Buy Template
New
11 days
for the security review, against 60 planned
62%
lower cost per supplier invoice
0
patient records reachable by agents
At a glance
Company
Ashgrove Health
Size
3,800 employees · 40 outpatient clinics in three states
Agents
Tessa, Milo
Systems connected
ERP, credentialing system, identity provider, email
Live in
28 days
The challenge
Ashgrove runs 40 clinics, and each one generates supplier invoices for everything from gloves to imaging maintenance: about 9,000 a month, processed by a central team of 14. Credentialing a new clinician took three weeks of chasing licenses and references by email. The CISO, Peter Lindgren, had turned down two automation vendors the year before. One couldn’t say where data was stored; the other wanted broad access to systems that also held patient records.
What they put in place
Ashgrove’s security team reviewed Wardlow before any workflow was chosen. The security pack answered most of their questionnaire, and two calls with Wardlow’s Head of Security & Trust covered the rest.
Agents were given their own accounts, with access only to the ERP, the credentialing system and two shared inboxes. The patient records system was left out entirely. Tessa matches supplier invoices to purchase orders and receipts; Milo collects licenses, references and training certificates from new clinicians and verifies them. All data is hosted in the US region under a business associate agreement.
Rollout
Week 1: Security review starts, with the security pack and a data-flow walkthrough.
Day 11: Security approval, with agent access limited to named systems.
Days 12–18: Read-only connections; guardrails replayed against a month of invoices.
Days 19–27: Shadow mode for invoices, with clinician onboarding in parallel.
Day 28: Both workflows live.
Results
The security review closed in 11 days, against the 60 Ashgrove had planned for. Cost per supplier invoice fell 62% over the first two quarters, and the invoice team moved three people into supplier negotiation. Credentialing a new clinician now takes 8 days instead of 21.
Agents have never had access to patient records, and every access they do have is listed in one place for the annual audit.
We gave Wardlow the questionnaire we use for vendors that touch patient data, even though they wouldn’t. They answered every question in writing, and their agents can only reach the systems we named.
Peter Lindgren
Chief Information Security Officer
Wardlow
Agents that do the work. People stay in charge.
Floor 4, 612 Bryant Street, San Francisco, CA 94107
SOC 2 Type II · ISO 27001 · GDPR · HIPAA
© 2026 Wardlow, Inc.
Crafted
by Jeeth