Case Study 02 · Vitalief · Clinical research, United States

AI is already running inside your operation. Can you prove what it did?

Not whether it works — whether you can show a sponsor who approved it, which version produced the output, and that the record hasn't been touched since. Vitalief came to us with expert work that only one person could run. We built the platform that let the whole firm run it, under signatures, sanitized for PII and PHI, and written to a record nobody can delete. Including us.

Governance

2 signatures

A technical reviewer and the methodology owner both sign the exact version before release. Change the version, sign again.

Compliance

100% immutable

Every audit record is append-only at the storage layer. No administrator, operator or database credential can alter or remove an entry.

Privacy

100% sanitized

PII and PHI are stripped from every log write, alert and error trace. Live today, on every write.

Scalability

75%

Efficiency improvement across the consultancy's expert workflows.

The opportunity

The capability already existed. It just couldn't travel.

This didn't start as a governance project. It started because a senior practitioner at Vitalief had already built something genuinely good — AI workflows that read study protocols and produced analysis that would otherwise take a specialist days. The problem wasn't the work. The problem was that he was the only person who could run it.

Handing it to a colleague meant handing over files, setup and a level of technical fluency most of the firm didn't have. So the fastest path was always the same one: he ran it himself and sent back the output. The capability was real and the bottleneck was a calendar.

Let colleagues run expert workflows directly, without technical setup or hand-holding.
Make every run attributable — who, when, which version, what came out.
Meet HIPAA and 21 CFR Part 11 obligations structurally, before patient data arrives rather than after.
Build it so the same platform can carry other expert work, not just this one workflow.

Client: Vitalief — a US-based clinical research consultancy
Scope: Firm-wide expert workflows across the client engagement portfolio
Environment: Managed cloud, BAA-grade hosting, encryption at rest and in transit
Engagement: Phase 1 — platform build, approximately one month. Phase 2 — ongoing partnership, in production.

Our approach

Four commitments, settled before any code was written.

Governance

Every workflow is versioned and carries a named human signature. Nothing runs from an untracked file, and nothing reaches a user unsigned.

Compliance

HIPAA safeguards and 21 CFR Part 11 electronic-records controls mapped to specific system behaviour — clause to control, not policy to intention.

Privacy

PII and PHI are removed before anything is written to a log, alert or error trace. Patient data does not leak through the plumbing.

Scalability

Expert judgment encoded once and executed consistently by everyone — without flattening it into generic software that no longer reflects how the expert actually works.

The problem

Every operation has one person everyone waits on.

Regulatory submissions. Budget and contract negotiation. Protocol feasibility. Coordinator training. Somewhere in your organization there is work that only two or three people do properly, and everything that needs it queues behind them.

AI is the obvious answer, and plenty of teams have already reached for it. That's where the second problem starts. Once expert work runs through a model, the questions change: which version produced this, who approved it, what did it see, and can you show that the answer hasn't been edited since. Most teams adopting AI in regulated operations cannot answer those questions — not because the work is bad, but because nothing was built to record it.

The bottleneck is a person.

Work that depends on one specialist's judgment moves at that specialist's pace. Adding demand doesn't add capacity.

Nothing carries a version.

A prompt gets tweaked, a file gets copied, a workflow gets adapted for the next study. Months later nobody can say which variant produced a given deliverable, or whether it was the approved one.

Nobody signed anything.

The output looks right and goes out. When a sponsor asks who reviewed it, the answer is a name recalled from memory rather than a signature bound to a version.

The record is a reconstruction.

The audit answer gets assembled from email threads and shared drives after the fact. That is a story about what happened, not evidence of it.

What we built

A platform where expert work runs under signature and leaves a record.

Expert workflows, registered and versioned

Each workflow is registered with an owner, a version history and a lifecycle state — draft, internal, ready for use, retired. Promotion between states is deliberate and recorded. There is always exactly one current version, and it is always knowable which version produced which output.

