Bluesight

Learned models drive the two surveillance products, beside a larger layer of non learned tools. ControlCheck's diversion analytics use unsupervised machine learning with continuous learning, and its proprietary Individual Risk Identification Score compares each clinician's behavior, drawn from demographics and dispensing, waste and shift reports, against peers in the same hospital, care area and department.

PrivacyPro, the former Protenus platform, audits up to all staff access to patient records and uses machine learning to score and group suspicious accesses into cases. Baselines estimated from observed behavior are models learned from data. Bluesight's case for them is specific: averages and standard deviations fail against people who conceal what they are doing, because the pattern appears only when many variables are compared at once.

The company also sells value that does not depend on a model: closed loop reconciliation that Bluesight says auto reconciles 95 percent of controlled substance transactions, investigation workflows and audit trails, and the KitCheck, CostCheck and 340BCheck products. Prism Assistant adds a generative layer. The model is the engine of the surveillance modules, not of the whole suite.

Detection and triage feeding human investigation, correctly positioned given that an alert here is a suspicion about a named clinician.

The company frames the product as an early warning system giving pharmacy directors control of discrepancy identification, with exception reports focusing attention on important discrepancies and automatic tracking of resolutions to produce a complete audit trail. It also explicitly supports building a diversion prevention program with clinically driven workflows and cross departmental cooperation, which is an honest acknowledgment that the software is one component of a human governance process rather than the process itself.

No alert precision or false positive rate is published, and in a product generating suspicion about individuals that is the number that matters most.

The approach is named without the version and update discipline behind it. Bluesight publishes that its diversion analytics use unsupervised machine learning with continuous learning, explains why simpler statistics fail, and describes its Individual Risk Identification Score: staff behavior drawn from demographics and from waste network, dispense trend and shift analysis reports, compared against peers by hospital, care area and department.

For PrivacyPro it describes machine learning that scores record accesses, aggregates suspicion scores and groups related incidents into multi incident cases. The features and weights behind either score, the training population, the thresholds that place a clinician on a worklist or a case in review, and any model versioning are not published; ControlCheck ships new features every two weeks, and nothing says when a scoring model changes. Prism Assistant, the generative layer, is described as trained on diversion specific workflows and names no underlying model.

The architecture is described and no model provider is named. The diversion analytics and PrivacyPro's access scoring are Bluesight's own machine learning over data the hospital delivers, largely as existing reports rather than through bespoke integrations.

Prism Assistant is a generative AI assistant that Bluesight says is trained on diversion specific workflows and operates entirely within its own secure environment, but it does not say which underlying model it runs or who built it, and Bluesight is building agentic capabilities on the same platform. What the products hold joins two sensitive categories: patients' medication and record access data, and the behavioral profile of identifiable staff derived from it. No cloud provider, subprocessor list or retention policy is published for the suite.

Named customers and vendor reported figures, without method. For ControlCheck, Bluesight reports more than 2,200 confirmed diversion cases, more than 47,000 potential cases investigated and closed, a 95 percent auto close rate on transaction audits, and at UCSF Health auto reconciliation of 95 percent of controlled substance vault transactions with a 74 percent cut in the time taken; it also states ControlCheck detects diversion 6.6 times more effectively than other next generation solutions, with no method or comparator.

For PrivacyPro it states a 95 percent accuracy rate in distinguishing proper from improper record access (96 percent on a statistics panel), 14 fewer cases a month to review, up to 70 percent time savings, and at a large physician group 96 percent accuracy and an 81 percent cut in time to resolve a case, none with a method, reference standard or denominator. Both products cite repeated Best in KLAS recognition, which measures customer satisfaction.

Named customers include OhioHealth, Children's Hospital of The King's Daughters and Nicklaus Children's Health System. None of this measures detection performance against a reviewed reference, such as how many violations or diversions surfaced that review would otherwise have missed, and how many flagged staff were cleared.

One categorical commitment is published for the generative layer, without the schedule behind it. Bluesight states that Prism Assistant operates entirely within Bluesight's secure environment and draws only on data already integrated into ControlCheck, which answers where that assistant sends controlled substance and staff data. Beyond that the assurances are general: a HIPAA compliant cloud, an annual HIPAA examination, and website level safeguards.

Nothing states how long medication administration records, EHR access logs and the staff behavioral profiles built from them are retained, whether customer data trains or refits the diversion or privacy models, or whether one hospital's data informs another's baselines, although ControlCheck benchmarks program metrics across health systems. The data joins identifiable patients' records with identifiable clinicians' behavior across two products.

Nothing is published on safety engineering either: how a clinician wrongly flagged by either product is detected and cleared, or how a wrong answer from Prism Assistant is caught before it shapes an investigation.

HIPAA compliance is claimed and supported by an announced examination whose report is not published. Bluesight describes its platform as running on a HIPAA compliant cloud and announced in 2022 that Schellman and Company had examined its HIPAA policies, procedures and controls against the Security Rule and the breach notification requirements, with an annual repeat.

Business associate status is not stated in words, no agreement text is published, and the only privacy policy covers Bluesight's websites and online services rather than the patient and staff data the products handle.

A recognized certification is named in Bluesight's own material, with a clock question attached. In February 2022 Bluesight announced that it had passed SOC 2 and SOC 3 Type 2 examinations, following a SOC 2 Type 1 the year before, and an independent examination of its HIPAA policies, procedures and controls by Schellman and Company, which it said would recur annually; the AICPA SOC mark appears in the footer of every page of its site.

