Care teams and AI working from the same patient journey—with consent, clinical handoffs, and the operational record inside the health system.Care is multiplayer by nature: patients, practitioners, coordinators, specialists, and systems all contribute to one journey. Visca lets AI join that shared work with a persistent identity, voice, presence, and approved capabilities. People can enter the same live session, redirect the work, review a handoff, and preserve one clinical operational record without sending PHI outside the health system. The first deployment is underway at Stanford Medicine.
Shared AI work is useful only when authority, data, and consequences remain controlled.
01
Service-account access to the whole panel
An agent integrated to the EHR through a service account can read every patient the clinician can. A leaked credential is a panel-wide PHI breach.
02
No machine-distinguishable AI authorship
The EMR audit shows a clinician edited a note. It does not show that an AI drafted the content underneath. For malpractice and bias review, that distinction is everything.
03
An ops burden no health system wants
Self-hosting the model server, the transcription pipeline, and the audit chain means someone patches them, rotates their credentials, and answers their incidents. Hospital IT is already stretched; a second infrastructure estate is a non-starter.
One shared workspace, not scattered agent threads
The collaboration and control plane around every participant, model, tool, and action.
01Identity
AI authorship, distinct from the clinician's
The clinical AI acts under its own identity, separate from the clinician's. The trail says: AI drafted, clinician edited, clinician attested — verifiable and exportable to the EHR.
02Credentials
Per-encounter PHI access
Read this patient, for this visit, for this duration, with this consent on file. No standing panel-wide access; nothing for a leaked token to read.
03Runtime
Models inside your tenancy
The model, the prompts, and the outputs execute inside your perimeter. No outbound call to clear, no new BAA per vendor, no egress finding to remediate.
04Audit
An encounter record a reviewer can trust
What the AI saw, what it drafted, what the clinician changed, what was attested — one chained, tamper-evident record. A single query, not weeks of forensics.
05Operators
Maintenance without a second IT org
The stack's own operators deploy, upgrade, patch, rotate credentials, and answer incidents — inside the tenancy, under the same identity and audit, on the same record.
What the institution gets
Durable control without giving up capability.
Keep PHI in your tenancy — model, transcription, and record included
Replace standing EHR access with per-encounter, time-bound credentials
Prove AI-vs-clinician authorship from one record
Resident operators maintain the stack in-perimeter — no second IT org
In practice
An ambient clinical scribe
During a visit, the scribe requests a per-encounter credential: read this patient's chart, for this visit, for forty-five minutes. It drafts the note under its own identity; the clinician edits and attests under theirs; both land on one record. Months later, when the note is questioned, the authorship trail — and the patch history of the stack that produced it — is one query, not weeks of forensics.
Relevant control frameworks
HIPAA (BAA)HITRUSTSOC 2 Type II21 CFR Part 11 (where applicable)
