Abridge

Ambient speech to structured note generation is the entire product. Without the model there is no artifact.

Linked Evidence is the most rigorous oversight mechanism in this category: every part of a generated note maps back to the source audio, so a clinician can verify any individual sentence against what was actually said before signing. That converts review from a trust exercise into an auditable one, and it is the specific control a compliance function should be asking every scribe vendor for.

What is disclosed here is the supply chain and the architecture surface rather than the model itself. OpenAI is named on the public subprocessor list alongside Google Cloud, Zendesk, Amplitude and Sentry. That is a meaningful disclosure and a direct contrast with vendors in this segment that decline to name any foundation model provider: a buyer who knows which model provider sits in the stack can reason about the dependency, the data flow, and the exposure to a third party's policy changes.

A security whitepaper and a network diagram are both published as documents, so the system architecture is documented and reviewable, and AI security and AI monitoring are catalogued as standing items. Held below the top grade because the model layer itself is not described. There is no model card, no architecture description, no statement of what is proprietary versus what is a wrapped foundation model, no version or update policy, and no published performance figure of any kind. For a company whose clinical evidence is strong, the absence of any published characterisation of the system producing that evidence is the notable gap.

Abridge is one of the few vendors in this segment that names the model provider. The public subprocessor list on the trust centre enumerates the parties individually, naming OpenAI alongside Google Cloud, Zendesk, Amplitude and Sentry, so a buyer can see that encounter derived content reaches a third party foundation model provider rather than being left to infer it from a proprietary artificial intelligence claim.

That single disclosure is the difference between a supply chain a compliance function can diligence and one it cannot, and it is the specific artifact to ask every scribe vendor for. A third party notices page is published separately, a security whitepaper and a network diagram are both available as documents, and the business associate agreement is incorporated by reference into the clinician terms rather than offered only on request.

Graded at the top because individual enumeration including the model layer is what this axis asks for and Abridge does it by name. Two residuals are worth putting to the vendor, neither a disclosure failure so much as the question the naming now makes it possible to ask: the list does not state which of the named parties are individually covered by a business associate agreement, and no public statement was located on whether encounter audio or transcripts are retained at the model provider or used to train or improve models.

The strongest evidence position in the ambient documentation category. The largest independent peer reviewed study of ambient AI documentation was conducted with Kaiser Permanente across 1,306 clinicians and published in NEJM AI. Independently corroborated by Best in KLAS for Ambient AI in both 2025 and 2026, which is buyer survey based rather than vendor asserted. Graded on the existence, scale, and venue of the evidence; this index does not re verify the underlying study.

The stakes on this axis are higher than for most products in this index, because an ambient scribe records the patient encounter itself, which is the richest and least controllable protected health information any of these products touch. The disclosure architecture is correspondingly serious.

The trust centre catalogues data into system, data out of system, breach notification, access monitoring, data asset classification, certificates of destruction, audit logging, multi factor authentication and single sign on, and it names every data service vendor in the stack: Zendesk, Amplitude, Sentry, OpenAI and Google Cloud.

Naming OpenAI is the disclosure that matters most here, because it tells a buyer that encounter derived content reaches a third party model provider, which most vendors in this category leave a buyer to infer. A patient facing explainer is published alongside a clinician guide, treating the recorded party as an audience owed an explanation rather than as a data source.

Held below the top grade because the central question is not answered publicly: nothing located states whether encounter audio or transcripts are retained, for how long, or whether customer content is used to train or improve models. Both are worth putting to the vendor directly.

HIPAA is listed as a named compliance programme on the public trust centre alongside SOC 2 Type 2, CCPA and TX-RAMP, with supporting documentation available on request and a master services agreement among the published legal documents. Data breach notification is separately catalogued rather than implied.

Abridge also states that it applies HIPAA security standards to all data it collects, including data the rule would not otherwise cover, and that a user can delete their account at any time. The customer base is the strongest implicit evidence: more than 200 health systems, including Mayo Clinic, Duke Health, Memorial Sloan Kettering, Sutter Health, Emory Healthcare and Yale New Haven Health.

Institutions of that size do not deploy an ambient recording product across clinical operations without an executed business associate agreement, so these agreements demonstrably exist at scale. Held below the top grade for one reason: the agreement itself is not publicly establishable. No terms, tier, execution path or standard instrument is published, so a buyer cannot determine the shape of the arrangement before entering a sales conversation.

A full public trust centre runs at trust.abridge.com, hosted on SafeBase. Attestations listed include SOC 2 Type 2, validated by an independent third party auditor and scoped to the security and confidentiality trust services criteria, alongside SOC 2 Type 1, HIPAA, CCPA, TX-RAMP and WCAG 2.2 AA. TX-RAMP is a Texas state government cloud authorisation and is unusual in this category; published accessibility conformance is rarer still.

Available documents include a security whitepaper, a network diagram, the SOC 2 report, a business continuity and disaster recovery policy and tabletop exercise records, with structured sections covering application and network penetration testing, code analysis, security monitoring, endpoint detection and response, disk encryption, multi factor authentication, audit logging and cyber insurance.

The subprocessor list is published rather than withheld, naming Zendesk, Amplitude, Sentry, OpenAI and Google Cloud, which is the disclosure a health system security review actually needs. Substantive documents sit behind an access request, which is the normal trust centre pattern and does not reduce the assessment, since the existence, scope and auditor independence are all established without one.

No FDA clearance, none claimed and none apparently required. The grade records an absence rather than a deficiency, and the regulatory position here is genuinely simpler than for the clinical decision support products graded alongside it. An ambient scribe produces a draft clinical note from a recorded encounter, which a licensed clinician then reviews, edits and signs.