No report, audit period, scope or later date is published, no trust center is offered, and no penetration testing cadence or vulnerability disclosure program is stated. The 2022 examination predates the acquisition of Protenus, so whether PrivacyPro's systems now sit inside that scope is not stated. The holdings make the attestation matter: a complete account of which named clinicians handled which controlled substances and which staff opened which patient records.

No device claim is made and the product is scoped accordingly. What governs is the Controlled Substances Act and the recordkeeping it requires, and Bluesight frames ControlCheck as closing gaps in the controlled substance record so a hospital stays ready for DEA audits; state pharmacy and nursing board reporting duties attach when diversion is substantiated. That framing is accurate, and it describes the product's compliance purpose rather than a regulatory position on the software itself.

The exposure is the consequence of a finding: a substantiated case can end a clinician's career and trigger a mandatory report to a licensing board, and nothing published describes what accuracy standard applies before escalation or what recourse the accused has.

Governance is stated in policy language for the newest AI layer, with no evaluation behind it. Bluesight says Prism Assistant, the generative assistant launched in May 2026 inside ControlCheck and due in PrivacyPro, is aligned with Google's Secure AI Framework and operates entirely within Bluesight's own environment.

Nothing comparable is published for the models that make the consequential calls: the diversion analytics and their Individual Risk Identification Score, which draws on staff demographics alongside dispensing, waste and shift data and compares each clinician with peers in the same hospital, care area and department, and PrivacyPro's machine learning, which scores staff access to patient records.

Unsupervised anomaly detection flags statistical outliers, so a clinician whose legitimate practice differs from their peer group, through specialty, shift pattern, patient acuity or a small unit where peer comparison is thin, may be flagged for being unusual rather than for wrongdoing, and demographic inputs raise the question of whether flag rates differ by age, sex or other characteristics. An alert can lead to investigation, employment action, licensing board referral or criminal referral. No subgroup analysis, bias evaluation or monitoring statement is published for either model.

Naming the technique does real work here, because it shows how the system fails. Bluesight names its diversion method as unsupervised machine learning that surfaces behavioral outliers among staff, and PrivacyPro scores staff access to patient records with machine learning.

An outlier method treats being statistically unusual as the trigger, so a nurse whose practice differs legitimately, through shift pattern, unit, patient mix or simply working differently, is exactly the profile it surfaces. What stands behind the output is human review: flags go to worklists and cases, and a violation or diversion is confirmed or closed through a documented investigation. Nothing measures it in a form a customer can hold the vendor to.

PrivacyPro's stated 95 percent accuracy comes with no method, reference standard or denominator, no peer reviewed error rate is cited for either product, and no warranty or remediation commitment is published. The affected party is a named clinician: a flag can start an investigation that suspends and ends careers, attaching to someone with no access to the model and no route to see what triggered it.

Integration is the precondition for both surveillance products and it runs in production. ControlCheck reads data from a hospital's automated dispensing cabinets, electronic health record, wholesaler and controlled substance vault to reconcile each dispense against its administration, waste or return, relying on existing reports and flexible data deliveries rather than bespoke interfaces; PrivacyPro reads the record system's access logs.

One record system integration is named in Bluesight's own material: KitCheck integrates with Epic Willow Inventory. Named deployments show the surveillance side working: OhioHealth across 10 hospitals in a reported 33 days, UCSF Health reconciling its controlled substance vault. The surveillance flows are read access, no dispensing cabinet or record system vendor is named for ControlCheck or PrivacyPro, and no FHIR conformance statement or interface documentation is published.

A single hosted option with the location implied: ControlCheck is a cloud platform, described as HIPAA compliant, serving United States and Canadian hospitals from a United States company, and the website privacy policy says information is processed in the United States. No hosting provider, region, residency commitment or tenant isolation is published, and nothing states whether Canadian hospitals' data stays in Canada.

Deployment is fast, one ten hospital system went live in a reported 33 days with minimal IT involvement, which speaks to integration effort rather than to where the system runs or where the data rests.

Nothing about cost is public before a sales conversation. Bluesight publishes no price, unit, pricing basis, contract shape or implementation fee for ControlCheck; the one structural detail on the product page is that it offers unlimited user seats, which says what does not drive the cost without saying what does.

Bluesight also describes a partnership through which health system pharmacies can apply value recovered through reverse distribution services toward purchasing its solutions, which is a funding route rather than a price. The suite now runs to seven products, including KitCheck, CostCheck, 340BCheck, ShortageCheck, PrivacyPro and the Prism Assistant, and how they are bundled or licensed separately is not public.

A pharmacy back office workflow sits at the center: ControlCheck reconciles each controlled substance dispense against its administration, waste or return, which Bluesight says it does automatically for 95 percent of transactions. Coverage is deep across two insider risk domains and the pharmacy operations around them.

ControlCheck covers the controlled substance custody path from wholesaler and vault through dispense, administration, waste and return, across procedural areas, nursing, inpatient pharmacy and, through ControlCheck Retail, retail pharmacy. PrivacyPro covers staff access to patient records across the organization, including hospitals, health systems and physician groups. KitCheck, CostCheck, 340BCheck and ShortageCheck cover pharmacy inventory, spend, 340B compliance and shortages.

Bluesight reports more than 1,000 US and Canadian hospitals using its solutions. Validation behind the settings is named deployments in acute care and physician groups rather than every setting described, and retail and Canadian use are described more than they are evidenced.