Analysis on HIPAA, AI,
and healthcare regulation

Buy versus build is one door short. Composing a workflow on top of a general model is now a real third option, and it changed where the cost of AI tooling actually sits. This is a decision you make per workflow rather than per organization, and in regulated work the door is decided by one thing: whether you can specify and verify a correct output.

Consent architecture is not a single event. The three stages (scope, collection, and persistence) have to run in sequence. Get the order right and the architecture holds over time. Get it out of order and you have three components that coexist without working together.

AI models are good at reading, reasoning, and following instructions. What they don't have is the accumulated judgment of a practitioner who has done the task hundreds of times. Skills are how that judgment gets encoded, and why customizing one is the step most people skip.

A lawyer got sanctioned for filing a brief with AI-generated citations to cases that don't exist. The failure wasn't the model, it was a workflow with no review step. Here is the paper-to-outline-to-session process that keeps a professional behind every output.

The ability to bring sophisticated tooling to life without an engineering team is a real shift, not a marketing claim. What changed in the economics, and what actually works when you build with agentic coding tools instead of just talking about them.

How a fascination with why chatbots refuse absurd song lyrics turned into a compliance officer's dive into AI safety failure modes, and a fully functional, secure, multi-user research platform built in thirty days with AI coding tools.

Why a compliance officer went looking for AI safety research in the first place, what alignment failure modes have in common with the failure modes compliance work already looks for, and what this Substack was built to document.