It does not recommend a diagnosis, rank a differential or suggest a treatment, so the clinical decision support exclusion question that dominates records like UpToDate, OpenEvidence and Glass Health largely does not arise. The human signature is the control point and it is unambiguous. The question that does arise is scope, and it is the one to track over time.

The company describes benefits reaching beyond documentation into workflow acceleration and revenue cycle teams, and the wider category has been moving from note drafting into coding suggestions, clinical documentation improvement and order preparation. A system that drafts a note is a different regulatory and medicolegal object from one that proposes the codes that note will be billed under, because the second shapes reimbursement and creates an incentive gradient the first does not have. Worth establishing exactly which downstream outputs are in scope at the version being purchased. Two non FDA conformances are also on record: TX-RAMP and WCAG 2.2 AA.

The trust centre carries a dedicated AI section, which is rare in this category. Its catalogued items are AI training data and bias, AI security and AI monitoring, so bias in training data is treated as a named category a buyer is entitled to interrogate, and ongoing model monitoring is presented as a standing control rather than a launch activity. The norm elsewhere in this segment is either a marketing page of principles or silence.

Naming OpenAI on the public subprocessor list also lets a buyer reason about the underlying model supply chain, which is a governance fact in its own right. Held below the top grade because the contents are gated and no result is public: no bias evaluation output, no demographic or subgroup performance analysis, no error taxonomy and no measured accuracy figure.

That gap matters for an ambient product specifically, since speech recognition carries documented accuracy variation across accent, dialect, speech rate and vocal characteristics, and the affected populations overlap with those already underserved. A structured governance surface that a buyer can request is meaningfully more than an assertion, and meaningfully less than a published measurement.

Abridge publishes its clinician terms of use, which is more than most vendors in this category do, and the terms answer this axis directly. The platform is offered as is and on an as available basis, with warranties of accuracy, reliability, completeness and freedom from error expressly disclaimed.

Aggregate liability is capped at the greater of one thousand dollars or fees paid in the previous twelve months, and because the platform is frequently supplied to an individual clinician at no cost through a health system agreement, the effective cap for that user can be the floor figure. Indemnification runs in one direction only: the clinician defends and indemnifies Abridge, and no reciprocal obligation is stated.

Disputes go to binding arbitration with a class action waiver and a one year limitation period, with a thirty day opt out available by written notice. A limited performance warranty does exist, that the platform will be provided in a professional manner consistent with industry standards and will substantially conform in all material respects to the user documentation, though no remedy is attached to a breach of it.

Against that, the correction machinery inside the product is the strongest in the segment. Linked Evidence maps every part of a generated note back to the source audio, so an error can be found and fixed by the clinician before the note is signed, which is the moment a documentation error becomes a medicolegal fact. A patient explainer is published as well.

The grade records the distance between those two halves: excellent means of catching an error before harm, and no commitment standing behind one that gets through. The recorded patient has no route of any kind. The terms state that no person other than the parties is entitled to any benefit under them, so the individual whose encounter is captured is expressly not a beneficiary of the contract governing the system that captured it, and correcting a signed note runs through the health system's own amendment process rather than the vendor.

Two further clauses a buyer should read closely: responsibility for obtaining patient consent to recording sits entirely with the clinician, and publishing benchmark results or comparisons of the platform requires prior written consent, which constrains a customer's ability to publish its own evaluation. Terms last updated 2025-11-25.

The deepest EHR integration in the index. Embedded natively across Epic Haiku, Canto, and Hyperdrive with bidirectional note sync rather than copy and paste or a parallel interface, plus an athenahealth partnership. Extends beyond documentation into structured orders and real time prior authorization workflows with a payer and delivery system partner.

The installed base is the largest and most specifically named of any ambient scribe in this index, at more than 200 health systems with over twenty named publicly on the trust centre. The spread matters as much as the count. It covers academic medical centres including Mayo Clinic, Duke Health, Memorial Sloan Kettering, Emory Healthcare, Yale New Haven Health, UChicago Medicine and UNC Health; large integrated systems including Sutter Health, Corewell Health, Inova, CHRISTUS Health, MemorialCare, Sharp HealthCare and the University of Kansas Health System; paediatric hospitals including Akron Children's and Dayton Children's; and community and safety net providers including AltaMed, Cambridge Health Alliance, Tanner Health, Reid Health, Lee Health and UVM Health Network.

This is not a product proven only at well resourced flagships, which is the usual shape in this category. Operational resilience is documented rather than asserted, with a business continuity and disaster recovery policy, an alternate processing and storage site, contingency training, tabletop exercise records, status monitoring and anti DDoS protection. Held below the top grade on one specific absence: no data residency statement is public. No region is named, no residency commitment is offered, and hosting detail sits behind an access request. For a product holding recorded patient encounters, that is worth closing directly.

No published pricing of any kind: no rate card, no per clinician figure, no tier structure and no self serve path. Distribution is enterprise only, which is consistent with a customer base of more than 200 health systems reached through institutional contracts rather than individual clinician signup.

The trust centre lists a master services agreement among its legal documents, so the commercial instrument exists and is catalogued, but it sits behind an access request alongside the security documentation. The contrast within this category is the useful part for a buyer.

Several smaller ambient scribe vendors publish per clinician rates openly, and in the adjacent clinical decision support segment UpToDate operates a public webstore where a clinician can price the product without speaking to anyone, while Glass Health publishes a plan ladder with a free tier. Scale is therefore not the reason pricing is gated here; it is a choice, and the largest vendor in the category is among the least transparent on cost. No published return on investment figure, payback period or contract structure was located either, so neither the price nor the claimed value can be established from public material.

Broad and specifically stated: more than 28 languages and 55+ specialties across outpatient, inpatient, and emergency settings. Coverage is enumerated rather than implied.