Haystack iS (iatricSystems)

The model is the engine of the detection module inside a longer established audit platform. iatricSystems says Haystack iS uses Solomon, "the AI detection engine developed by iatricSystems", and that version 2 "uses machine learning and AI-driven privacy analytics to understand how PHI is typically accessed across your organization", learning normal access by role, department, shift and workflow and weighing several signals, such as access patterns, user roles, relationships and addresses, rather than one.

The October 2025 brochure describes the approach as "combining expert-written rules, advanced machine learning, and expanded AI-driven workflows". Consolidating audit logs from the record system and other applications into one place, investigation tracking and reporting carry value without the model, and the product has run for over two decades, first as Security Audit Manager.

Oversight is described for detection; the automated contact with staff has no published threshold. The company says a flag "does not automatically mean the access was inappropriate. It means the behavior was different enough to deserve a second look", that the aim is not for AI to make the final decision, and that privacy teams set event weights themselves; incidents can be routed to managers for review, and investigations are documented automatically.

AVA acts on its own: "When a suspicious access occurs, AVA automatically follows up with the user and reports back", and the company describes workflows such as a self-access event triggering a questionnaire that includes the policy and asks the employee to attest they will not repeat the action, with similar workflows for family, neighbor, coworker and VIP access.

Nothing published says which events AVA may contact an employee about before a privacy auditor has looked, whether a person can stop it, or what happens when the contact was wrong. The product page's line that AI "scrutinizes every instance of PHI access" describes uniform processing, not a claim that every call is right.

The approach and the engine are named; model versions and change practice are not. The detection engine is Solomon, built by iatricSystems, which learns each organization's normal access by role, department, shift and workflow and weighs several signals (access patterns, user roles, relationships, addresses) alongside expert-written rules; AVA is the in-house assistant that runs follow-up workflows.

Version 2, launched in 2026, was "rebuilt from the ground up" and lets customers adjust event weights. The ONC certification names Haystack iS version 1.0, certified 26 April 2021. No model version, training data description, accuracy figure or record of when the detection model changes is published.

The chain is structurally short at the model layer: the detection engine is built in house. iatricSystems describes Solomon as "the AI detection engine developed by iatricSystems" and AVA as its own assistant, so no outside model provider is named because none is described.

The ONC certification disclosure lists server and storage hardware, Microsoft server licenses and third party software for certificates, backup and virus protection among the costs of running the product, which describes infrastructure but not who hosts it or where. iatricSystems also sells privacy managed services in which its analysts work inside a customer's program. No subprocessor list is published, and the company's privacy policy does not cover data it processes for customers.

Named customers without measured outcomes. WVU Medicine, in a 27 February 2024 release marking 14 years with iatricSystems, says Haystack iS replaced separate audit reports across its record, document management, lab and other systems with one audit, and that it now alerts "to only what is more than likely inappropriate access"; it started AVA on self-access review. Renown Health's director of compliance and compliance coordinator are quoted on AVA reducing their workload.

The company states more than 1,300 hospitals as customers across its products. No count of events, false positive rate, investigation time or confirmed incidents is published, and no independent evaluation of the detection engine is published.

Nothing is published on how Haystack iS handles the protected information it gathers. The product joins access logs from the record system with HR records and third party applications, so it holds who opened which patient's record alongside each employee's role, department and shift. iatricSystems' June 2026 blog tells healthcare teams to understand how AI tools handle PHI, where data flows, whether it is retained or shared and whether a business associate agreement is in place, but it does not answer those questions for Haystack iS.

The company's privacy policy, updated 11 February 2026, covers its website and says it does not apply when iatricSystems processes personal data on behalf of a customer. No retention period, training use or de-identification statement for customer data is published, and nothing covers guardrails or how a safety event is handled.

No business associate status and no privacy document that reaches the product. Haystack iS exists to help a covered entity meet HIPAA's audit obligations: it consolidates PHI access logs, supports risk assessments and OCR-ready documentation, and its product page says reporting fields can be aligned to HIPAA requirements.

That is the customer's compliance, not the vendor's own position. iatricSystems' privacy policy, updated 11 February 2026, covers the website and states that it does not apply when the company processes personal data on behalf of a customer, and no page states business associate status or offers an agreement. The company's own blog tells buyers to check whether an agreement is in place with AI vendors.

