For sites that hold sponsor data, see patients, run trials, and answer to auditors. Microsoft 365 done right. HIPAA controls put in writing. AI that actually reduces tedious work — without the regulatory exposure most consumer tools introduce.
Generic IT vendors handle email and printers. Clinical research sites need vendors who understand IRB protocols, sponsor monitoring visits, FDA inspection readiness, CRIO and Veeva and Florence and Complion, EDC integrations, and the difference between a HIPAA Risk Assessment and a vendor questionnaire.
Nona Clinical IT is built for that gap. The same security controls, policy frameworks, and AI tooling — applied with the specific knowledge of what a sponsor's monitor asks for and what an OCR auditor flags.
We sign BAAs by default. We don't use consumer AI on PHI. The audit trail is built into the workflow, not bolted on later.
The HIPAA, Microsoft 365, endpoint, and network work that turns a self-managed environment into something a sponsor monitor can pass over without comment.
An internal assistant covering the tedious tasks that consume staff hours — built on Azure OpenAI inside your existing M365 tenant. Same BAA as your email.
Monthly retainer with a real ticketing portal, response SLAs, and a single point of contact who knows your environment. Not an offshore tier-1 queue.
Every engagement begins with a signed BAA. Every system that touches PHI runs on a vendor with a BAA. Every AI workflow has a documented human-approval step. Every output is logged for the audit you haven't had yet but will eventually face.
No work that touches PHI begins before the BAA is signed — by anyone, including us. Standard mutual-indemnification template available on request.
Phase 3 AI workflows run on Azure OpenAI inside your Microsoft tenant. ChatGPT Plus and consumer Gemini are out of scope for any patient data.
Every AI output is logged with the input data, model version, reviewer, and disposition. Sponsor monitors and OCR auditors are explicit audiences.
Required under HIPAA Security Rule 164.308. We run it on your behalf, every 12 months and after material changes. Sponsors see the document.
Each phase has a defined deliverable, an explicit hour range, and transparent tooling costs. You approve work item-by-item; nothing is done uninvited.
If you're running a research site, a clinical practice, or any healthcare operation that has been quietly avoiding the IT-and-compliance conversation — this is a 30-minute call that gives you a clear-eyed picture of where you stand and what an actual remediation path looks like.
No sales script. No 60-page deck. You'll get a written report; you'll know whether we're a fit.
