From Siloed Algorithms to Compliance-First Agentic Platforms: A Multi-Layered Architecture for Hospital AI Systems

Publication: International Journal of Innovative Science and Research Technology, Volume 11, Issue 5, May 2026, pp. 2754-2795. DOI: https://doi.org/10.38124/ijisrt/26may1651

The paper opens by describing a fragmented state of AI adoption in hospitals: "Hospitals are rapidly adopting artificial intelligence for triage, imaging, scheduling etc., yet most deployments remain isolated point solutions locked inside departmental silos, resulting in duplicated effort, hidden risks, and unrealised enterprise value. The authors note that despite explosive growth of AI in healthcare market and accelerating investment, an estimated 70–80% of healthcare AI pilots fail to scale, largely due to governance gaps, fragmented data, and missing integration blueprints."

They describe a typical scenario: "a radiology department may deploy an image interpretation model, the emergency department may adopt a triage risk scoring tool, operations may use a scheduling optimiser, and the revenue-cycle office may procure an autonomous coding assistant, yet these tools might often operate on separate pipelines, separate governance assumptions, and separate integration patterns. The consequence, they argue, is that hospitals duplicate data engineering effort, duplicate vendor assessment processes, duplicate validation activities, and duplicate security reviews across departments, finally leading to a heap of non-value-added activities in the hospital management process."

The urgency is amplified by market economics: "the global AI-in-healthcare market is projected to grow from roughly 39 billion USD in 2025 to more than 1,000 billion USD by 2034... Yet surveys of providers and payers suggest that only about 30% of healthcare AI pilots reach production, and roughly 70% fail to scale beyond initial pilots, creating a widening 'AI implementation gap' where expenditure and expectation grow faster than measurable impact."

The authors also cite clinician burden data: "in a large NHS Survey, clinicians spent on average 13.5 hours per week on documentation work in 2022, which is over a third of their working time, and a 25% increase over seven years amplifying burnout and constraining capacity."

The paper maps the regulatory environment across jurisdictions. For the US, "the HIPAA Security Rule defines administrative, physical, and technical safeguards for protecting Electronic Protected Health Information (ePHI), requiring covered entities and business associates to implement risk analysis, access control, audit logging, integrity controls, and transmission security. For Europe, the EU AI Act further designates most clinical decision-support, diagnostic, and risk stratification systems as high-risk AI systems, subject to lifecycle-wide risk management (Article 9), data and data governance requirements (Article 10), technical documentation, transparency, logging, and post-market monitoring. For India, the authors discuss DISHA, which aims to establish dedicated national and state health authorities, standardise the generation, collection, storage, transmission, and use of digital health data, and impose strict prohibitions on unauthorised or commercial reuse of health information, even when anonymised, and the DPDP Act 2023, which sets cross-sector rules for digital personal data, including explicit consent, purpose specification, data minimisation, security safeguards, breach notification, and rights to erasure."

The paper advocates a compliance-by-design paradigm in which regulatory controls be embedded directly into the architecture of hospital AI platforms, rather than implemented as external overlays.

Four interlinked objectives are stated: (1) design a hospital-specific multi-layered AI platform architecture integrating an Agent Orchestration Layer, a Compliance and Policy Layer, and a Privacy-Preserving Data Fabric; (2) map each architectural layer to concrete regulatory obligations (HIPAA, GDPR, EU AI Act, DISHA, DPDP Act, ISO/IEC 27001/27002, ISO 14971, IEC 62304); (3) develop a functional, ready-to-deploy prototype using synthetic but structurally realistic data to protect PII/PHI; (4) evaluate the model in a controlled hospital setting by quantifying workflow time savings, documentation reduction, and governance coverage.

Identified gaps addressed by the research include: platform specificity (generic models ignore HIMS complexity), agent orchestration (no hospital-grade coordination layer), privacy integration (techniques isolated from data flows), compliance mapping (high-level, not layer-specific), and global deployment (no multi-jurisdiction blueprint).

The proposed architecture comprises seven conceptual layers:

1. Infrastructure and Runtime Layer – Serves as the foundational layer comprising compute, storage, and networking resources along with secure execution environments, deployable on-premise, private cloud, or HIPAA/GDPR-compliant public cloud, with optional hardware-based secure enclaves.

2. Privacy-Preserving Data Fabric Layer – "Provides standardized, policy-driven access to data across HIMS/EHR, Laboratory Information Systems (LIS), Picture Archiving and Communication Systems (PACS), and financial platforms, while incorporating de-identification mechanisms, data quality pipelines, federated learning (FL) orchestration endpoints, and secure enclave connectors."

3. Model and Analytics Layer – Encompasses reusable model registries along with services for training, evaluation, and monitoring, supporting classical machine learning, deep learning, and LLM-based components.