An outside check of the software's security features, with no audit of how the company operates. Haystack iS version 1.0 is an ONC certified health IT module (certification 15.05.05.2760.HSiS.01.00.0.210426, 26 April 2021) whose tested criteria include authentication, access control and authorization, audit reports, automatic access time-out, encrypted authentication credentials and multi-factor authentication. That tests the product's security features, not the vendor's operations.

No SOC 2 report, ISO/IEC 27001 certificate, HITRUST certification, penetration test statement or trust center is published for iatricSystems or Haystack iS, and version 2, rebuilt in 2026, is not shown as certified. The platform holds a consolidated record of who looked at which patient, joined to HR data.

No device claim, and a credential under the health IT regime. Haystack iS is privacy monitoring software for covered entities, with no FDA clearance and none claimed. Version 1.0 is certified under the ONC Health IT Certification Program (15.05.05.2760.HSiS.01.00.0.210426, certified 26 April 2021, criteria 170.315(b)(10), (d)(1), (d)(3), (d)(5), (d)(12), (d)(13), (g)(4) and (g)(5)), with iatricSystems publishing the certification, disclosures and cost types as the program requires.

The product is built around HIPAA audit duties and OCR audit readiness for the customer. The certification names version 1.0, and nothing says whether version 2, launched in 2026 as a rebuild, carries it.

Responsible use is stated in plain terms, with no evaluation behind it. iatricSystems says a flag means behavior differed enough to deserve a second look rather than that access was inappropriate, that normal varies by role, department, shift and workflow so one-size-fits-all monitoring is wrong, that human judgment stays at the center, and that customers set event weights themselves. No governance framework, model evaluation or outside review is published.

The people the model scores are employees, and a false flag can bring an automated questionnaire and an investigation, but no false flag rate is published overall or by role, department, shift or length of service, which is where a baseline model is most likely to mistake new or changed work for misconduct.

Mechanisms let a privacy team examine a flag before acting; nothing stands behind the output and the flagged employee has no route. Haystack iS shows auditors related access history, prior investigations and user and patient activity for each event, documents investigations automatically, and records AVA's questionnaires and responses.

No accuracy, precision or false positive figure is published, and the product page's "Remove False Positives" and "false positives are minimized" are unquantified. Nothing commits iatricSystems to a remedy when a flag is wrong, and no published route lets an employee who was flagged or contacted by AVA see the basis or challenge it.

Named record systems with read access, in production. Haystack iS reads audit files: its vendor integrations list names Cerner, Epic, MEDITECH, NextGen, HealthQuest, Allscripts, Athena, CompleteCare and Medhost among record systems, Hyland, Perceptive/ImageNow and Open4 for document management, ADP, Ceridian, Infor, Kronos, Lawson, PeopleSoft, SAP Payroll, Workday, Paylocity and UltiPro for HR, Sunquest for lab, McKesson, Medicon, Omnicell and Pyxis for pharmacy, and GE, Philips iSite, Sectra, Siemens, Carestream, Fuji, NovaRAD and Penrad for imaging, through an open audit file import specification, with an offer to build for unlisted systems. WVU Medicine consolidated its record, document management and lab audit trails in it. The connections are one way: the product consumes audit files and does not write back to the record.

One deployment described only through its costs. The ONC certification disclosure says the product "requires server and data storage resources" and lists server and storage hardware, Microsoft server operating system and database licenses and third party software for certificates, backup and virus protection as costs, and asks buyers to consult iatricSystems on server requirements, which reads as infrastructure on the customer's side. The October 2025 brochure repeats the hardware note. No page states a hosted option, a location where the consolidated audit and HR data rests, or whether iatricSystems or its managed services analysts reach it remotely.

No price, and the cost drivers are published. The ONC cost disclosure for Haystack iS lists the costs a buyer carries beyond the license: server and storage hardware, Microsoft server licensing, third party software for certificates, backup and virus protection, and interface costs charged by the third party vendors whose systems feed it. The license price and its unit are not published, and the product page routes to a demo request. Privacy managed services, with iatricSystems analysts working a customer's privacy program, are sold alongside it.

Coverage is named, with validation behind part of it. Haystack iS is sold to hospital and health system privacy and compliance officers for monitoring access to protected health information across the record system, document management, lab, imaging, pharmacy and HR applications, and iatricSystems also offers the monitoring as a managed service. Named deployments are WVU Medicine, which has worked with the company for 14 years, and Renown Health. The product page offers it to organizations of any size; no page shows which settings beyond acute hospitals, such as clinics or physician groups, run it.