The Vizient Price File Is Under NDA. The DME Orders Carry Patient Names. Run the AI in Your Own Warehouse.

You already had this conversation in 2024. Somebody demoed a tool that could read your contract file and reconcile your chargeback denials in an afternoon, and it looked genuinely good. Then you asked the only question that mattered — where does the file go — and the answer was a data center somewhere, and your compliance person said no. She was right. That was the correct answer with the tools that existed.

It is no longer the answer, and the reason is not that anyone got looser about data. It is that the same work now runs on a box in your own building.

Three files in your building that legally cannot go anywhere

Every medical and dental supply distributor has a short list of material that is not a matter of preference. It is contractual or statutory, and someone signed for it.

The contract price file. Your tier pricing under a group purchasing agreement — the Vizient, Premier, or HealthTrust line-item pricing you sell against, plus your manufacturer cost and rebate terms — sits under a confidentiality clause in your distribution agreement. Disclosure is a breach, and the remedy in those agreements is usually termination. That file is the single most useful document in your company for answering questions, and it is the one you are least free to hand over.

Patient-identified orders. If any part of your book is durable medical equipment or home medical equipment, you are handling detailed written orders and certificates of medical necessity with a patient name, a date of birth, and a diagnosis code on them. You signed a business associate agreement to touch those. That agreement follows the data to every place you send it, and every place you send it is a place you now have to audit.

The customer license and registration file. State prescription-device licenses, DEA registration numbers, expiry dates, resale certificates. You keep it because you cannot legally ship certain items without it, and it is exactly the sort of file that turns a routine question into a notification event if it walks.

Running the work on your own hardware means the file is read, searched, and answered from inside your four walls, and nothing about it crosses your firewall — the answer comes out, the document never does. That is the entire proposition, and in 2026 it finally performs well enough to be worth the server closet.

What changed since your compliance officer said no

Two things. First, the hardware got good enough to matter: Qualcomm's Dragonwing-class processors put genuinely capable local processing into a small, quiet, ordinary-looking machine, and running high-volume work locally now costs roughly 90% less than sending the same volume to a cloud service. Second, and more persuasive to a skeptical owner: the big enterprises stopped treating on-premises as the legacy option. Cisco, rolling a personal AI agent out to about 90,000 employees, explicitly emphasized on-premises operation for control and data protection. When a company that size chooses the local box for the sensitive material, a 40-person distributor is not being paranoid by doing the same.

flowchart TB
  subgraph inside["Inside your building"]
    A["Manufacturer chargeback denial file arrives"] --> B["Local assistant matches each denial to the GPO contract line"]
    B --> C{"Contract price supports the claim?"}
    C -->|Yes| D["Rebill packet drafted with contract reference"]
    C -->|No| E["Flagged for the contract analyst to research"]
  end
  D --> F["Analyst signs and resubmits the EDI 844"]
  E --> F
  F --> G["Recovery posted against the customer contract in Prophet 21"]

Tuesday in the contracts office

The chargeback cycle is where this pays for itself first, because it is the highest-value repetitive reading job in a distribution business and it touches the one file you cannot export.

Here is how it goes today. You sell a case of sutures to an account on a group purchasing contract at the contract price, well below your acquisition cost. You submit the EDI 844 claiming the difference back from the manufacturer. Some weeks later the 849 comes back and a chunk of your claims are denied or short-paid, with reason codes: member not eligible on that date, contract not effective, price mismatch, unit-of-measure discrepancy, ship-to not on the roster. Your contract analyst — one person, sometimes a part-timer — works the denial file line by line against the contract and the membership roster, recovers what she can get to, and writes off what she cannot reach before the resubmission window closes.

With the local box, that Tuesday looks different. The denial file lands in the morning. The assistant reads every line against the contract file sitting on your own server, groups the denials by reason code rather than by line, and builds two piles: claims where the contract text and the effective dates plainly support you, and claims where something genuinely does not line up. The first pile arrives as drafted rebill packets with the contract section referenced. The analyst reviews and resubmits in a morning instead of working the file for three weeks and running out of time. The second pile is the actual work, and she now has time to do it — calling the manufacturer's contract administrator about the eleven lines where the member roster is wrong.

The price file never left the building. That is not a footnote; it is the reason this was possible at all.

The box in the closet versus doing nothing

Illustrative numbers for a distributor with $12.6 million a year in contract-eligible sales. Assume monthly chargeback claims of $240,000, a denial and short-pay rate of 4.1%, and one analyst who currently gets through about 55% of the denial file before the window closes.

Assumed hardware: about $6,400 for the machine plus $1,100 of setup, three-year life. The payback is inside the first two months on chargebacks alone, before you count the same box answering license-file and contract-price questions for the order desk all day. Prove it the boring way: pick one month's denial file, work it the way you work it now, and separately let the assistant sort it. Compare recovery dollars. If the recovery rate does not move, the contract file you loaded is out of date, which is worth knowing on its own.

Where the local box is the wrong tool

It is not the answer for everything, and pretending otherwise is how these projects get resented. A local machine sized for a 40-person distributor handles document reading, matching, and drafting well. It is not where you go for a piece of long, difficult reasoning — drafting a response to a warning letter, restructuring a contract. For that, use a strong cloud service, with material you have deliberately stripped of anything confidential first.

It also needs an owner. Somebody in your building has to patch it, back it up, and notice when it stops. If your IT is one contractor who comes in on Thursdays, write that into the arrangement before you buy, because an unmaintained box in a closet is a liability with a power cable.

And it does not remove your obligations. Running locally makes the confidentiality story simple, but you still owe your business associate agreement the same access controls, the same logging, and the same breach procedure — now with your name on the server instead of a vendor's. Several state AI statutes that took effect on 1 January 2026, including Texas and California rules, apply to what a system does, not to where it is plugged in.

Monday's first step: ask your controller for last month's chargeback denial file and count two numbers — total denied dollars, and how much of it anyone actually got to before the window closed. That gap is your budget.

Frequently asked questions

What does a box like this actually look like in the building?

A single machine roughly the size of a small tower, sitting in the same closet as your Prophet 21 server, on a battery backup. Nobody in the warehouse knows it is there. It draws less power than the fridge in the break room.

Does keeping it local mean it is worse at the work?

For reading your documents, matching denial lines to contract lines, checking license expiries, and drafting standard letters — no, and this is the change from 2024. For open-ended writing and hard analysis, a cloud service is still noticeably stronger. Most distributors end up with both and a written rule about which material goes where.

Can I keep patient-identified DME orders on it under my business associate agreement?

Generally that is much easier to justify than sending them out, because there is no new subcontractor to paper and no new place for the data to live. Do not treat that as legal clearance — take your agreement to counsel — but the conversation is far shorter than the one about a cloud vendor.

What happens when the machine dies during the chargeback window?

Your analyst goes back to working the file the way she does today, which is a slow month, not a stopped one. Keep the manual process documented for exactly that reason, and buy a spare-parts arrangement rather than assuming next-day replacement.

One thing that stays outside the building on purpose is your phone line. CallSphere builds voice and chat agents that answer the order desk and web chat around the clock, take reorders and capture leads, and pass anything touching contract pricing, a license file, or a patient-identified order to the person inside your building who is allowed to see it.