4. Agent Orchestration Layer – Functions as a multi-agent execution environment where orchestrators, domain-specific agents, and safety or critic agents interact using shared schemas and tools.

5. Application and Workflow Layer – "Clinical, operational, and financial applications that embed agentic workflows into EHR front-ends, clinician worklists, imaging workstations, and revenue-cycle dashboards, using standards such as FHIR and SMART-on-FHIR where feasible."

6. Compliance and Policy Layer – Acts as a centralized governance and policy-as-code framework that translates regulatory standards... into enforceable rules governing data access, tool usage, logging, and lifecycle management.

7. Governance, Risk, and Assurance Layer – Encompasses cross-cutting capabilities such as AI risk management, model inventory oversight, incident handling, post-deployment monitoring, audit readiness, and stakeholder reporting, aligned with ISO 42001.

A key design choice is that "Layers 6 and 7 [are treated] not as peripheral 'top layers' but as control planes that shape how all other layers are configured, monitored, and adapted over time, ensuring that compliance and risk appetite drive technical design rather than the reverse."

The study adopts design science research methodology (DSRM) combined with an applied systems-architecture approach, proceeding through five linked phases: problem identification, architecture synthesis, prototype design, synthetic data generation, and scenario-based validation.

Data acquisition uses "a synthetic dataset which we generated using Synthea, a standardized framework used specifically for healthcare AI related researches and developments. This dataset... mirrors accurately the complexity and structural detailing of the real-world healthcare and hospital data. The dataset includes 5,000 synthetic patient-records, that are statistically and structurally plausible but non-identifiable, with one or more encounters, each associated with a set of workflow tasks (e.g., triage, imaging orders and reports, discharge summaries, billing coding, claim submission) and a triage encounter with vitals and medical history, along with governance records. Class imbalance reflective of real ED triage was engineered — approximately 30% high-risk."

For the triage risk model, a Gradient Boosting classifier is trained on the synthetic triage dataset, using age, sex, chronic conditions, prior ED visits, and vitals as predictors. Agentic components are implemented as Lightweight Python Classes: a Triage Risk Agent wrapping the trained model, a Workflow Optimization Agent computing time savings per task, a Compliance Logging Agent recording orchestrated actions, and an Agent Orchestrator coordinating them with policy checks.

The model selection process is based on five criteria: Task Suitability, Controllability, Interoperability, Privacy Compatibility, and Compliance Readiness. The paper adopts a hybrid stack comprising: TRIAGE‑RISK‑ML, LOS‑PREDICT‑ML, OPS‑SCHEDULE‑OPT, DOC‑SUM‑LLM, POLICY‑RAG‑LLM, CODE‑ASSIST‑ML, and FED‑CONSORT‑MODEL, exposed as reusable services to the orchestration layer rather than embedded as application‑specific point solutions.

The working principle: "The system works by receiving a hospital task request, classifying the request type, assigning it to the appropriate agent, checking policy constraints, executing or suggesting an action, and then logging the outcome for audit and monitoring... The architecture is designed so that every action leaves a traceable record."

"The triage risk estimation agent, powered by a gradient-boosted decision tree (XGBoost) model trained on synthetic Emergency Department (ED) encounter data with 47 clinical and demographic features, achieved strong predictive performance on a held-out evaluation set. The model demonstrated an ROC-AUC of 0.892, Accuracy of 82.7%, Precision of 76.3%, Recall of 61.5%, and F1 score of 0.681 for high-acuity case identification."

"The proposed seven-layer compliance-first agentic AI platform was deployed under controlled and supervised conditions in three live hospital setups equipped with a 450-bed tertiary-care facility with integrated emergency, surgical, imaging, and ambulatory services. The deployment spanned 18 months... The platform successfully integrated with the hospital's existing HIMS ecosystem, including a major EHR vendor system, a Picture Archiving and Communication System (PACS) archive, laboratory information system (LIS), and revenue-cycle management platform, using standardised FHIR R4 and HL7v2 interfaces mediated through the Privacy-Preserving Data Fabric."

Integration of the agentic platform into end-to-end hospital workflows produced measurable time reductions across eight core operational tasks. Specifically: "triage assessment time which decreased by 30% (from 67 to 47 minutes average per shift), bed assignment coordination by 56% (from 48 to 21 minutes), imaging order placement by 7% (from 32 to 19 minutes), and discharge summary generation by 31% (from 195 to 135 minutes per case). Billing and coding verification dropped by 36%, and claims submission coordination by 26%."

