Nightshift for Healthcare
Answers across the chart, claims, and ops. Minimum necessary by default.
Connect the EHR, claims, and your operational systems once: clinical and analytics teams and their agents query live data without standing up a warehouse. A governed view redacts identifiers before any response leaves, so each agent gets only the fields its task needs and the rest never reaches the model.
| Field | Care-coordination agenton the patient’s care team | Analytics agentno treatment relationship |
|---|---|---|
| Patient name | masked | masked |
| MRN · DOB · SSN | masked | masked |
| Care team | Cardiology, Team B | — |
| Diagnosis | I50.9 Heart failure | cardiology encounter, no code |
| Psychotherapy notes | denied | denied |
Cross-source attribution
Attribute readmissions no single system can see.
An agent connects Nightshift over MCP and pins $2.8M of 30-day penalties to the units, DRGs, and follow-up gaps behind them, across Epic, ServiceNow, Salesforce Health Cloud, and Workday. No single system computes this: the catalog composes all four into one governed query.
| UnitEpic | DRGEpic | Follow-up gapSalesforce | 30-day readmitsServiceNow | PenaltyWorkday |
|---|---|---|---|---|
| Cardiology | DRG-291 | 34% | 41 | $0.9M |
| Cardiology | DRG-292 | 28% | 33 | $0.7M |
| Pulmonary | DRG-190 | 22% | 27 | $0.5M |
| Orthopedics | DRG-470 | 18% | 22 | $0.4M |
| Nephrology | DRG-682 | 15% | 18 | $0.3M |
Minimum necessary
Each agent sees only its part.
Minimum-necessary is a view, not a hope. Each role reads through a governed view granted read-only, so the same catalog answers each agent differently.
What agents do
Care agents under minimum necessary.
Coordinate care
Read the chart its team is assigned to, with SSN, MRN, and date of birth masked before anything leaves.
Work the claim
Read claims data and draft the claim or a follow-up-gap flag into Nightshift for a person to review, with restricted notes left out of the view entirely.
Brief the clinician
Summarize a patient’s relevant history, scoped to the care relationship, never the whole record.
Governance in plain SQL
Scope to a care team, redact the identifiers, grant read.
A governed view scopes an agent to its care team, redacts SSN, MRN, and date of birth, and drops sensitive notes. Grant the agent read on that view, and it is the only data the agent can reach.
- Scope rows and columns with a governed view
- Redact identifiers, leave restricted notes out
- Agents read the chart, never write it; claims and ops drafts land in Nightshift for review
-- encounters_safe: cardiology panel, identifiers and notes droppedcreate view encounters_safe asselect encounter_id, care_team, diagnosis_code,'REDACTED' as patient_name -- PHI not exposedfrom encounterswhere care_team = 'cardiology'; -- ssn, mrn, dob, notes not selected
Questions privacy officers ask
What compliance wants to know.
- Does the agent ever see full PHI?
- Only the fields a role needs. A governed view redacts identifiers and drops restricted fields, and the agent reads through that view, so the model never receives them.
- Is minimum-necessary enforced or assumed?
- Enforced. Each role reads through a governed view that exposes only its fields and rows, granted read-only, so the same catalog answers each agent with only its part.
- How is access audited?
- Every read is recorded with who, what, and when, and streams to your existing log of record for the same review any access gets.
Chart writes stay with clinicians.
Writing to the chart stays with your clinicians and the EHR: care and analytics agents read it, never change it. Operational and claims work, a drafted claim, a flagged follow-up gap, a prepared coordination note, lands in Nightshift for a person to review before it enters your systems of record.
Put an agent on clinical data, within your rules.
Start free, connect an EHR or claims warehouse, and watch minimum-necessary reads reach your agent in minutes.
Want to look first? Take the product tour