Healthcare AI is flying blind. Introducing Aggi ARIA (Aggi Responsible Intelligence Assessor), a continuous AI compliance platform for healthcare organizations deploying large language models (LLMs) in clinical environments.
A grant that died in 2007
In 2007, a Veterans Administration research grant worth $80 million was cancelled.
The science had not failed, and the funding had not dried up. The participating institutions, brilliant researchers at world-class medical centers, could not share patient context data in a way that was at once secure, HIPAA-compliant and ethically defensible.
The technology to do it existed. The governance framework to do it safely did not.
The VA walked away, and Gulf War veterans waiting for answers about their health waited longer.
I was there, as part of the team at UT Southwestern Medical Center trying to build that platform. When the grant was cancelled, I filed away a lesson that has taken nearly twenty years to fully surface.
Islands of LLMs
Sridhar Yerramreddy, CEO of Steer Health and a respected voice in healthcare AI, describes a pattern he calls the "Islands of LLMs."
Dozens of AI tools are deployed across a health system. Each one is evaluated and procured independently, and each one operates in isolation. Nobody has a unified view of what data they touch, what risks they carry, or what happens when one of them fails.
It is the same fragmentation problem that ended the Gulf War Syndrome research in 2007: the same category of mistake, with a different technology, twenty years later.
The difference today is scale and speed. In 2007 the fragmentation involved a handful of research institutions and one disagreement over a database protocol. In 2026 a mid-sized health system may be running 30, 50 or 100 AI tools, including clinical scribes, triage assistants, diagnostic support, patient communication bots and revenue cycle automation. Few of them are governed by a unified framework, and many were never formally assessed for safety, bias or regulatory compliance before deployment.
The numbers are not reassuring. Grant Thornton's 2026 AI Impact Survey found that 78% of business leaders lack full confidence their organization could pass an independent AI governance audit within 90 days. IBM's 2025 Cost of a Data Breach Report found that one in five organizations studied had a breach involving shadow AI, meaning AI tools used without the organization's approval, and that high levels of shadow AI added about $670,000 to the cost of a breach.
In clinical environments, an erroneous outcome is a patient safety event rather than a budget line.
The risks nobody is assessing
When I ask healthcare organizations about their LLM governance, I hear variations of the same three answers.
"We have RBAC." Role-based access control at the database layer does not protect against prompt injection at the LLM layer. A carefully worded request to a clinical scribe system can surface records it was never authorized to show, without touching the database directly. RBAC alone is not an AI security strategy.
"Our vendor handles compliance." Your vendor's Business Associate Agreement (BAA) is a legal instrument, not a technical safeguard. It does not check whether your vendor's model is hallucinating medication doses, drifting from its validated baseline, or processing protected health information (PHI) in ways your contract does not cover. Have you tested it?
"We validated it before deployment." That was once, on clean data, before the vendor updated the model. Clinical AI validation has to be a continuous process. Every vendor model update is effectively a new deployment that needs re-validation, and most organizations do not know when their vendor's model has changed.
These gaps are real, and I have seen them in clinical AI deployments. General HIPAA guidance, NIST AI RMF documentation and general-purpose governance, risk and compliance (GRC) platforms are not built to catch them.
What the market offers, and why the gap remains
The AI governance market is moving fast. Platforms like Credo AI, Holistic AI and Microsoft Purview are building capable products. VerifyWise has built an impressive open-source framework, and IBM OpenPages has decades of GRC credibility.
Most of them are built for general enterprise governance rather than clinical environments. They tend not to raise the FDA Clinical Decision Support (CDS) classification question, which may be the most consequential regulatory determination a healthcare AI startup faces, because getting it wrong can mean deploying an uncleared medical device. They tend not to model the dependency between a clinical scribe's PHI logging and a BAA that may not cover that logging. They also tend not to combine a HIPAA assessment with the NIST AI RMF functions (Govern, Map, Measure and Manage) in one workflow.
General-purpose platforms also tend to start at six figures a year, take months to implement, and arrive with frameworks designed for financial services or manufacturing, which healthcare organizations then spend more months and more money adapting.
A Series A healthcare AI startup cannot afford that, and it cannot afford to go without a governance posture either.
