Who Miso is for

The multi-hospital system

Six to forty hospitals, hundreds of clinics, one privacy office and one security office for all of them.

What AI looks like thereThirty to sixty AI applications in flight, two-thirds of them from vendors: ambient scribes in several service lines, a revenue-cycle vendor with a model behind it, imaging tools with a language model in the latest release, and internal teams on two or three cloud providers.

Where the reviews pile upThe same scribe vendor is reviewed by three regions. Each new site brings its own instance and its own key. Privacy signs off on data flows it never sees again, and the inventory is rebuilt by hand before every board meeting.

What the bill looks likeConsumption pricing on the EHR's AI features after a discounted first year, five vendor invoices on five different units, and two cloud bills that mix AI with everything else. Finance sees the total in the month after it was spent.

The first routesOne route per vendor with a pinned model, shared across every site that uses it. Internal routes for discharge summaries, prior-authorization drafting, and patient-message replies, each with its own candidate set and identifier rule.

The academic medical center

A hospital, a medical school, and research groups that want models today.

What AI looks like thereResidents and faculty with provider keys obtained on a credit card. IRB-approved studies that need de-identified data at scale. A clinical informatics team building copilots, and vendors arriving through the affiliated practice plan.

Where the reviews pile upInnovation asks are the backlog. Security says no to the sandbox because there is no way to say yes safely; the study team waits a quarter for a data-use answer; nobody knows which keys exist.

What the bill looks likeProvider keys on department cards and grant budgets, a hospital cloud account with no per-lab split, and one flagship model contract negotiated centrally that half the building routes around.

The first routesA research route with de-identified data only and a budget per lab. A sandbox route with synthetic data and no retention. A clinical route with PHI, candidate models, and a comparison the committee approves before any version moves.

The large physician group

Two hundred to two thousand clinicians across specialties, physician-owned or PE-backed, thin central IT.

What AI looks like thereAmbient documentation everywhere, a phone and scheduling agent, a coding assistant, and a payer-facing vendor or two. Nearly all of it from vendors; the group builds little itself.

Where the reviews pile upA compliance officer and an IT director carry every review. Vendor contracts arrive with the vendor's own downstream terms, and the group has no leverage over which model the vendor uses or where its data goes.

What the bill looks likeAmbient documentation at a per-clinician list price, with a pay-as-you-go tier the vendor is steering toward. The group has no view of what each vendor's model use costs the vendor, and so no leverage on renewal.

The first routesVendor routes first: every vendor on a pinned model under the group's own provider agreement, with the record the group holds. Then one internal route for staff drafting with no patient data, so the consumer chat tools can be turned off.

The payer-provider

A health plan that also runs clinics or hospitals, with two regulatory postures in one organization.

What AI looks like thereUtilization management and appeals on the plan side, clinical documentation on the delivery side, and member-facing agents that touch both. Data classes differ by line of business and the same vendor may serve both.

Where the reviews pile upPurpose is the hard question. The same model call is permissible for one purpose and prohibited for another, and state rules on automated coverage decisions apply to some requests and not others.

What the bill looks likeTwo AI budgets in one organization, plan and delivery, with vendors that serve both and bill once. The question at renewal is which line of business consumed what.

The first routesRoutes keyed on purpose before anything else: utilization review, appeals drafting, clinical documentation, member service, each with the data class and the state obligations it carries and a record that names which one applied.

The people inside, and what changes for each.

Five seats carry a piece of the AI question by hand today. Vendors are the sixth, on their own page.

Builders

TodayFind out which provider is allowed, get credentials, handle PHI correctly, wait for approval, then integrate against provider-specific APIs. The desired experience is one sentence: give me the endpoint and tell me what models I can call.

One key to every approved modelThe provider agreements are already in place when you start.
The provider registry
A sandbox today, a route this weekRequest a route from the console; Privacy approves it with the validator's findings in front of them.
The prototype
A budget you can seeSpend against ceiling by application and by route, and denials with reasons.
The builder view
A comparison when a version changesOld and new on your own samples. You propose; Privacy approves.
The upgrade

The CISO

TodayEach AI vendor or application adds another data path, credential set, provider relationship, and control surface. Every one of them is secured separately.

Review the shared AI path onceApplications and vendors reuse it. A model change is a policy edit.
The backlog
Unregistered AI traffic is refused and loggedA key that matches no entry gets a denial and a row in the record.
The caller registry
Runs in your VPCThe gateway, the policy, the credentials, and the records are in your account.
Security & deployment

The privacy officer

TodayDeciding, again and again, whether a particular application may send particular data to a particular model, and then relying on the application team to do it correctly.

Identifiers replaced per route, before sendingThe record shows which identifier types were found and what was done with each.
The record
A queue with the evidence attachedRoute requests arrive with the validator's findings. Approve, approve with an edit, or ask.
Yes in a week
An answer for the inquirySix years of records by patient, caller, route, and date.
The inquiry
Every obligation has a named ownerWhat Miso enforces and what each caller attests to, with the state overlays.
State overlays

The CIO and the board

TodayAI is proliferating across departments with no coherent architecture. The inventory is a spreadsheet updated before board meetings, and open access for internal teams has no ceiling.

One set of provider agreementsNegotiated once. Every application and vendor works under them.
The provider registry
Open access with a ceilingBudgets by team and by route.
Routes
An inventory from trafficFor everything routed through Miso, one page answers what AI is running here.
The board page
The chain for the big dealWhich agreement covers which route, before signature.
The deal

The CFO and the CEO

TodayAI arrives on invoices priced by the seat, the encounter, and now the token: the EHR vendor's AI features after a discounted first year, each AI vendor on its own terms, and cloud bills that mix model calls with everything else. The number is known after the month closes, and nobody was in a position to say yes or no to it while it was being spent.

A budget enforced before the callBy application, department, and route. A request that would pass its ceiling is refused and recorded.
AI spend
Next month's number this monthA forecast from the record, by department, with the lever behind each change.
The forecast
One view of the AI billEverything behind the endpoint enforced; the EHR's own AI usage observed beside it.
Enforced and observed
Vendors inside a ceiling you setEach vendor's AI runs under your agreements and its own budget.
AI vendors