What gets easier, for each person in the building.

Miso is easier to understand as a list of what stops being a bespoke project. Below: what bothers each role today and what changes, then six situations health systems bring to us. Whichever one you start with, the deployment, the policy, and the record are the same.

RoleWhat bothers them todayWhat Miso gives them
CIO / CTOAI is proliferating across departments with no coherent architecture.One institutional way to reach and govern models, in place of every application building its own stack.
CISO / SecurityEach AI vendor or application adds another data path, credential set, provider relationship, and control surface.One enforcement point where access is restricted, credentials are held centrally, traffic is governed, and activity is logged. Fewer things to secure.
Chief Privacy OfficerDecides again and again whether a particular application may send particular data to a particular model.Privacy decisions that are enforced: who may send what data, for what purpose, to which approved destination.
Legal / ProcurementBAAs, provider terms, and vendor agreements sit next to the software, disconnected from actual AI activity.Agreements linked to use: a route exists because a contract covers that provider, model, purpose, and data. If the agreement does not cover it, the route is not available.
AI / Innovation leaderPromising projects stall in review; teams negotiate the same issues every time.A paved road to production. Once the institution's boundaries are set, new projects inherit them. Approval becomes a capability rather than a project.
Developers / Data scienceFind out which provider is allowed, get credentials, handle PHI correctly, wait for approval, then integrate against provider-specific APIs.One approved endpoint. Build against Miso; the institution's policy decides which models and routes are available.
Vendor management / Third-party riskEvery AI vendor brings its own model stack and opaque downstream dependencies.Vendors route through Miso and inherit the health system's AI controls, in place of selecting models and providers on their own.
Compliance / Internal auditInventory and evidence are assembled after the fact from surveys, spreadsheets, tickets, and interviews.A contemporaneous record of what was approved and what actually ran.
CFO / OperationsDuplicated vendor and model spend, and expensive internal review.Less duplicated infrastructure and review, spend visible by team, route, and vendor, and value from AI investments realized sooner.
Clinical / Operational leaderWants a useful tool deployed and has no interest in model-governance machinery.Less friction between a good use case and production.

Six situations.

The prototype Security said no to.

"We have a working prototype on synthetic data. To prove anything we need real notes, and the review to get them takes longer than the project."

What gets easier
Getting real data into a prototype stops being a six-month exception process. The team inherits the institution's existing decisions about providers, PHI, and agreements.
First thirty days
The team gets a sandbox key on day one. They request a route: purpose, data class, candidate models, one sentence about the data. The privacy officer sees it with the validator's findings and approves it, with an edit if needed. Real data on a limited-data-set route within the week.
First report shows
The team's applications, requests, spend against budget, denials with reasons, and the approved route with its diff.
Who owns it
The builder, with the privacy officer as approver.
What Miso leaves to you
The decision. Miso assembles the evidence; Privacy still says yes or no.
Inventory · clinical informaticsconsole.northstar.health
discharge-summary-prod · PHI · 2 candidateslive
inbox-reply-draft · treatmentlive
encounter-note-draft · treatmentin review
sandbox · syntheticalways on
Builder view · synthetic

The vendor review backlog.

"Eleven questionnaires on my desk, eleven providers behind them, and every one of them wants a different model next quarter."

What gets easier
The model-and-data half of every vendor questionnaire is answered once, by the path the vendor now uses, and the vendor's AI activity is in your record.
First thirty days
Each vendor becomes a caller: its BAA, its routes, its pinned model. Its model traffic goes through the path Security already reviewed, so the questionnaire's model-and-data section collapses to a registry entry.
First report shows
Each vendor, its agreement, its review date, and which provider actually answered its traffic.
Who owns it
The CISO.
What Miso leaves to you
Diligence on the vendor's own application. Miso covers the shared AI path; the rest of the questionnaire is still yours.
Agreementsconsole.northstar.health
Ambient scribe · BAA 2025review Nov 1
Care coordination · BAA 2026review 2027-05
Inbox triage · BAA 2026in force
Coding assistregistering
Five vendors · synthetic

The big vendor deal.

"The scribe contract is on the desk. Where is the chain from their model to our BAA?"

What gets easier
The contract and the traffic are connected. Legal can see which agreement permits which use before signature, and a use the agreement does not cover has no route.
First thirty days
The vendor's provider is checked against your provider registry. If the agreement exists, the vendor's route runs under it. If it is missing, the ledger shows the gap before anyone signs.
First report shows
The obligations on the scribe route in three columns: what Miso enforces, what the provider attests, what the vendor attests.
Who owns it
The CIO, with Legal.
What Miso leaves to you
The negotiation. Miso shows which agreement covers which route.
Obligations · encounter-note-draftconsole.northstar.health
Zero retentionprovider attests
Identifiers replacedMiso enforces
Human review before usevendor attests
TX HB 149 disclosureunassigned
Three columns · synthetic

The model upgrade.

"A new version landed. Last time this happened it was a full re-review, and the team lost a quarter."

What gets easier
A provider's new version is a comparison and an approval, with the old and new both on the record, in place of a re-review that costs the team a quarter.
First thirty days
The new version appears in the console as a comparison: old and new on your own samples, side by side, both in the record. The privacy officer approves, and the pin moves in the policy file with a dated, hashed change.
First report shows
Which routes moved to the new version, when, and who approved the comparison.
Who owns it
The builder proposes; the privacy officer approves.
What Miso leaves to you
Judging quality. Miso runs the comparison and records both results; the score is yours.
Policy · azure openai gptconsole.northstar.health
gpt @2026-07-10pinned · 4 routes
gpt @2026-08-20comparison ready · 212 samples
Approve → policy v16privacy officer
Synthetic

The inquiry.

"OCR wants to know what a model saw for one patient across six months. Internal audit wants the same for a department."

What gets easier
The evidence already exists. What a model saw, for whom, under which approval, by date, without reconstructing it from tickets and interviews.
First thirty days
The record answers by patient, by caller, by route, by date: which model, which agreement, which identifiers were handled and how, what the caller owed and acknowledged.
First report shows
A slice of the record with the chain verified, ready to attach to the reply.
Who owns it
The privacy officer.
What Miso leaves to you
The reply itself. Miso produces the record; counsel writes the letter.
Record · subject 44810-2 · Feb–Augconsole.northstar.health
14:02:22 · discharge-summary-prod · PHI✓ d02e…3b
11:40:07 · ambient scribe · treatment✓ 8e1a…40
09:15:51 · unregistereddenied
chain verified · 212 recordsexport
Six months · synthetic

The state law question.

"Texas has a disclosure rule and Colorado has a different one. Which of our routes does each touch?"

What gets easier
State obligations are rows on the routes they touch, with an owner or a visible gap, in place of a memo that has to be re-read every time a route changes.
First thirty days
State overlays are rows in the obligations ledger. Each route shows which obligation satisfies which overlay, and where there is no owner yet.
First report shows
The overlay rows per route, with the unassigned ones highlighted.
Who owns it
Compliance, with counsel.
What Miso leaves to you
Whether a law applies to a route. Miso records and maps the obligations; counsel makes the determination.
Obligations · state overlaysconsole.northstar.health
TX HB 149 · encounter-note-draftunassigned
TX HB 149 · inbox-reply-draftvendor attests
CO SB 205 · denial-letter-draftMiso enforces
CO SB 205 · readmission-summaryn/a · LDS
Synthetic