Loading…
AI Agent Development · Boston
Agents in Boston tend to fail at the same place generic agents pretend does not exist: regulated environments. A customer-support agent at a typical B2B SaaS can hallucinate a refund and someone fixes it. An eligibility-verification agent touching Epic at Mass General Brigham cannot. A protocol-prep agent in a Cambridge biotech that posts the wrong reagent allocation into LabWare LIMS triggers a deviation report.
We build agents for healthcare, biotech, life-sciences, and EdTech teams in the metro. The architecture starts from HIPAA and 21 CFR Part 11 working backward: BAA-covered model providers (Anthropic on Bedrock, Azure OpenAI), private VPC inference where the risk profile demands it, FHIR R4 integration against Epic and Cerner, LIMS and ELN integration against Benchling, LabWare, and Genemod, plus an audit trail that holds up to internal audit.
Projects run fixed-scope: discovery first, fixed quote after, four to ten weeks of build with weekly demos on Eastern time.
Tell us about the regulated workflow.
The model layer comes first. For HIPAA-covered work we route to Anthropic Claude Sonnet 5 or Claude Haiku 4.5 through AWS Bedrock under a signed BAA, or to GPT-5 through Azure OpenAI under Microsoft's BAA. The agent runtime never reaches the public OpenAI or Anthropic APIs directly. For workflows where PHI cannot leave your environment at all, we deploy Llama 4 70B or a Mistral model on a private VPC behind vLLM with no external egress. Discovery picks the right path; we do not default.
The agent runtime is LangGraph on ECS Fargate or Azure Container Apps depending on which cloud your team operates. State is checkpointed in DynamoDB or Cosmos DB so a runtime restart resumes from the last completed node. Every tool call writes an audit record with the agent run ID, tool name, input hash, output status, and the human user or service identity on whose behalf the action ran.
FHIR R4 is the integration surface for Epic and Cerner. The agent uses OAuth 2.0 with SMART on FHIR scopes scoped to the exact resources it needs - Patient.read, Coverage.read, Appointment.write, ServiceRequest.read - and never holds a blanket access token. For payer-side work, integration is Change Healthcare, Availity, or Waystar through their REST APIs with the same scope discipline.
For biotech operations the integration surface is different but the architecture is similar. Benchling and Genemod for ELN. LabWare and Sapio for LIMS. Hamilton, Tecan, and Opentrons liquid handlers through their scheduling APIs. The agent generates the records, books the instruments, and writes the protocol back into the ELN. The scientist runs the experiment. Every record is reversible and audit-logged.
Six components that show up in nearly every healthcare, biotech, or regulated-environment agent we ship.
Anthropic Claude on AWS Bedrock under signed BAA, Azure OpenAI under Microsoft BAA, or private VPC inference with Llama 4 70B for no-egress workflows. Routing logic picks per request based on PHI sensitivity.
Epic on FHIR and Oracle Health (Cerner) FHIR R4 through SMART on FHIR OAuth scopes. Tool wrappers for Patient.read, Coverage.read, Appointment.write, ServiceRequest, and DocumentReference. No blanket tokens.
Benchling, Genemod, LabWare, and Sapio integration. Protocol scaffolding, sample registration, plate allocation, instrument scheduling against Hamilton and Tecan. Reversible writes with full audit trail.
Every tool call writes an immutable record with agent run ID, identity, input hash, output status, and timestamp. Records stored in S3 Object Lock or Azure Blob immutable storage, queryable through Athena or Synapse.
Braintrust or Promptfoo against a labeled set, gated in CI. Task completion rate, hallucination rate, tool-call accuracy. Doubles as Operational Qualification documentation for non-SaMD validation packages.
High-risk actions (prior-auth submission, instrument reservation, prescription updates) route to a human approver with full context. The agent surfaces the proposed action, the supporting data, and the reasoning trace.
No other metro has Boston's density of healthcare delivery, biotech R&D, and academic medicine in one place. Mass General Brigham operates one of the largest research-active health systems in the country, with Epic across the network. Beth Israel Deaconess and Tufts Medical Center run sizable clinical and research operations. Kendall Square is the most concentrated biotech ecosystem in the world, with Moderna, Vertex, Biogen, Takeda, and hundreds of seed-to-Series B companies running wet and dry labs within a 15-minute walk of each other.
The pattern we see most often: an operations or platform team has an agent prototype that does something useful in a notebook, but it cannot ship because the compliance review, the audit trail, the BAA coverage, and the validation documentation are missing. We come in to harden the architecture into something an internal-audit team or an IRB can review, while keeping the underlying capability the prototype was built around.
We work remotely with Boston clients on Eastern time. Discovery calls and demos run between 9am and 5pm ET. Code ships to repositories you own, including the Terraform or CDK that defines the BAA-covered cloud topology.
Industries where we see strongest fit: health-system operations, biotech R&D and lab ops, clinical trial operations, payer prior-auth and eligibility workflows, HealthTech SaaS shipping clinical-adjacent features, and EdTech with FERPA-covered student data.
Describe the workflow, the regulatory frame (HIPAA, 21 CFR Part 11, FERPA), and the systems the agent has to touch. We'll reply within one business day with a rough architecture and a price range.