Your scribe is approved clinically. Then it stalls.
The shape of a stuck ambient deal
The clinical sponsor signed off in week two. The CIO is supportive. The pilot was great. Then it hit the wall: no SOC 2 Type II, no standardized BAA the legal team has seen before, no Epic Showroom listing, and no clean answer to "how does this write back into the chart?"
Each of those is a months-long workstream. Together, on a deal-by-deal basis, they're the reason most ambient vendors are still selling pilots in year two instead of hospital-wide deployments.
What hospital security actually asks AI ambient vendors
- →Where is PHI processed, who is the model provider, and what's the data retention contract with them?
- →Show me your SOC 2 Type II report and your BAA. Yes, the actual report, not an attestation letter.
- →How does the generated note get into the chart, and what audit trail do we get on every write?
- →What happens when the clinician edits the note? When they reject it? When they're offline mid-encounter?
- →How do you isolate our hospital's data from your other customers' data?
What SoFaaS™ handles for you
Compliant hosting + BAA
HIPAA-ready environment with the BAA template hospitals have already reviewed.
SOC 2 Type II evidence
Annual audit. Full report shareable under NDA the same week procurement asks.
SMART App Launch
Your app launches inside the Epic clinician workflow with patient and encounter context.
FHIR write-back
DocumentReference and Observation handling with full audit trail. The chart write the hospital can defend in review.
Multi-tenant isolation
Per-hospital data partitioning baked into the runtime. Standard answer in every security questionnaire.
Showroom submission
Listing handled end-to-end. Your distribution channel is open by the time you're cleared to deploy.
The first hospital is hard. The tenth is harder.
The first hospital deal teaches you what hospital security review looks like for an ambient product — the questions, the evidence, the clinical safety reviews. It's expensive and slow, but it's finite.
The tenth hospital is what kills internal-build ambient platforms. Each hospital wants its own SSO, its own audit log format, its own EHR version, its own answer to "what about edits made after the encounter is closed?" Without a runtime that absorbs that variance as configuration, every hospital becomes another integration project.
SoFaaS™ is what sits between your ambient product and the long tail of hospital-specific requirements. You ship the same app; we make it deployable into every hospital that asks.
FAQ
Why are AI ambient deals especially stuck on Epic?
Ambient scribes touch protected health information at the speech layer, write structured documentation back into the chart, and run inside the clinician's active workflow. That makes them a worst-case for hospital security review — multiple sensitive data flows, a new vendor model, and a clinician-facing UX. Most ambient vendors lose months per hospital on review and integration.
What does SoFaaS™ handle for an AI ambient vendor?
Compliant hosting and BAA on day one, SOC 2 Type II evidence the hospital already knows how to read, SMART App Launch from inside the Epic workflow, FHIR write-back of the generated note, audit logging the hospital can ingest, and the Epic Showroom listing. You keep the ambient model, the transcription pipeline, and the documentation IP — those are the parts that make you you.
What about model providers and sub-processors?
We treat your model provider as a sub-processor in the SoFaaS™ posture and disclose it in the standard sub-processor list hospitals are already used to reviewing. You get to keep using the model that gives you your edge without each hospital re-doing that disclosure from scratch.
How do hospital reviews go after the second deployment?
Faster every time. The first hospital teaches us what their security team specifically asked for; we hard-code the answer into the standard SoFaaS™ evidence packet. By the third or fourth hospital in the same category, the review converges on the same packet of artifacts and the timeline collapses from months to weeks.
Do we still control how our app behaves clinically?
Yes. SoFaaS™ owns the runtime — the hosting, auth, FHIR mappings, listing, and ongoing maintenance. You own the product behavior, the clinician UX, and the model. We sit between your app and Epic; we don't sit between your app and your customer.
Have a deal stuck on Epic?
Tell us about it. Half-hour call. We'll know within 15 minutes whether SoFaaS™ can unblock you.
Talk to us