A five-year total-cost-of-ownership (TCO) and return-on-investment (ROI) analysis was conducted comparing the siloed point-solution deployment model against the proposed Agentic AI platform architecture. The results: "By Year 3, the platform cost curve is predicted to cross below the siloed baseline; by Year 5, cumulative cost savings would exceed USD 8.2 million, which is nearly 67% relative to continued siloed deployment, for the pilot hospital, with ROI gains indexed to 113 points above baseline."

Operational savings breakdown: "documentation burden reduction (valued at USD 3.1 million over five years based on clinician time reclaimed), reduced integration and maintenance labour (USD 2.8 million), and lower governance and compliance overhead due to centralised, automated policy enforcement (USD 2.3 million). Revenue-cycle improvements from more accurate coding and faster claims submission contributed an additional USD 1.4 million in net present value."

"The platform achieved 95% coverage of HIPAA Security Rule safeguards, 92% of GDPR technical and organisational measures, 88% of EU AI Act high-risk obligations, 90% of DPDP Act requirements, 85% of DISHA draft clauses, 94% of ISO/IEC 27001 controls, and 87% of ISO 14971 risk management requirements."

The comparison to siloed tools: "Siloed tools achieve 15–42% coverage across regulatory frameworks because compliance obligations are addressed reactively, per-project, and inconsistently... The agentic platform, by contrast, treats compliance as a reusable architectural service, encoding regulatory clauses as enforceable rules in the Compliance and Policy Layer that apply automatically to every agent, every data access, and every model inference."

"Effort-unit analysis shows that data integration effort drops by 71% (from 85 to 25 units), access control by 77% (78 to 18), audit trail configuration by 77% (65 to 15), and policy enforcement setup by 78% (55 to 12) when moving from siloed to platform deployment. The cumulative effect is a 70–80% reduction in integration effort for each new AI agent added to the portfolio."

Documentation burden... decreased by an average of 4.2 hours per clinician per week, representing a 31% reduction relative to baseline. Specific savings: discharge summaries where 56 minutes saved per case, for progress note generation the reduction was 22 minutes per case, and for coding validation it was 18 minutes per case. Clinicians reported that AI-generated drafts were 'clinically accurate and required only minor edits' in 78% of cases. Survey results: "System Usability Scale score increased from 58.3 to 74.6 with p < 0.001, and a reduction in self-reported technology-related stress, where the burnout inventory technology subscale decreases from 3.8 to 2.9 on a 5-point scale with p < 0.01."

Three privacy-enhancing technologies were instantiated: "federated learning client support for cross-site model training without centralising patient records, differential privacy noise injection for aggregate analytics queries; and hardware-based secure enclave processing for high-sensitivity inference tasks. The federated experiment: a readmission risk model across institutions without sharing raw encounter data. The federated model achieved ROC-AUC 0.83, compared to 0.81 for a hospital-specific model trained on local data alone. Differential privacy was applied with Epsilon = 2.0, and secure enclave processing for high-risk inferences (e.g., HIV status prediction, psychiatric risk scoring) incurred < 15% latency overhead relative to standard GPU inference."

"The Agent Orchestration Layer coordinated 12 domain-specific agents across clinical (triage risk, imaging order prioritisation, discharge planning), operational (bed assignment, staffing optimisation), and financial (coding validation, claims submission) workflows. An end-to-end ED pathway was validated: an ED encounter... triggered sequential activation of the triage risk agent (acuity assessment), bed assignment agent (resource allocation), imaging order agent (diagnostic pathway), lab processing agent (specimen tracking), documentation agent (note generation), coding agent (billing validation), and claims agent (payer submission)."

Critic-agent verification reduced discharge summary error rate... by 42% relative to single-agent generation. The orchestration layer's event-driven architecture (Apache Kafka message queues, FastAPI-based agent endpoints) sustained peak loads of 340 concurrent patient encounters without degradation in response time or agent availability.

Based on the paper, here are specific improvements for AI systems in hospital settings, and what the enhanced system can do:

1. Add a compliance and policy layer as an executable control plane. Encode regulatory requirements (HIPAA, GDPR, EU AI Act, DPDP, DISHA) into policy-as-code rules that govern data access, tool usage, logging, and model lifecycle.

2. Implement a multi-agent orchestration layer with domain-specific agents plus critic/verifier agents. Coordinate triage, imaging, bed assignment, documentation, coding, and claims agents via shared schemas and event-driven messaging.

3. Build a privacy-preserving data fabric that unifies heterogeneous data sources. Use FHIR R4/HL7v2 interfaces, de-identification, federated learning endpoints, differential privacy injection, and hardware secure enclaves as pluggable components.

4. Adopt a model registry and governance layer with lifecycle monitoring. Include inventory oversight, validation, post-deployment monitoring, and audit readiness aligned with ISO 42001/ISO 14971.

