Downtime is a clinical event.
Hospital networks, clinic groups and diagnostic providers buy technology for a building that never closes. The systems that schedule a patient, identify a patient and record what was done to a patient are in use at three in the morning, and every one of them holds information the law treats as the most sensitive a person has. Altuon builds for the ward and the privacy officer at the same time, from the first architecture review.
Che cosa è in gioco
The regulation is written around the patient, and it is enforced. In the United States, the HIPAA Privacy Rule decides which uses and disclosures of protected health information are permitted, what the minimum necessary standard means for each of them, and which rights the patient keeps over the record; the Security Rule requires administrative, physical and technical safeguards for that information in electronic form, beginning with a risk analysis the covered entity can produce on request; and any firm that touches the information on the provider's behalf is a business associate, bound by a written agreement and directly liable under the rules. In Switzerland, the revised Federal Act on Data Protection names health data as sensitive personal data, with the stricter consent, impact-assessment and disclosure duties that follow, and the electronic patient record framework sets out how a record moves between providers through recognised communities, with the patient deciding who may open it. In the European Union, the GDPR treats health data as a special category: processing is prohibited unless a specific condition applies, and the condition for care itself rests on professional secrecy. In Jordan, the Personal Data Protection Law classes health data as sensitive and requires explicit consent and heightened protection for it. A vendor that cannot describe its work in these terms will not get past the privacy officer, and should not.
The systems are old, they are joined to everything, and none of them can be switched off. The scheduling engine, the master patient index and the records core were often installed before the current law existed, and they are held together by interface feeds to the laboratory, the pharmacy, radiology, billing and a dozen departmental systems that each assume the core will answer. A migration cannot borrow a weekend, because the emergency department does not have one. Every hour a ward spends on paper downtime procedures is a reconciliation debt and a safety exposure, and a patient identity that is duplicated or merged wrongly during a cut-over is not a data-quality issue but a wrong-patient risk. The compatibility layer, the dual-running, the identity reconciliation and the rehearsed rollback are the migration; the rest is configuration.
The buyer is a committee that includes clinicians. The chief medical information officer wants documentation intelligence that saves clinician time without deciding anything a clinician should decide. The chief information officer wants an integration and scheduling architecture that will still be defensible when the next records platform arrives. The privacy officer, or the data protection officer, wants the business associate or processing agreement, the residency commitment, the sub-processor list and the breach-notification terms. The head of patient access wants a telephone line that fills the diary, reminds patients and routes the urgent call to a nurse without ever offering an opinion on a symptom. Procurement wants the exit terms. A proposal that speaks to the technologists and not to the clinicians does not reach the medical executive.
Failure reaches the patient. A voice agent that reassures a caller it should have escalated, a documentation model that codes a diagnosis the clinician did not make, a migration that leaves an appointment in one system and not in the other, a marketing tag that sends an appointment page to an advertising platform: each is a reportable event and a harm before it is a business problem. The work is designed so that the failure mode is a handover to a person, a blocked release, a rollback or a refusal, and never a patient who was treated on the wrong information.
Discipline applicabili
- Ingegneria del softwareDistintivo, dove Altuon guidaScheduling, patient-index and records platforms migrated while the hospital keeps running: one interface consumer at a time behind a compatibility layer, patient identities reconciled and reviewed before any record moves, dual-running with reconciliation until the numbers match, a rehearsed rollback, and protected health information kept inside the boundaries HIPAA and its Swiss, European and Jordanian counterparts draw.
- Intelligenza artificialeCentraleClinical documentation, coding and scheduling intelligence with a clinician deciding: models that draft the note, propose the code and suggest the slot, each with an owner, an evaluation set scored by clinicians on the provider's own cases, a monitored baseline and a rollback version, deployed inside the provider's data plane and recorded in a register the medical executive and the privacy officer can both read.
- Agenti vocaliCentraleAppointment scheduling, rescheduling and reminders by telephone, with triage routing that recognises the words that mean a nurse must take the call now, verifies the caller to the level the request requires, never offers clinical advice, and hands over to a person with the whole context of the call, in German, French, Italian, English and Arabic.
- Consulenza tecnologicaCentraleScheduling, records and integration strategy for hospital networks, written as evidence: the obligation register, the transition states of every core system, the interface inventory, the residency decision per data store and the exit terms of every arrangement, governed by the case the board and the medical executive approved together.
- Pubblicità e crescitaDi supportoProvider and service advertising designed under health-privacy constraints before the first campaign: no protected health information used for marketing without the authorisation the law requires, no tracking technology on pages where a patient is identified or an appointment is made, audiences built from consented first-party data or from context, and every claim about a service approved by the people responsible for it.
Note regionali
- Europa e DACH
- Swiss providers operate under cantonal health responsibilities, the revised FADP's treatment of health data as sensitive, and an electronic patient record framework in which the patient controls access and the provider must connect through a recognised community. The data plane is Swiss unless there is a written reason for it not to be; the interface strategy is designed around the record framework rather than beside it; and the sub-processor list is short enough to be read at a single meeting. German, French and Italian are working languages on the wards and on the telephone line. German and Austrian providers operate under the GDPR, national health-data provisions and the professional secrecy of the medical profession, and buy the same discretion and longevity.
