Product · Built by Fullspec Studio · 2026

HIPAA-aware intake assistant

A voice intake assistant for recovery and behavioral-health clinics that answers after-hours calls inside a HIPAA-eligible AWS boundary — with a crisis path that never waits on the model, staff alerts that carry a link instead of patient details, and every clinic deployed as code.

Project shape
Systems Design 24%Infra 20%DevOps 10%Data 8%AI 16%Backend 17%Frontend 5%
Leading
Systems Design24%Infra20%Backend17%
Minimalist coral line art on paper: a ringing phone under a crescent moon connects into a dashed protected boundary holding a speech bubble, a keyhole shield, and a locked database, with three paths leaving it to a calendar with a check mark, a phone showing only a link, and a heart held in an open hand, and the brand spectrum strip along the base.

The problem

The person who calls a recovery clinic at 2am is often the one whose window is closing, and most clinics send that call to voicemail. An AI assistant can answer it, but in healthcare the conversation is the easy part. Patient data has to stay inside a covered boundary from the first word, the assistant can't diagnose or promise a bed, and a caller in crisis has to reach a person, not a model.

What we built

A voice intake assistant, written in TypeScript and defined entirely as AWS infrastructure code, so each clinic gets its own isolated, repeatable deployment.

  • Calls in, callbacks out. Amazon Connect answers, Amazon Lex handles speech, and a Lambda orchestrator runs a scripted conversation with Claude on Amazon Bedrock. The goal is a confirmed callback, not intake: a first name, a callback number, a rough sense of the need, and a good time to call.
  • A crisis path that doesn't depend on the AI. A fixed phrase check runs before every model call. Medical emergencies get told to call 911. Behavioral crises transfer to the clinic's on-call roster, with 988 as the fallback if the transfer fails. If the orchestrator is down, the call flow falls back to a fixed safety menu.
  • Guardrails as versioned policy. Bedrock Guardrails block medical advice, diagnosis, bed availability, cost and insurance, and admission promises, checked on every reply.
  • Patient data stays inside. Records live in DynamoDB under a clinic-controlled KMS key, with expiry and recovery. Staff alerts go out as SMS carrying only a link. The staff inbox sits behind login with MFA and shows a callback number only after staff acknowledge the caller's instructions. The audit trail deliberately leaves patient data out, and a check plants a synthetic name in test traffic to prove it never shows up in logs.
  • Tested like it matters. More than 800 passing tests, including a crisis check at every stage of the conversation, 11 scripted-caller scenarios from overdose to wrong number, and a 20-case guardrail regression suite set to run daily once deployed.

Status

Built and tested offline with synthetic data and a fictional demo clinic, and not yet deployed. The next steps are a demo line, a tabletop review with clinicians, and a pilot, with BAAs signed before any real patient data flows.

Work

Have a system that needs this level of attention?

See how we evaluate a new engagement.

Start a conversation