Sherpa

Sherpa is your HIPAA compliance guide. It answers plain-language questions about your program — "are we ready for an OCR audit?", "which vendors are missing a BAA?", "where are we weakest?" — and cites the figures it used.

How it stays grounded

Every answer is generated from a snapshot of your organization's own data: your compliance score and its five dimensions, open findings by severity, overdue remediation, vendor/BAA coverage, policy review status, and open risks. Sherpa is instructed to answer only from that snapshot and to say so when the snapshot doesn't contain the answer — it will not invent counts or dates, and it distinguishes what your data shows from professional inference.

What it does and doesn't see

Sees: aggregate counts, short titles/labels, and your score. No patient data (PHI) and no free database access are ever sent to the model.
Single-turn: each question is answered independently from a fresh snapshot — it isn't a memoryful chatbot, so include the context you need in each question.
Resists manipulation: your question and the snapshot are treated strictly as data. Text that tries to change Sherpa's task, dictate an answer, or extract its instructions is ignored, and Sherpa answers conservatively.

Today's brief

When AI is enabled, the Sherpa page leads with a daily brief: a short list of what changed in your program in the last day (posture movement, new findings, newly-overdue tasks, stale evidence) plus the single highest-leverage step to take next. The "what changed" lines are computed directly from your data and are exact; the recommended step is AI-generated from your grounded snapshot. A daily cron also notifies org admins when something material changes (this follows your weekly digest notification preference).

Evidence radar

The evidence radar is a deterministic, no-AI view of two audit risks:

Stale evidence — files past their review date or expiry that haven't been superseded by a newer version.
Gaps — questions you answered "yes" or "partial" that an auditor expects evidence for, but where nothing is attached.

Both are computed straight from your evidence dates and answers — there is no model involved, so the lists are exact. Each row links straight to where you fix it: a gap jumps to the question so you can attach evidence, and a stale item jumps to it in the Evidence library to refresh.

Notes

Answers are AI-generated and stream in as they're written. Treat them as a fast read on your posture, and verify before relying on one for a compliance decision.
Each answer has a 👍 / 👎 "Was this helpful?" control — your rating is private to your organization and helps surface which AI features are landing (see Settings → AI Usage).
Sherpa is also one click away from any page via the Ask Sherpa button in the top bar.
Asking a question counts toward your organization's daily AI quota (see Settings → AI Usage). Sherpa is available only when AI features are enabled for your org.
For the full picture of what AI can do across the app, see the AI overview.

Shortcuts

Press <kbd>g</kbd> then <kbd>c</kbd> from anywhere to jump to Sherpa.
On the Sherpa page, <kbd>/</kbd> focuses the question box, <kbd>Enter</kbd> sends it, and <kbd>Esc</kbd> clears and unfocuses it.