Portfolio · selected work, 2025–2026
Five case studies from healthcare revenue-cycle AI and beyond: the architecture, the state machines, the evals, the guardrails, and what the pilot data said. Real systems with patient and client details removed. Anything illustrative is labeled.
Illustrative stream. Real event kinds and rules, synthetic cases.
Works each flagged procedure to a payer decision across e-filing, a portal browser agent, AI voice calls and fax, under a pure state machine and an append-only evidence ledger.
56/68 resolved in 13 days 02BAM · voiceCalls payers, keeps paid models idle through phone menus and hold, wakes in ~300 ms when a human answers, and accepts an answer only if code can verify it.
$0.09 for a 6-minute lab call 03BAM · researchTurns 7,900 hours of consented clinic footage into task inventories and role specs, verified against click logs and stopped by convergence, not budget.
3-tier PHI masking, fail-closed 04BAM · internalA footage librarian that answers null instead of guessing, a PR studio with an independent critic, a meeting agent that opens draft PRs, and a multi-machine build loop.
6 internal agents, one pattern 05RepeatMD · shippedA support copilot with RAG and live SQL in the admin console, and a document pipeline that went from 13 models to 2 without losing quality gates.
13 → 2 models, same QA bar01 Prior authorization · BAM
Specialty practices lose hours to prior authorization. Every payer answers through a different door: an X12 278 API, a phone tree with a 40-minute hold, a portal, a PDF list, a fax form. The answer a practice needs isn’t “approved”. It’s proof: a certification number or a reference that wins the appeal if a claim is ever denied.
So I built an agent that treats every case as a plan with an owner and a next date, routes it to the channel most likely to settle it, and refuses to settle anything without evidence.
System map
Tap any part to see how it works.
The state machine
next_plan(position, outcome, today) is a pure function: the same inputs always give the same plan. Twelve channel outcomes map onto eight case states.
pending.reopen() one.Pick a case to replay it. Each step writes the event the real ledger would hold.
Synthetic cases walked through the real transition rules.
The clinic pilot · day 13
Resolved with proof, by pilot day
Real report snapshots (Sep 18 → Oct 2). Days between snapshots aren’t drawn.
Routing, as data
28 rules, each citing the pilot finding or payer page it came from. Payers are shown by type.
Guardrails
The agent ships switched off and check-only: until a practice opts in, a run that reaches a submit button stops before filing. Every answer has to come back with proof, or the case keeps working.
The operator
When a case needs judgment, a reasoning model may pick exactly one of nine actions. Code validates every choice before it applies, and each case has a budget of 8 decisions and $1.00.
Replay before rollout
Before review, the rebuilt agent replayed 1,667 imported verification results (87 cases) behind a network guard that blocked every outbound connection: zero filings, 3 bugs found, and agreement with the pilot’s first channel in 27 of 32 linked cases.
Shipping it
ModMed FHIR, Availity eligibility and prior auth, write-back, and the shared outcome service: ~13.6K lines merged to production (FastAPI, Next.js, PostgreSQL, AWS Lambda), plus 360+ new tests. CI runs lint, types, tests, migrations from scratch with drift and downgrade checks, a docs linter, and a secret scan, with a preview environment per PR.
The integrations
ModMed’s certified FHIR R4 API through SMART Backend Services: RS384-signed JWT assertions, a published JWKS, POST searches so record numbers never touch a URL. Availity’s 278 rebuilt to the Service Reviews 2.0.0 spec, with per-payer requirements learned the hard way (one payer took four attempts).
02 Payer calls · BAM
I timed 26 real payer calls made by people: 17.5 hours, and 54% of it was hold music. The median wait for a human was 4 minutes; the worst was 34. Per-minute voice platforms bill all of it. Switchboard keeps paid models idle through phone menus and hold until a person is actually on the line, for ~5× lower modeled cost per call than commercial voice-agent platforms.
Call replay · real lab run, Aug 17
Timing, outcome, and $0.0926 cost are from the lab run (blind payer simulator, 5/5 facts captured, wake p95 300 ms). Dialogue is illustrative of today’s design.
Hearing hold music
Hold detection is plain signal processing: energy, zero-crossing rate, spectral flatness, and the syllable-rate rhythm of the energy envelope. About 2.4 seconds of steady music enters hold; about 300 ms of speech wakes the agent, and the last 0.8 seconds are replayed so the representative’s first words aren’t lost.
When a rep says “let me check,” the call parks in SOFT_HOLD: the paid session pauses but keeps its context.
Illustrative signals; real features and thresholds.
The call lab
A simulated payer works only from a scenario card and never sees the caller’s prompt. Deterministic scoring plus LLM-as-judge grade capture accuracy (identifiers must match exactly), wake latency, cost, and fabricated IDs. Regression gates fail the build unless capture is 100%, wake is under 2 s, a long-hold call costs under $0.10, and a disclosure challenge gets an honest answer.
What the pilot taught me
I reviewed 88 pilot calls by why they ended. Missing or wrong case data ended 44% of them, more than every voice issue combined. So the fix wasn’t a better voice: it was checking data before dialing, and making the phone the last resort after the API, published lists, and the portal agent.
