AI Triage for Incidental Lung Nodules: Madigan’s PHI-Compliant Ask Sage Deployment

The Problem: Incidental Findings Get Lost in Volume

Pulmonary nodules are small growths in the lung tissue, frequently discovered during imaging ordered for entirely unrelated reasons. Most are benign. Some are not. The clinical stakes are high enough that every identified nodule warrants structured follow-up — additional imaging, specialist referral, or ongoing surveillance depending on risk profile.

The operational reality, however, works against consistency. A busy clinical environment generates an enormous throughput of imaging studies. Manually tracking every incidental finding, cross-referencing patient history, and ensuring timely follow-up is not a workflow problem — it is a systems problem. No amount of clinical diligence fully compensates for the absence of an automated safety net.

The consequence of failure is not abstract. Delayed follow-up on a malignant nodule can mean the difference between early-stage and late-stage lung cancer. In a military population where health directly affects force readiness, that delay carries institutional weight beyond the individual patient.

The Solution Architecture: Registry Plus AI Triage

Madigan’s response was two-layered. First, the establishment of a Pulmonary Nodule Registry — a centralized system designed to capture every identified nodule and ensure no patient falls through the cracks. Second, the integration of the Ask Sage Large Language Model to automate the prioritization of cases within that registry.

Ask Sage is a PHI-compliant AI platform certified and provided through the Defense Health Agency’s J-6 office. Its compliance posture is not incidental to the deployment — it is the prerequisite. Healthcare AI that cannot operate securely within regulated environments is not healthcare AI in any practical sense. The DHA certification establishes the trust baseline that makes clinical adoption possible.

The AI layer performs a specific, bounded function: it analyzes each patient’s medical history, demographic profile, imaging findings, and lifestyle factors — including smoking history — and produces a risk-ranked ordering of cases. Clinicians receive a prioritized queue rather than an undifferentiated list.

After: Risk-Stratified Prioritization

With Ask Sage integrated into the registry workflow, the AI pre-processes incoming cases and surfaces the highest-risk patients at the top of the queue. Clinicians engage with a structured, ranked list rather than raw data.

This does not remove clinical judgment from the equation. It removes the administrative overhead that precedes clinical judgment. The physician still decides — but they decide faster, with better information, and on the cases that matter most first.

Rick Barnhill, Chief Health Information Officer at Madigan, framed the operational intent clearly: the goal is to increase efficiency in care delivery and expand access — not just for Madigan’s patient population, but as a replicable model for the broader Military Health System.

Why PHI Compliance Is the Critical Differentiator

Deploying AI in a healthcare setting is not simply a technical challenge — it is a regulatory and ethical one. Patient health information is among the most sensitive data categories in existence. Any AI tool operating on that data must meet stringent standards for access control, data handling, and auditability.

Ask Sage’s PHI-compliant architecture addresses this directly. The platform is designed to operate securely within healthcare environments, meaning clinical teams can leverage its analytical capabilities without exposing patient data to uncontrolled external systems. For a military medical center operating under Defense Health Agency oversight, this compliance posture is non-negotiable.

The DHA J-6 certification also signals something broader: institutional validation. When a tool is certified at the agency level, individual facilities do not need to rebuild the compliance case from scratch. Adoption becomes faster, and the path from pilot to system-wide deployment becomes shorter.

Risk Stratification in Practice: What the AI Evaluates

The Ask Sage deployment at Madigan does not operate as a black box. Its triage logic draws on a defined set of clinical and demographic variables:

• Imaging findings — nodule size, morphology, and location as documented in radiology reports
• Medical history — prior diagnoses, comorbidities, and previous imaging results
• Demographic data — age and sex, both established risk factors in lung nodule assessment
• Lifestyle factors — smoking history, which significantly elevates malignancy risk

By synthesizing these inputs, the model produces a risk score that reflects established clinical guidelines for pulmonary nodule management. The output is not a diagnosis — it is a triage signal. The distinction matters, both clinically and legally.

This bounded scope is a design strength, not a limitation. AI tools that attempt to do too much in clinical environments introduce liability and erode clinician trust. A tool that does one thing well — rank-order cases by urgency — integrates cleanly into existing workflows without disrupting clinical authority.

Lessons for Healthcare AI Adoption

Madigan’s deployment offers a replicable framework for healthcare organizations evaluating AI integration. Several principles stand out.

Start with a defined, high-stakes problem. Incidental finding management is a well-understood failure mode in clinical operations. The problem is specific, the consequences of failure are measurable, and the value of improvement is clear. AI tools deployed against vague or poorly scoped problems rarely demonstrate meaningful impact.

Compliance is not a phase — it is a foundation. The Ask Sage deployment succeeded in part because the compliance infrastructure was established before clinical rollout, not retrofitted afterward. Organizations that treat PHI compliance as a checkbox risk both regulatory exposure and clinician resistance.

Design for augmentation, not replacement. The Madigan model explicitly positions AI as decision support. Clinicians retain authority; the AI reduces the cognitive and administrative load that precedes their decisions. This framing is both ethically sound and practically effective — it accelerates adoption by removing the threat perception that often slows AI integration in clinical settings.

Build for scale from the start. Barnhill’s stated ambition is not a single-facility improvement — it is a model for the Military Health System. The registry and AI layer were designed with portability in mind. That orientation shapes architectural decisions early and avoids the costly rework that comes from retrofitting a local solution for broader deployment.

The Broader Signal for Military and Civilian Healthcare

Madigan’s Pulmonary Nodule Registry is a relatively narrow application — one use case, one facility, one category of incidental finding. But it demonstrates something with wide implications: that PHI-compliant AI can be deployed in high-stakes clinical environments today, not in some future state of regulatory clarity.

The Defense Health Agency’s role in certifying and providing Ask Sage also points toward a model of centralized AI governance that other large healthcare systems — integrated delivery networks, national health services, academic medical centers — might usefully study. Centralized certification reduces redundant compliance work and accelerates adoption across distributed facilities.

For the patients at the center of this — service members, their families, military retirees — the practical outcome is straightforward: a higher probability that an incidental finding on a chest X-ray leads to timely follow-up rather than administrative silence.

Closing Reflection

The most consequential AI deployments in healthcare will not be the ones that generate headlines for their ambition. They will be the ones that quietly close the gaps where patients fall through — the incidental findings that get documented and forgotten, the follow-up appointments that never get scheduled, the risk signals that surface too late.

Madigan’s Ask Sage deployment is precisely that kind of work. Unglamorous in scope, rigorous in execution, and meaningful in outcome. It is a useful reminder that in clinical AI, precision and compliance are not constraints on innovation — they are the conditions that make innovation trustworthy enough to actually use.