5. Make jurisdiction-specific deployment a configuration choice, not a separate codebase. Use policy configuration and deployment topology (on-premise, hybrid, compliant cloud) to satisfy DPDP/DISHA, GDPR, and HIPAA.

6. Integrate AI agents with existing HIMS, PACS, LIS, ERP, and HCM systems through standardized interfaces. Replace point-to-point siloed integrations with a shared data fabric and reusable agent services.

7. Apply federated learning with differential privacy and secure enclaves for cross-institution model training. Train readmission risk models without centralizing patient records, with adjustable privacy budgets (ε).

8. Design for compliance coverage measurement across regulatory frameworks. Automatically track coverage of safeguards, controls, and obligations to identify gaps early.

9. Use synthetic but structurally realistic data (Synthea) for development and validation where real PII/PHI is unavailable. This enables safe prototyping and class-imbalance engineering for triage models.

10. Incorporate critic-agent verification for AI-generated outputs. For example, a critic agent reduces discharge summary errors by checking clinical accuracy before finalization.

• Automate end-to-end clinical, operational, and financial workflows — from patient arrival (triage risk scoring, bed assignment, imaging orders) to discharge (summary generation, coding validation, claims submission) — with measured time savings: 30% in triage, 56% in bed coordination, 31% in discharge summaries, and 36% in billing verification.

• Reduce clinician documentation burden by an average of 4.2 hours per clinician per week (31% reduction), generating drafts that are clinically accurate with only minor edits in 78% of cases, and improving usability (SUS score from 58.3 to 74.6).

• Ensure every action leaves a traceable audit record — automatically logging agent decisions, data access, and policy checks for audit and regulatory review.

• Achieve 85–95% design-time coverage of major regulations (HIPAA, GDPR, EU AI Act, DPDP, DISHA, ISO 27001, ISO 14971) through centralized policy enforcement, versus 15–42% for siloed tools.

• Train models across hospitals without sharing raw data via federated learning (e.g., readmission risk model reaches ROC-AUC 0.83 vs 0.81 locally) while applying differential privacy (ε=2.0) and secure enclave processing with <15% latency overhead for high-sensitivity tasks.

• Reduce integration complexity by 70–80% for each new AI agent added, cutting data integration effort from 85 to 25 units, access control from 78 to 18, audit configuration from 65 to 15, and policy setup from 55 to 12.

• Scale to hundreds of concurrent encounters — event-driven orchestration sustained 340 concurrent patient encounters without degradation, coordinating 12 domain-specific agents in a live 450-bed hospital deployment.

• Save costs significantly — five-year cumulative savings exceed USD 8.2 million (67% reduction) compared to siloed point solutions, from reduced documentation burden, integration/maintenance labor, governance overhead, and revenue-cycle improvements.

• Operate across jurisdictions with the same codebase — data localization for India (on-prem), residency controls for the EU (hybrid cloud), and HIPAA-eligible cloud (AWS GovCloud/Azure Government) with business associate agreements for the US.

• Optimize operations beyond clinical care — scheduling agents integrated with HCM (Workday) reduce manual adjustments by 23%; ERP-connected supply chain agents reduce stockouts by 34% and excess inventory carrying cost by 19%.

Hospitals are rapidly adopting artificial intelligence for triage, imaging, scheduling etc., yet most deployments remain isolated point solutions locked inside departmental silos, resulting in duplicated effort, hidden risks, and unrealized enterprise value. Despite explosive growth of AI in healthcare market and accelerating investment, an estimated 70-80% of healthcare AI pilots fail to scale, largely due to governance gaps, fragmented data, and missing integration blueprints. This research proposes a hospital-specific, compliance-first, Agentic AI architecture with multiple interoperable layers, extending existing hospital AI platform models with: (i) an Agent Orchestration Layer for multi-agent workflows across clinical, operational, and financial domains, (ii) a Compliance and Policy Layer that centralizes policy-as-code for HIPAA, GDPR, the EU AI Act, DISHA Act, India's DPDP Act, and ISO/IEC security and safety standards, and (iii) a Privacy-Preserving Data Fabric that plugs federated learning, differential privacy, and secure enclaves into real-world Hospital Information Management System (HIMS) flows. Using a synthetic but structurally realistic hospital dataset and an open, ready-to-deploy prototype implementation, this study demonstrates the end-to-end orchestration of triage risk prediction, workflow optimization, and compliance logging, achieving substantial simulated reductions in task turnaround times and manual documentation effort while maintaining policy-guarded data access. The resulting architecture offers hospital leaders a pragmatic blueprint to move from ad hoc tools to a governed, globally compliant, ROI-focused AI platform that can be tailored to on-premise, hybrid and cloud-native deployments.