Hutchins Data Strategy Consultants
A seven-dimension diagnostic for health systems deploying AI. Twenty-one questions, scored against NIST AI RMF, ISO/IEC 42001 and the HIPAA Security Rule.
Most health systems cannot answer a regulator's first question: which AI systems are running here, and who signed off on them?
This instrument scores where you actually stand. It is built for the person who would be asked that question — the CIO, CISO, CMIO or compliance lead — and every item is answerable without pulling a report.
Answer honestly. A score you disagree with is worth more than one you engineered.
Weighted by where patient harm and regulatory exposure actually concentrate.
Ranked by dimension weight against distance from Level 5.
A maturity score says where the practice sits today. These say what to build, in what order, and whether it is actually moving.
Gap Report
$950
Governance Monitor
$1,500/mo
This model scores capability — how developed your governance practice is, what exists, what is documented, what is measured, and what to build next. The AI Governance Defensibility Brief scores exposure — whether you could reconstruct and justify one specific AI decision if a regulator, auditor or plaintiff’s counsel came asking for it.
You can score well on one and badly on the other. A mature practice can still fail to produce the artifact for a single decision. A well-documented shop can have no vendor risk program at all. If the question keeping you up is evidence rather than capability, start there instead.
Twenty questions, five domains, benchmarked against every other organization assessed. The score is free; the Brief is $149 at founding price, and the first fifty include a twenty-minute walkthrough with Chris.
Take the Defensibility DiagnosticThis is an informational self-evaluation tool. It is not legal advice, not a HIPAA compliance certification, and not a substitute for the Security Risk Analysis required under 45 CFR §164.308(a)(1)(ii)(A). A score here does not establish or reduce regulatory liability. Responses are scored in your browser and are not transmitted or stored.