Quick Take

  • Low‑friction AI coding assistants (Anthropic Claude Code, Claude Opus 4.5, Cursor) now let non‑programmers generate working scripts and mini‑apps from plain language. These are general‑purpose tools, not clinically integrated healthcare products.
  • For informatics and clinical pharmacists, AI speeds ad‑hoc EHR extracts, SQL/Python analyses, and 'glue' automations for automated dispensing cabinets (ADCs) and CSV workflows. Immediate priorities include approved platforms, mandatory code review, audit logs, and clear migration paths to supported systems.

Why it Matters

  • Operational lift: Informatics pharmacists can generate MUEs, ADC reconciliations, and shortage triage in hours rather than days. Before these outputs inform care or P&T decisions, require peer review by an informatics owner and a spot‑check against a source‑of‑truth report, plus change‑detection to flag schema or NDC updates.
  • Data safety: Do not put protected health information (PHI) into cloud prompts. Standardize use of de‑identified samples or BAA‑covered platforms, and require prompt/code archiving in an approved repository under privacy/informatics governance before any script informs care or compliance.
  • Graduation: When a one‑off script runs daily (ADC restocks, diversion flags), treat it as a prototype that must graduate to supported systems. Assign an owner, set a schedule and monitoring, and plan migration; AI suggestions remain inputs to human judgment, not autonomous actions.

Bottom Line

Pilot AI‑assisted coding for low‑risk analytics and lightweight integrations under informatics ownership, using BAA‑approved tools and de‑identified data, with mandatory second‑review before clinical use.


Key Details

  • Operators: Informatics pharmacists, pharmacy data analysts, diversion analysts, and residents generate code in Claude Code or Cursor, then run it on hospital‑managed laptops or virtual desktops behind the firewall.
  • Execution and outputs: Scripts run via Python, R, or SQL clients over local ODBC connections. Results land in secure file shares or are sent through hospital SMTP, not stored in public clouds.
  • Data access: EHR reads come from reporting replicas (e.g., Epic Clarity/Caboodle) using read‑only service accounts over ODBC/JDBC. Near‑real‑time pulls use FHIR (Fast Healthcare Interoperability Resources) exports. ADC data arrives via Omnicell/Pyxis CSVs or vendor APIs, authenticated via VPN, single sign‑on (SSO), or API tokens for least‑privilege service accounts.
  • Failure modes and compliance: Example — a medication‑use evaluation (MUE) script tied to last quarter's ADC CSV may drop new National Drug Codes (NDCs) after a formulary change, causing undercounts. Pasting PHI into cloud prompts sends ePHI offsite, risking inaccurate audits and HIPAA violations without a business associate agreement (BAA).