7 red flags an engineer should catch in a healthcare AI vendor

You're the one who has to make it safe in production, so you're also the one who should catch these. Seven technical red flags in a healthcare AI pitch.

1. "Fully autonomous" as the headline — no per-action gating means no way to hold irreversible operations. Autonomy should be per-action metadata, not a global mode.
2. "HIPAA-certified" — a claim tell. Ask which controls map to which safeguard; a real answer is specific, not a badge.
3. No citation on decisions — if outputs aren't grounded with a source enforced at the output layer, you can't defend them.
4. HITL as a callback, not a durable interrupt — "review later" doesn't halt the action; a real gate does.
5. PHI handling described "at the end" — redaction belongs on the input path, before prompt assembly. Order matters.
6. No exportable audit log — request → retrieval → decision → approver, append-only, or "who decided this" is unanswerable.
7. Unsourced benchmarks — round-number automation claims with no methodology are noise.

Flip all seven and you have the spec for a governed healthcare AI agent. That's what we build at IntelliBooks Studio — more at intellibooks.ai/overview.