Two-key certification before anything is released

A workflow becomes usable only when two people sign it: a technical reviewer confirming it runs correctly and handles edge cases, and the methodology owner confirming the output meets the firm's standard. Both signatures are bound to that specific version. Publish a new version and both are required again.

This is the direct answer to the accountability question. Not we reviewed our AI, but this named person approved this exact version, and the moment it changed they approved it again.

Privacy enforced in the path, not in policy

PII and PHI are stripped before any log write, alert or error report leaves the system. That sanitization is a live code path today, running on every write — built in from the first commit rather than retrofitted ahead of an audit.

Vitalief's current workflows operate on study documentation rather than patient records. The safeguards went in anyway, because the workflows that will carry patient-level data are coming, and a platform that has to change shape to receive PHI is a platform that wasn't ready for it.

A record that cannot be altered by anyone, including us

Every run is logged with timestamp, user, engagement, client, workflow and version. The log is append-only at the storage layer — there is no delete path, and no administrator, operator or database credential can remove an entry.

That distinction is the whole point. Most audit trails mean the interface doesn't offer a delete button, which is a design decision one deployment away from being untrue. Nobody worries the client will edit the log. They worry the vendor can.

Before & after

Guardrails

The platform executes certified expert workflows. It does not invent them.
A named human signs before release, and signs again on every version.
No identifier reaches a log until it has been sanitized. Before the write, not after the incident.

In production

The hardest thing we could have put through it.

The workflow now running on the platform takes a study protocol in at one end and produces a Medicare coverage determination at the other, through a sequence of certified stages, each consuming the output of the last. Work of this kind conventionally takes a specialist days, and getting it wrong isn't a quality problem — it has billing consequences.

We name it because it's the proof, not the product. A platform that can carry work that regulated, under signature and against an immutable record, can carry regulatory submissions, feasibility analysis or budget work just as safely. The sequence extends further downstream as new stages are certified into it.

Authoring

Experts build and revise workflows against live work
Full version history, with prior versions retained and retrievable
Access scoped by engagement, so teams see their own portfolio

Running

Colleagues run certified workflows themselves, no technical setup
Documents in, finished deliverables out in the firm's own brand standards
Runs execute against the registered version — no local variants, no drift

Record

Complete invocation history, append-only and queryable
Electronic signatures bound immutably to the certified version
PII and PHI safeguards enforced platform-wide, not feature by feature

Impact

The person everyone waited on is out of the loop.

The practitioner who built these workflows no longer runs them. Colleagues across the firm run them directly, and have done since the platform went live. The expertise didn't move into someone else's head — it moved into software that anyone on the engagement can invoke, under signatures, against a record.

That is the outcome that matters. The firm's capability is no longer paced by one person's availability, and every output it produces can be traced to a version, a signature and a moment in time.

~1 month

Phase 1 build to a working platform in production.

1 → firm-wide

Workflows that one practitioner used to run personally now run across the firm.

3 live, 2 in build

Certified expert workflows in production, with the library still extending.

Zero setup

Colleagues run certified workflows with no install, no files and no technical fluency required.

Before

Expert workflows that only their author could operate. Colleagues waiting on his calendar, or receiving outputs he had produced himself. No version history, no signature, no record of what produced what.

After

Workflows registered, versioned and certified under two signatures. Anyone on the engagement runs them directly. Every run logged immutably, every identifier sanitized before it reaches a log.

Ongoing

The build partnership continues as an authoring partnership — new expert workflows certified into the platform as they are developed, existing ones refined against live use. Formal computer-system validation is the next milestone on the compliance roadmap; the Part 11 controls it will validate are already in place and running.

Take it with you

Take it into a governance review.

The full write-up covers the governance model, the HIPAA and Part 11 control mapping, and the architecture behind the audit record. Useful if you need to bring it to a compliance or operations review.

Questions first? contact@matechnologies.net

Full case study

Governed AI for clinical operations

Enter your work email and we'll send the complete write-up — the governance model, the HIPAA and Part 11 control mapping, and the architecture behind the audit record.

Running AI on protocols or patient data without a record underneath it?

Governed AI Talk to the team