- Medio Oriente e Nord Africa
- Providers in Jordan and the Gulf are building capacity at speed under the Personal Data Protection Law's classification of health data as sensitive and under health authorities that expect the record to stay in the country. Patients arrive from across the region, so the voice line has to understand Arabic dialects as well as English and route a caller who is frightened in either. Sovereignty shapes the architecture: in-country hosting, models the provider can inspect, and a partner present in the hospital rather than on a call. A relationship with the medical leadership is part of the mandate, not a preliminary to it.
- Nord America
- US providers buy velocity under HIPAA, under state health-privacy laws that reach further than the federal floor, and under federal information-blocking rules that require patient data to move through standard interfaces when a patient or another provider asks for it. The Office for Civil Rights investigates complaints and breaches, so the risk analysis, the business associate chain and the audit logs have to exist before anyone asks. Outcomes are measured in appointments kept, minutes returned to clinicians and interfaces retired, and the documentary trail has to move as fast as the work.
Regioni servite
Europa e DACH
Sede legale
Torino, Italia
Incarico rappresentativo
- Ingegneria9 settembre 2026Migrating legacy core systems without stopping the businessThe big-bang cut-over is how core migrations fail. The alternative is slower, less dramatic and works: a compatibility layer, one consumer at a time, and a rollback path that is rehearsed rather than hoped for.
- Acquisti9 settembre 2026Procurement's questions about AI vendors, answeredWho owns the model weights? Where is the training data? What happens to our prompts? Can we leave? The questions procurement teams ask AI vendors are the right ones. Here are the answers a serious firm should be able to give, and the ones that should end the conversation.
Le domande che ci vengono poste
Will you sign a business associate agreement, and who are your sub-processors?
Yes, and its European and Swiss equivalents: a data processing agreement under the GDPR and the revised FADP, with health data named as the sensitive category it is, and the corresponding terms under Jordan's Personal Data Protection Law. The agreement sets out the permitted uses of protected health information, the safeguards, the breach-notification timeline and the return or destruction of data at exit. The proposal lists every third party that could touch that information — hosting, telephony, speech and language model providers, observability tooling — by name, role and location. Each is approved by the provider before use and changes are notified in advance with the right to object, and each is bound downstream by terms no weaker than the ones the provider signed with us.
Can protected health information stay in our data centre, in Switzerland or in Jordan?
Yes. The data plane is decided per system in the Define phase and recorded in the architecture register: the provider's own premises, a Swiss region, the European Union, an in-country cloud in Jordan or the Gulf, or the United States. Speech, language and documentation models run inside that plane; the control plane carries policy, identity and metrics and never carries patient data. For an on-premises deployment the proposal states what the provider supplies — hardware, network, identity, the interface engine — and which model options fit that footprint, so that residency is costed rather than promised.
How do you migrate a scheduling or records core without stopping the hospital?
By never asking the hospital to stop. A compatibility layer sits in front of the old core so that every interface consumer keeps working while it is moved, one consumer at a time, in an order agreed with the clinical departments that depend on it. Patient identities are reconciled before any record moves, with candidate duplicates and merges reviewed by the provider's own health-information staff rather than resolved by a rule. The old and new systems run in parallel with reconciliation until the numbers match for an agreed period, the rollback is rehearsed before each cut-over, and the paper downtime procedure is updated and drilled rather than assumed. Availability and response commitments for the systems we operate are written into the agreement, with the maintenance windows agreed with the clinical directorates, not with the IT calendar.
How is a voice agent kept from giving clinical advice, and what happens to an urgent call?
The agent's permitted actions are written outside the language model: it may book, move, confirm and cancel appointments within the rules the provider sets, remind a patient of an appointment and read back preparation instructions the provider has approved, and nothing else. Triage routing is not diagnosis. The words and situations that require a nurse or the emergency number are defined with the provider's clinical governance function, versioned like code and tested on every release, and when one is detected the agent stops, says so plainly and hands over to a person or gives the emergency number. It cannot be argued into an opinion on a symptom, and adversarial testing for exactly that attempt is part of every release gate. Every handover carries the full context of the call so the patient does not repeat it.
For documentation and coding, who decides, who is liable, and who owns the evidence?
The clinician decides, every time. A documentation model drafts the note and a coding model proposes the codes, and neither is entered into the record until a named clinician has reviewed and signed it. The provider's evaluation set, built from its own cases and scored by its own clinicians, belongs to the provider, as does the model register, the monitoring evidence and any prompt, configuration and integration code written for the engagement; intellectual property is assigned on payment. Liability for the system's conduct is written into the agreement with a cap that reflects the work, backed by professional indemnity and cyber insurance whose certificates procurement receives, and it does not extend to a clinical decision a clinician has signed, because the design leaves that decision with the clinician.
What are the exit terms, and how do you manage key-person risk?
Exit is designed in the Discover phase, not negotiated at the end. The agreement sets a notice period, a transition period in which we continue to operate and hand over, the return or verified destruction of protected health information in an agreed format, and the delivery of the code, configuration, models and documentation the provider owns. Nothing we build depends on a licence to a proprietary Altuon component that the provider cannot replace. Every engagement has a named engagement director and a named deputy, the design decisions are written in the architecture register rather than held in anyone's head, and the provider's own engineers and health-information staff work alongside ours from the first phase so that the knowledge stays in the hospital when we leave.
Bring us the system that cannot go down.
Whether it is a scheduling core, a records migration, a documentation model or the telephone line patients call first, the Discover phase begins with your obligations and ends with a register your privacy officer and your medical executive can both sign. Request a proposal, or book a briefing for the executives who will be asked to.