Ascent by Linnear
Your clinicians already use AI. Give it your systems, on your terms.
Ascent connects Claude and other agents to your EHR, PACS, claims and exchanges. It runs on your network, follows your policy, and no patient data reaches Linnear.
Pre-launch, and now onboarding a small group of design partners.
Example sessions. Patients appear only as tokens.
Draft the prior auth for my 2:30's lumbar MRI.
-
ehr_get_schedule2:30 PM, PATIENT_7f3a, follow-up for low back pain -
ehr_search_notes4 notes since Aug 2026, physical therapy and NSAIDs documented -
pacs_search_studiesXR lumbar spine, Aug 12, 2026 -
claims_get_payer_rulesLumbar MRI needs 6 weeks of conservative care or a red flag
PATIENT_7f3a meets the payer's criteria for a lumbar MRI without contrast: 8 weeks of physical therapy and NSAIDs without improvement, radicular pain in the left L5 distribution, and X-rays on Aug 12, 2026 that ruled out fracture.
Generated Draft
Prior Authorization Request
Procedure: CPT 72148, MRI lumbar spine without contrast
Diagnosis: ICD-10 M54.16, radiculopathy, lumbar region
Justification: 8 weeks of failed conservative care, worsening radicular symptoms
Built from 4 notes, 1 imaging study and the payer's imaging policy
The draft is ready for your review. Submitting it needs your approval.
Allow claims_submit_prior_auth from Ascent?
Submit the prior auth for PATIENT_7f3a, CPT 72148, to the payer
Physicians complete about 40 prior authorizations a week, taking about 13 hours of physician and staff time.1
Providers spent nearly $18 billion in 2023 fighting denials of claims that insurers ultimately paid.2
In a survey of 91 academic radiology chairs, 16.5% preferred repeating outside imaging studies over importing them into PACS.3
The Problem
AI Is Already in Your Hospital
Clinicians use general-purpose AI for notes, letters and appeals, often on accounts IT never approved. In a December 2025 survey of 518 hospital providers and administrators, 57% had come across unapproved AI tools at work, and 17% had used one.4
Blocking them moves the work to personal phones, and a separate AI app loses to the one clinicians already have open. Ascent is the governed path. Clinicians keep the agent they use, and IT decides what it can reach.
How It Works
One Server on Your Network
Your agent already knows the coverage rules. Ascent gives it your systems, from a server inside your network that every request passes through.
Outside Your Network
Agent Provider
Gets only what your policy allows: full or tokenized data under your BAA, nothing without one.
Outside Your Network
Linnear
License checks and usage counts. Never tool arguments or results.
Outside Your Network
Agent Provider
Gets only what your policy allows: full or tokenized data under your BAA, nothing without one.
Your Hospital Network
Clinician's Laptop
Agent App
Claude Desktop, Claude Code or another local MCP client, with the Ascent client. Holds no system credentials.
Your VM
Ascent
- Sign-in and roles
- Policy per agent app
- Identifier tokens
- Audit log
Your Systems
Existing Interfaces
- EHR
- PACS
- Claims
- Health information exchange
Outside Your Network
Linnear
License checks and usage counts. Never tool arguments or results.
Step 1
Install on Your VM
Site IT installs Ascent, connects your systems with credentials you already have, and sets who can use which tools.
Step 2
Connect Each Agent App
Clinicians add the Ascent client to Claude Desktop or Claude Code with one command, then sign in with your SSO.
Step 3
Ask in Plain Language
Ascent checks each tool call against your policy, answers it from your systems, and logs it.
Guardrails
Your Policy, Checked on Every Call
Every tool call passes your rules before it reaches a system. Nothing is on until you turn it on.
- Sign-In and Roles
- Every user signs in with your SSO, and roles from your directory groups decide which tools each person can use. Sign-in and roles are the security boundary.
- Read-Only by Default
- Write tools, such as submitting a prior auth, stay off until you enable them for a connector and a role.
- Scoped Tools
- An agent sees only the tools its user is allowed. Anything else is missing from its tool list, and calls to it are refused.
- PHI Levels per Agent App
- Agent apps under your BAA get full or tokenized data, as you choose, and agent apps without one are refused. Tokens map back to patients only on your network.
- Audit Log on Your Network
- Every call is recorded with the user, the agent app, the tool and the PHI level applied. The log stays on your VM, ready for your AI governance reviews.
Why Ascent
One Policy Across Every System
Your EHR vendor's agent tools cover your EHR, with their own permissions and logs. Ascent puts every system behind one policy, and works alongside the vendor's tools.
A Vendor's Agent Tools
- Cover that vendor's system
- Each with its own permissions and logs
- Reach what that vendor's APIs expose
Ascent
- Covers PACS, EHR, claims and exchanges
- One policy and one audit log for all of them
- Speaks FHIR, HL7v2 and DICOM, on your network
In a 2026 survey of more than 60 health system IT leaders, 74% named dependence on their EHR vendor as a top barrier to putting AI into practice.5
For IT
Built to Run Inside Your Network
One server your team installs, configures and audits. Clinicians add one small client to the agent app they already use.
One Binary on a VM
A single binary on a VM you control. System credentials, policy and the audit log live there and nowhere else.
Your Sign-In
OIDC through your identity provider, or LDAP against your directory. Local accounts for sites with neither.
One Install Line
Site IT gives clinicians one command that points at your server. The Ascent client holds no system credentials or license.
Works Through Outages
Connectors load from local disk, so Ascent keeps serving through an internet outage until its license lease expires.
Updates in Rings
Connector updates for payer rules, code sets and vendor upgrades reach Linnear's test sites first, then pilot sites, then everyone.
Priced per Connector
Pricing is per connector, never per tool call, so an agent retrying a task never changes your bill.
Design Partners
Shape Ascent with Us
Ascent is pre-launch. We're onboarding a small group of hospitals and health systems to deploy it first.
What You Get
- Ascent at your site first, with our engineers on the deployment
- Connectors for your systems built first
- A direct line to the team building Ascent
- Design partner pricing on your first contract
What We Ask
- A test VM with non-production EHR and PACS instances
- An IT or informatics owner on your side
- A 30-minute feedback session every two weeks
Become a Design Partner
Tell us where you work, and we'll be in touch to set up a first call.
FAQ
What Buyers Ask First
No. Ascent runs on your network and sends Linnear only license checks and usage counts, such as which tool ran and whether it succeeded. Never tool arguments or results. Support sessions and crash reports are kept free of patient data too.
That rests on your agreement with the agent provider, such as a HIPAA business associate agreement, which providers offer on some plans. Ascent enforces your decision: agent apps you haven't approved for patient data are refused, and tokenizing identifiers never stands in for that agreement.
Least privilege. Ascent is read-only by default, write tools stay off until you enable them, each role gets only the tools it needs, and every call is logged on your network.
No. Text in a record can steer an agent, and no tool server can prevent that. What Ascent limits is what a steered agent can reach and do: the user's role, read-only defaults and the audit log apply to every call, whatever prompted it.
Tools return only the fields a task needs, in line with the minimum necessary standard, and the audit log records who called which tool from which agent app, supporting HIPAA's audit controls. The same log gives your AI governance the monitoring record that the Joint Commission and CHAI's 2025 guidance asks for.
Ascent keeps serving. Connectors and policy live on your VM, so an outage only matters once the license lease expires.
Ascent connects through interfaces and credentials you already have, such as FHIR, HL7v2 and DICOM. Any API fees your vendor charges stay between you and your vendor.
Claude Desktop, Claude Code and other agent apps that run local MCP servers. Web-based agents call tools from their provider's cloud, which can't reach a server inside your network.