Introducing Aggi ARIA
This week, Aggi Technologies LLC is launching Aggi ARIA (Aggi Responsible Intelligence Assessor), a modular, data-driven AI governance and compliance platform for healthcare organizations deploying LLMs in clinical and administrative workflows.
At its core is an assessment engine, with three design choices that I think set it apart for clinical use.
1. A question bank calibrated for healthcare, across several frameworks. Aggi ARIA's questions cover the NIST AI RMF, HIPAA Security and Privacy, and ISO/IEC 42001, with FDA Clinical Decision Support questions alongside. A plain-English intake questionnaire feeds its answers into all three frameworks automatically, and cross-standard mapping lets a single answer flow into related controls in other frameworks, held for a person to confirm.
Every question is written for clinical context. Instead of "do you have a governance policy," Aggi ARIA asks whether your AI governance policy defines acceptable and unacceptable uses specifically for patient-facing versus clinician-facing LLM tools. Instead of "have you assessed bias," it asks whether your bias audit used a dataset representative of the patient population this system actually serves, including age, race, language and socioeconomic status.
The specificity is the point. Generic questions produce generic answers that miss the gaps that matter in a clinical deployment.
2. A dependency graph, because compliance gaps are connected. Aggi ARIA maps the relationships between gaps. If your organization answers "no" to whether a BAA has been signed with your LLM vendor, Aggi ARIA flags every downstream exposure as well: the PHI flowing to that vendor without authorization, the audit trail gaps that follow, and the incident response gaps that cascade from there. Healthcare AI compliance is a system, and Aggi ARIA shows the system.
3. Conditional logic, where critical questions act as gates. Some questions do more than produce findings. If an organization says its LLM outputs enter the electronic health record (EHR) automatically without human review, Aggi ARIA flags it as a critical patient safety risk, raises it in the leadership report, and links it to the FDA guidance and HIPAA provisions that apply. If an organization is unsure whether its system counts as a Clinical Decision Support device, Aggi ARIA opens the FDA CDS module and records a critical finding, because deploying a regulated medical device without FDA clearance is a federal violation rather than a paperwork gap.
Where we are, and where we are going
Aggi ARIA is live and available now at aria.aggicorp.com.
The platform is built in deliberate layers, and the foundation is running: a multi-framework assessment engine with cross-standard propagation, evidence management, conditional logic, remediation tracking and audit-ready PDF export. Dependency graph visualization, reports for different audiences, executive dashboards and a maturity progress view are live. An analytics layer tracks each organization's posture over time, scores audit readiness and flags contradictions across its assessments. For practitioners who would rather upload a policy document than answer every question by hand, an LLM-assisted ingestion pipeline scans for personal data first, logs every prompt and response, and requires a person to approve any extracted answer. The FDA CDS questions are still in draft and need expert review before production use.
Pricing is built for a market that exists but is underserved. It does not start at six figures, it does not need a six-month implementation, and it is not a governance framework designed for someone else's industry.
Why this matters now
Enterprise healthcare customers now include AI governance questions in their procurement requirements, and the organizations buying healthcare AI tools are starting to ask vendors the questions Aggi ARIA is designed to help answer. FDA guidance on AI-enabled medical devices continues to develop. When we launched, the EU AI Act's high-risk provisions were due to apply in August 2026; in June the EU moved them to December 2027 for most systems and to August 2028 for AI built into regulated products such as medical devices.
The governance infrastructure that should have come with the LLM deployment wave did not arrive with it. Aggi ARIA is part of closing that gap.
I spent nineteen years building toward a platform that could have prevented what happened in 2007, when a VA grant died because the data could not be governed correctly and the Gulf War veterans' research went unfunded because the institutions could not get their infrastructure right.
We are not going to repeat that mistake.
Responsible AI, Verified.
Dr. Prasad N. Golla, Ph.D., MBA, is the founder of Aggi Technologies LLC. He conceived and architected Aggi ARIA. prasad@aggicorp.com · aggicorp.com
Aggi Technologies LLC helps regulated organizations govern AI behavior with Aggi ARIA and the Aggi ARIA AI Health Check (ARIA Shape B). Talk to us →