AI & Machine Learning Company in Salt Lake City

Ranges tied to scope, because the data assessment usually determines the total more than the modeling does. A data readiness and feasibility engagement, meaning lineage mapping, quality and leakage audit, label review, and a written go or no-go with a proposed baseline, runs USD 20,000 to 45,000 over four to six weeks and regularly saves clients from funding a model that the data cannot support. A single production model with a real pipeline, evaluation suite, model card, deployment endpoint, and monitoring runs USD 75,000 to 220,000 depending on data condition and regulatory overhead. Computer vision on whole-slide imaging or phenomics-scale datasets sits at the top of that band and sometimes above it because of storage, compute, and annotation costs. A full ML platform build with feature store, training pipelines, model registry, CI for models, and drift monitoring across a portfolio runs USD 250,000 to 700,000 across phases. Annotation budgets for clinical data are a separate line item and we quote them separately rather than hiding them.

There are exactly two lawful routes under the HIPAA Privacy Rule and we pick one explicitly rather than blending them. Safe Harbor requires removing all eighteen enumerated identifiers, including dates more precise than year and ages over 89, and it is deterministic, auditable, and often too lossy for time-series clinical modeling because it destroys the temporal resolution the model needs. Expert Determination has a qualified statistician assess and document that the re-identification risk is very small given the recipient and the context, which preserves far more signal but requires a real assessment and a written report your privacy office keeps. For most Intermountain-class and University of Utah Health-class modeling work we recommend Expert Determination with date shifting applied consistently per patient so intervals survive. Where de-identification is not viable, the alternative is a limited data set under a data use agreement, or keeping identified data inside your perimeter under a business associate agreement and training in place. Genomic data deserves separate treatment: whole-genome sequence is not meaningfully de-identifiable, so it stays inside the covered entity's controlled environment, and GINA restricts what employers and health insurers may do with it regardless of how the data was obtained.

Mostly not, and the distinction matters when you are budgeting compliance work. SB 149, signed March 13 2024 and effective May 1 2024, is written around generative artificial intelligence, meaning systems that produce text, images, audio, or video in response to a prompt. A gradient boosted tree that scores readmission risk or a convolutional network that flags a cell phenotype does not produce the kind of output the statute addresses, so the disclosure duties as amended by SB 226 in 2025 generally do not attach. What does attach to predictive models is everything else: the Utah Consumer Privacy Act where consumer personal data is in the training corpus, HIPAA where protected health information is involved, ECOA and Regulation B where the model influences credit decisions, EEOC guidance where it touches employment, and FDA oversight where it functions as a medical device. The trap we see is hybrid systems. If a predictive model feeds a generative layer that then explains the score to a consumer in a health or financial context, the generative surface is in scope for high-risk interaction disclosure and the whole system needs the review. We scope that boundary in discovery and write it down.

The dividing line is what the software claims to do and whether a clinician can independently review the basis for its output. Under the 21st Century Cures Act amendments to the Food, Drug, and Cosmetic Act, certain clinical decision support software is excluded from device regulation when it displays or analyzes medical information, provides recommendations rather than a specific directive, and presents the basis so the clinician does not rely primarily on the software. A sepsis model that outputs an opaque risk score driving an automatic order is on the device side of that line. A model that surfaces contributing factors and supporting evidence for a clinician to weigh usually is not, though the analysis is fact-specific and belongs to your regulatory affairs team rather than to us. Where a build is headed for a device pathway, the work changes shape: design controls under 21 CFR Part 820, documented software lifecycle processes, a defined intended use statement, clinical validation on a population that matches the deployment setting, and increasingly a Predetermined Change Control Plan so the model can be updated without a new submission each time. We build to that documentation standard when it applies and we tell you plainly when we think it applies.

This is the most common blocker in Salt Lake City engagements and there are five honest paths. First, reframe the target. Teams often ask for a label nobody records while a proxy sits in the data already, such as using time-to-next-encounter instead of an unrecorded outcome flag. Second, transfer learning. For imaging, a foundation model pretrained on natural images or on a public biomedical corpus, then fine-tuned on a few thousand of your examples, routinely beats training from scratch on your whole dataset. Third, weak supervision. Programmatic labeling functions written by your subject matter experts, combined with a label model, can produce a usable training set in weeks instead of quarters. Fourth, active learning. Label the examples the model is least certain about rather than a random sample, which typically cuts annotation volume substantially for the same performance. Fifth, synthetic data, which works well for rare-event augmentation in tabular and sensor domains and works badly as a substitute for real clinical outcomes, so we use it narrowly and say so. If none of these get you there, the correct answer is a data collection program rather than a model, and we will recommend that instead of billing you for a model that cannot work.

A model that ships without monitoring is a liability with a launch party. We instrument three layers. Input drift watches the distribution of every feature against the training reference using population stability index and Kolmogorov-Smirnov tests, which catches upstream schema changes, a new lab analyzer, a coding practice change, or a source system migration before the model quietly degrades. Output drift watches the prediction distribution and the rate at which predictions cross your operating threshold. Outcome drift watches realized performance against ground truth as it arrives, which in clinical settings can lag by weeks or months, so we build the delayed-label join rather than pretending outcomes are immediate. Alerts route to a named owner on your side, not to a shared inbox, and the runbook states the threshold that triggers investigation and the threshold that triggers rollback to the previous model version. Retraining is scheduled rather than reactive where data volume supports it, with a documented cadence, an automatic evaluation gate against the frozen holdout, and a human sign-off before promotion. Every model version is registered with its training data snapshot, code commit, hyperparameters, and evaluation report so any past prediction can be reproduced.