Healthcare data strategy consulting | AI-ready health data
by Dr. Phil Winder , CEO
Healthcare data strategy consulting establishes whether a health system’s, payer’s or digital health company’s data can support the AI it plans, then fixes the gaps: electronic health record (EHR) and claims sources that disagree, coding changes that split the history, and protected health information (PHI) that the Health Insurance Portability and Accountability Act (HIPAA) restricts. Winder.AI, independent since 2013, runs it as the first phase of an AI build, so the senior engineers who map the data are the ones who build on it. The review ends with a field-level map of every source and the pipeline and monitoring design that closes the gaps.
Where healthcare data breaks AI
The same patient encounter is usually recorded in two systems that disagree. The EHR records what the clinician saw on the day, while the claim records what was billed weeks later, after coding and payer adjudication. A model trained on claims learns billing behaviour and a model trained on EHR data learns each site’s documentation habits, so the review decides which source holds the truth for each field the model will use.
Coding history splits as well, because US providers and payers moved from ICD-9 to ICD-10 diagnosis codes (the International Classification of Diseases) on 1 October 2015, and the ICD-10 code set has been revised every October since. The Centers for Medicare & Medicaid Services (CMS) published mappings between the two systems, but many codes map one-to-many, so any trend or label that crosses 2015 needs checking before a model trains on it.
Patient identity breaks too, because the US has no national patient identifier and one person carries a different medical record number in each hospital, clinic and health plan. Matching on name, date of birth and address merges some different people and splits others, and the model then sees two histories joined into one, or a readmission counted as a new patient. We measure the match rate before anything trains on it.
Much of the clinical detail is in free text: discharge summaries, referral letters and pathology reports. Structured fields often miss the fact a model needs, and extracting it reliably is a separate piece of work.
US health data rules the strategy has to satisfy
HIPAA’s Privacy Rule allows two routes to de-identified data: Safe Harbor, which removes 18 identifiers including every date element except the year, and Expert Determination, in which a qualified statistician certifies that the risk of re-identification is very small. Safe Harbor strips the admission and discharge dates most clinical models depend on, so time-based work usually needs Expert Determination or a limited data set under a data use agreement.
HIPAA’s minimum necessary standard also limits each use of PHI to the fields that use needs, so the plan lists every field a model takes and the reason for it.
Records from federally assisted substance use disorder programmes fall under 42 CFR Part 2, which the Department of Health and Human Services (HHS) rewrote in a final rule published on 16 February 2024, with compliance due by 16 February 2026. Part 2 puts consent and redisclosure limits on those records beyond HIPAA’s, so the pipeline has to know which rows came from a Part 2 programme and keep that flag as the data moves.
Payers also have a deadline under the CMS Interoperability and Prior Authorization final rule (CMS-0057-F), released on 17 January 2024. It requires Medicare Advantage organisations, Medicaid and Children’s Health Insurance Program (CHIP) programmes, and plans on the federal exchanges to run Fast Healthcare Interoperability Resources (FHIR) application programming interfaces (APIs) for patient access, provider access, payer-to-payer exchange and prior authorisation, mostly by 1 January 2027.
Mapping claims and clinical data into FHIR for those APIs is the same field-level work a model needs, so we scope the API mapping and the model’s data together.
Outside the US, the same review runs under the UK General Data Protection Regulation (UK GDPR) and the NHS Data Security and Protection Toolkit, and the Medicines and Healthcare products Regulatory Agency (MHRA) regulates software that qualifies as a medical device.
Steps in a healthcare data readiness review
The review follows the data from each source to the model that will use it:
- Source inventory. We list every system in scope (EHR, claims, lab, pharmacy, scheduling and documents), who owns each one, and which access requests need approval.
- Field tracing and cross-source tests. We trace each input the model needs to its origin, test the EHR against the claims, and measure how much usable history stays consistent across the coding changes.
- PHI plan. For each use, we name the fields, the de-identification route and where the data is processed.
- Gap list. For each gap that blocks the intended model, we set out the options: backfill it, use a proxy, narrow the scope, or stop.
- Pipeline and monitoring design. We design the pipelines that close the gaps and the monitoring that catches drift once a model is live.
You keep the written report, the field-level map and the designs, and the build can follow on a monthly retainer with the same engineers fixing the pipelines they reviewed.
