-System Pharmacists records, days-on-hand inventory, machine learning shortage forecasts, and back-order reports from other hospitals — all manually.

ControlCheck Agent Now Live Across 20 Hospital Health Systems

Bluesight began with ControlCheck, its controlled-substance monitoring product. While hospital diversion teams use ControlCheck to flag unusual medication transaction patterns, compliance staff still had to manually assemble reports, review dashboards, and correlate findings.

Prism Assistant introduces a conversational interface that allows users to query ControlCheck data, generate charts, and produce report material directly. AWS reports that Bluesight built the first version during a three-day Experience-Based Acceleration engagement in September 2025, with eight Bluesight engineers working alongside seven AWS specialists.

⚠️ Editorial note: While these rapid development timelines highlight the agility of the tools, they remain vendor-reported metrics pending independent verification from active health systems.

The engineering team leveraged Strands Agents with Amazon Bedrock and hosted the application via Amazon Bedrock AgentCore Runtime. AgentCore Gateway exposed more than 10 ControlCheck APIs as MCP tools, enabling the agent to discover and call them dynamically during user requests.

Crucially, Bluesight avoided direct database access for the language model. Engineers wrapped existing ControlCheck API endpoints in AWS Lambda functions that return structured data optimised for agent processing, keeping business logic inside the application layer while the agent handled question interpretation, tool selection, record retrieval, and result presentation.

⚡ Performance improvement: Query latency dropped from 5 minutes to 10 seconds following this architectural design.

The deployment also included a frontend with chart generation, observability controls, cost attribution, encryption, authentication, and infrastructure-as-code. Bluesight deployed the service within a virtual private cloud and reached general availability in under nine months.

💬 "This is exactly what diversion program leaders have been waiting for — it gets them to answers faster and takes the manual grind out of every investigation."
— Samir Neyazi, Director of Product Management, Bluesight

Multi-Agent Architecture Targets 340B GPO Compliance

Federal 340B rules prohibit Disproportionate Share, Children's, and Free-Standing Cancer hospitals from purchasing outpatient drugs through GPO contracts when non-GPO channels are available. Compliance teams must document exceptions when supply conditions prevent an alternative purchase route.

Bluesight's planned GPO agent integrates data from three products: CostCheck (purchase information), ShortageCheck (drug availability evidence), and 340BCheck (eligibility validation).

The proposed architecture uses Anthropic Claude Sonnet 4.6 as the primary model and Claude Haiku 4.5 for lower-latency operations through Amazon Bedrock. A coordinating GPO agent directs specialist data workers — one retrieving purchase records, another gathering supply evidence, and a third checking 340B eligibility — before assembling an audit-oriented report.

A second AWS acceleration engagement in March 2026 focused on this architecture. AWS reports the team connected the system within the first day and completed all planned features by day two.

🧪 Synthetic test results: 100% invoice discovery rate and 93% evidence justification accuracy — exceeding the 85% target threshold.

⚠️ Important caveat: These figures do not represent production performance across hospital customers. Synthetic testing validates logic against prepared scenarios but cannot account for local data gaps, delayed shortage updates, unusual drug identifiers, or disputed purchasing cases.

Compliance Scoring Kept Outside the Language Model

Bluesight assigns the language model a deliberate and constrained role. The model gathers records, calls product tools, and drafts explanations — but a deterministic scoring service handles all compliance determinations.

That scoring service evaluates 13 evidence inputs, applies priority-based matching, and uses configurable time windows. This gives compliance teams a repeatable, auditable scoring process — rather than an LLM-generated judgment — and allows auditors to inspect source records, the rules applied, and the sequence of tool calls behind each determination.

🏥 Critical reminder: Hospital pharmacy, legal, and compliance teams must retain full ownership of all policy settings. Supplier shortage thresholds, acceptable inventory periods, and purchase-date windows can all alter a compliance outcome. Each organisation must independently set and approve its own policy rules.

HIPAA Controls and Audit Trails Underpin the Deployment

Amazon Bedrock holds HIPAA eligibility, and Bluesight operates under a Business Associate Agreement with AWS. AWS states it does not train foundation models on customer data processed through Amazon Bedrock.

Security controls in place include:

• 🔐 Amazon Cognito — OAuth2 client-credential authentication and JSON Web Token validation
• 🔒 AWS Key Management Service — encryption of data at rest and in transit
• 🗝️ AWS Secrets Manager — credential management for downstream services
• 📊 Amazon CloudWatch — full logging of agent decisions, tool invocations, data-access events, alarms, and performance metrics
• 🧱 AgentCore Runtime — session isolation for concurrent customer requests

That audit trail is essential when a hospital must explain why it permitted a GPO purchase or escalated a drug-diversion pattern.

Reported Performance Gains Across 20 Health Systems

Bluesight's internal measurements across its 20 active health systems report the following improvements in ControlCheck workflows:

• 📈 Up to 97% faster report generation and analysis
• ⏱️ Recurring reports: from ~6 hours to 15 minutes — a 96% reduction
• 🔍 Pre-investigation triage: from 3 hours to ~10 minutes
• 📋 Controlled-substance variance analysis: from 30 minutes to under 1 minute

🚨 Guidance for enterprise buyers: Teams should run historical purchasing cases in parallel with existing review processes before allowing agent-assisted results to influence compliance decisions. Local testing must rigorously examine data completeness, drug-code matching, shortage timing, exception rules, and cases where human reviewers previously disagreed. Each production finding should retain the scoring-rule version, source evidence, and tool trace that produced it.

Further information on Amazon Bedrock and AgentCore Runtime is available via AWS official documentation. Details on 340B program compliance requirements can be found through the Health Resources & Services Administration.