Disclosure, owned by code
The model hears silence and nothing reaches the line until the AI-disclosure notice appears in the model’s own output transcript. Two tries, or the call ends. The notice repeats after transfers, and a recording objection deletes the audio.
Same engine, new job
A front-desk variant asks practices who handles billing, guarded by 600 lines of rules: calling windows, one attempt per three business days, landlines only, do-not-call lists that fail closed, and a human approval gate. Lab and dry run only, by design.
Into BAM’s cloud
Moving from Fly.io to AWS Fargate behind CloudFront and an internal load balancer, with KMS-encrypted storage and logs, state in Postgres, off by default and check-only.
03 Workflow research · BAM
Before automating a clinic, you have to know what people there actually do all day. I shipped a signed, consented capture agent to 30 workstations, then built an autonomous loop that turns the footage into per-person task lists, role specs, and the work only a human can do. It fed a ranked roadmap of 28 automation opportunities.
The loop
A plain scheduler owns every limit. “An LLM never enforces its own limits.”
of logged clicks and keystrokes must appear in a description, or code rejects it. A circuit breaker trips when more than 30% fail in a run.
of PHI masking, failing closed: on-device model, healthcare regex, then a Claude leak scan. A second leak pauses that client automatically.
the cost: a Gemini Flash skim pass decides which footage earns the expensive Gemini 2.5 Pro pass.
Stopping rule
Work on a person stops when three straight segments add under 5% new tasks and at least 60% of their working hours are covered. Not when a token budget runs out. An adversarial Claude reviewer emits “gap records” that decide which footage gets pulled next, and a weekly retro reviews the loop’s own numbers.
04 Agent engineering · BAM
Each was built to take recurring work off people at BAM. They share three habits: a fixed set of allowed actions, an independent checker that isn’t the doer, and a person approving anything that leaves the building.
Gemini Flash · Vertex · Slack
Files every recording under a Dewey-style call-number system whose classes follow the life of a dollar through a practice. Its rule is “match → context, no match → null”: it never guesses, and human corrections become examples.
Claude Opus · Gemini · Perplexity
Matches news to BAM’s writing and drafts posts, and now produces short films. A separate Claude session scores each film on 6 dimensions; anything under 8 goes back for a fix. Deterministic QA checks safe zones, reading time and −14 LUFS loudness. Max 2 films a day; I approve each in Slack.
OpenAI Realtime · Claude Code · Codex
Joins Zoom, Meet or Teams, stays silent until its wake word, and keeps a live notes board. Say “fix X” and it hands a PHI-scrubbed brief to a coding agent in an isolated worktree, which may only open a draft PR.
Claude Code · GitHub
Coordinates coder, tester, grader and improver roles across several machines with GitHub as the only backend. Every file has one writer, heartbeats reassign dropped work, and the coder physically can’t edit the acceptance criteria. It’s done only when every reviewer passes the same commit.
Claude · encrypted review site
Writes proposals, not code. Each states an outcome and picks the cheapest path in a fixed order: backend API, product feature, integration, UI automation as a last resort, then human judgment. IDs hash from titles, so re-ranking never changes what “execute P-967” means.
Electron · React · Express
One desktop app covering 28 operational goals. An engine ticks every 20 seconds and the only UI is a “Needs a human” queue. Each kind of work earns trust before its human review is retired.
05 AI enablement · RepeatMD
CX Agent
Embedded in the admin console as a Chrome side panel. It answers with RAG over the help center and Notion (pgvector) plus live Metabase and SQL data, through tool calls like search_knowledge_base and get_client_catalog, and it shows which source each claim came from.
Why didn’t this member’s gift card apply at checkout?
sql.account_staterag.search · help center
The gift card is restricted to memberships, and this cart holds a retail product 1. Apply it to the membership renewal instead, or issue store credit 2.
[1] gift card rules · help center [2] account state · live SQL
Platform Agent
A Python pipeline that turns messy client files (PDFs, spreadsheets, images, Gong call transcripts) into structured app-build specs for about 15 practices. Version 20 orchestrated 13 models: 8 for generation, 5 for vision. By version 21 I’d consolidated to Claude Sonnet plus Gemini Flash, keeping the 660-line QA evaluator, JSON repair, and prompt caching.
v20: 8 generation + 5 vision models · v21: Claude Sonnet + Gemini Flash
06 How I build
Every model choice is one of a fixed set of actions, validated before it runs: the operator’s 9 moves, Lois’s critic gate, Relay’s locked criteria.
Certification numbers, verbatim quotes, click-log coverage. If code can’t verify it, the system keeps working instead of guessing.
Signal processing hears hold music, rules route cases, a cheap skim picks footage. The expensive model only runs when it’s the only thing that can.
BAA-covered, zero-retention models only, POST searches, PHI-free logs and emails, masking that pauses a client on a second leak.
Blind labs, held-out evals, sealed replays of real pilot data with zero outbound connections. Gates fail builds, not demos.
Disclosed AI calls, never-call registries, kill switches, and credentials that never reach a model.
I’ll screen-share any of these systems and go as deep as you like: the state machine, the lab, the guardrails, the trade-offs.
Every figure on this page comes from the systems’ own reports, tests, or repositories. Patient, clinic, staff, and payer-specific details are removed or generalized. Synthetic and illustrative items are labeled where they appear.