Cost and timeline
Our pricing page publishes indicative rates of £150 to £300 an hour on time and materials, drawn from real projects, and we quote each review on its scope. The same page lists an analysis-and-design engagement that took about two months. In healthcare, approvals to access patient data can extend that timeline before the first record arrives.
Proof from data work in other industries
Our published case studies of this work come from outside healthcare, in proptech and aviation, and their data problems are the ones EHR and claims data present: sources that disagree, history with gaps, and drift once a model is live.
At Apartment List, an online rental marketplace, training and inference data had drifted apart, which made model performance unreliable once deployed. In 2025 we mapped the machine learning pipeline, found the sources of the drift and moved the platform to a unified Chalk feature store, after which the case study records no training/inference drift.
“Winder.AI guided us toward a unified architecture and an automated deployment process. The structured discovery turned abstract concerns into concrete solutions.”
Steve Kim, Senior Engineering Manager, Apartment List
Also in 2025, we improved the taxi-time prediction model behind a global aviation business’s Taxi-Time API. The work used hundreds of thousands of flight records drawn from multiple and often disparate sources, in which events such as last-minute runway configuration changes were inconsistently logged.
Who this is for
This review is for health systems, payers and digital health companies whose AI plans depend on EHR, claims or clinical document data, such as a readmission or no-show model, a payer analytics programme, or an agent that reads the record. If the real problem is a dashboard showing the wrong numbers, a reporting fix may solve it without an AI programme, and we will say so on the first call.
Other healthcare work
Once the data is ready, our custom AI agents for healthcare service builds agents for prior authorisation, intake and coding workflows, and our intelligent document processing for healthcare service extracts structured fields from clinical letters, referrals and pathology reports. The method behind this review is our data strategy consulting service, applied to clinical and claims data.
Frequently asked questions
Healthcare data strategy consulting establishes whether a health system’s, payer’s or digital health company’s data can support the AI it plans, then fixes the gaps. The usual gaps are electronic health record (EHR) and claims data that disagree, a coding history split by the October 2015 move from ICD-9 to ICD-10, patients recorded under different identifiers in different systems, and protected health information that the Health Insurance Portability and Accountability Act (HIPAA) limits. Winder.AI runs it as the first phase of an AI build, and the same senior engineers then build on the data.
Winder.AI’s pricing page publishes indicative rates of £150 to £300 an hour on time and materials, drawn from real projects, and we quote each review on its scope. The number of source systems in scope sets most of the cost: an EHR and a claims feed is a smaller review than an EHR, claims, lab, pharmacy and document estate across several sites.
As a guide, our pricing page lists an analysis-and-design engagement that took about two months. Healthcare reviews can take longer, because approvals to access patient data and agreements with each data owner come before the first record arrives. The build that follows runs as a monthly retainer for as long as it needs.
We agree the access route with your privacy and security leads before any record moves, and use the least identifiable data that answers each question. HIPAA allows de-identification by Safe Harbor, which removes 18 identifiers including every date element except the year, or by Expert Determination. Because Safe Harbor strips the dates most clinical models need, time-based work usually needs Expert Determination or a limited data set under a data use agreement. We flag records from substance use disorder programmes covered by 42 CFR Part 2 and keep them separate.
Our published case studies of data strategy work come from outside healthcare, in proptech and aviation. In 2025 we mapped Apartment List’s machine learning pipeline, found the sources of its training and inference drift and moved it to a unified Chalk feature store, after which the case study records no training/inference drift. In 2025 we also improved the taxi-time prediction model behind a global aviation business’s Taxi-Time API, working from flight data drawn from multiple, inconsistently logged sources. Disagreeing sources and gaps in the history are the same problems EHR and claims data present.
A small team of senior engineers, working remotely from Europe and the USA and led by Phil Winder, author of O’Reilly’s Reinforcement Learning, does the review and the build that follows. There is no sales layer between you and them. You keep the written report, the field-level map of every source, and the pipeline and monitoring designs.
This page applies the method of our data strategy consulting service to clinical and claims data under US health regulation: EHR and claims reconciliation, ICD coding history, patient matching, HIPAA de-identification, 42 CFR Part 2 and the CMS-0057-F payer API rule.
You need it for the fields the agent or model will read, because an agent that drafts prior authorisation requests from EHR data inherits every gap in that data. A document processing project can itself be the remedy, when the facts a model needs are in clinical letters and reports. See custom AI agents for healthcare and intelligent document processing for healthcare.