Clinical NLP Governance — Air-Gapped Managed Service for VA/DoD/Hosp

Every healthcare CIO and CISO running an air-gapped, FedRAMP-High, or IL5/IL6 environment has the same problem: HealthLake, Bedrock, Comprehend Medical, Nuance DAX, and Watson Health are unavailable, deprecated, or blocked at their perimeter — yet clinical research, revenue cycle, and quality programs that rely on clinical NLP cannot pause waiting for a public-cloud path.

VA medical centers (150+ facilities), DoD Defense Health Agency facilities on MHS GENESIS / Oracle Health (Cerner), rural + critical-access hospitals, correctional medical, tribal health (IHS), academic medical centers with sovereign-data research, and international hospitals under data-residency rules (Singapore MoH, UK NHS Digital, Germany BSI) all share one requirement —PHI cannot leave the Customer's network, but modern clinical NLP is still required. Compliance is layered: HIPAA + 42 CFR Part 2 + 38 USC 7332 + 10 USC 1079/1086 + VHA Handbook 1605.01 + FedRAMP + DoD SRG IL + FIPS 140-3 + Section 508 + NIST SP 800-171/800-53 Rev 5 + ATO, simultaneously.

Every clinical NLP offering on AWS Marketplace today requires public-cloud or is platform-specific. Comprehend Medical is public-cloud only. John Snow Labs bills by vCPU-hour at $1.86–$253.56/hr with Customer operating the software. Commercial clinical NLP (Linguamatics/IQVIA, Averbis, Clinithink, 3M/Solventum, Philips IntelliSpace) runs $150K–$500K/yr ACV with heavy licensing and no AWS Marketplace managed service. Nuance DAX is ambient-scribe at $369–$830 per provider per month with a cloud dependency air-gapped + IL5/IL6 cannot accept.

Nothing on AWS Marketplace today delivers a fixed-fee, air-gap-compatible, managed clinical NLP service with a transparent monthly tier and a federal posture (SAM.gov + CAGE + FedRAMP-eligible patterns). This listing closes that gap.

Kriv is SAM.gov registered (UEI DATARJAUUXQ2, CAGE 1AEF1, March 25, 2026). The managed service operates a self-hosted clinical NLP toolkit on Customer infrastructure: air-gapped, on-prem, VPC-isolated AWS, Outposts, or GovCloud, with all PHI inside Customer's ATO boundary. Kriv operates the software; Customer does not redistribute. Methodology-reference stack, not a productized Kriv platform.

Reference stack (modular). Microsoft Presidio + scispaCy + MedCAT for PHI de-identification and clinical NER; Ollama / vLLM / llama.cpp for local LLM inference (Mistral, Llama 3, BioMistral, Meditron, no public-cloud inference by default); pgvector or Qdrant for embeddings; MinIO or Customer S3 for object storage; Prometheus + Grafana; HIPAA §164.312(b) audit logging; FIPS 140-3 cryptography.

Two phases. Phase 1: Discovery & Deployment ($40K one-time, 4–6 weeks; 90-day lead for federal/DoD): site + network + security review, install on Customer infrastructure, de-id tuning, i2b2 2014 + n2c2 benchmarks (target recall ≥95% / precision ≥99% on i2b2 2014), admin training for 5 staff, handover. Phase 1 required before Phase 2.

Phase 2: Monthly Managed Service: ops, monitoring, patching, IR. 12-month minimum term.

Three monthly tiers. Essentials $5K/mo (8x5 email, synthetic probe monitoring, quarterly security updates, drift checks, monthly ops report; ≤100K docs/mo). Standard $10K/mo (adds 24x7 on-call, 4-hr Sev-1 SLA, 99.5% uptime, monthly drift-retraining, quarterly HIPAA/de-id attestation; ≤500K docs/mo). Enterprise $15K/mo (adds quarterly fine-tuning, 0.25 FTE dedicated engineer, 99.9% uptime, annual NLP governance review, priority IR, FedRAMP-ready + NIST AI RMF artifacts; unlimited volume). 3-year 10% / annual prepay 8% via private offer. First-year ACV floor $100K.

Important disclosures. Kriv is not a CLIA lab, radiology reader, CDS provider, FDA-registered medical device manufacturer, utilization-review organization, or CRO; non-diagnostic clinical NLP only. No legal / regulatory / clinical / compliance advice. No FedRAMP / IL5 / IL6 ATO guarantee, ATO owned by Customer's Authorizing Official; Kriv produces support artifacts only. No per-record de-id accuracy guarantee, target benchmarks are stack-level; Customer's HIPAA Privacy Officer retains §164.514 Safe Harbor / Expert Determination authority. Kriv is NOT 8(a) / HUBZone / SDVOSB / WOSB / VOSB, set-asides require subcontracting through certified partner. Open-source operated by Kriv on Customer infrastructure; Customer does not redistribute. MinIO AGPLv3 reviewed in Discovery; SeaweedFS / Ceph / Customer S3 substitution available. Infrastructure costs Customer's responsibility. Portfolio 01D is early-stage methodology reference, not a productized platform. Claude is NOT in default scope (local models only); optional Bedrock Claude integration scoped separately.