AccuCode AI

The engine is the product across both lines. Documentation goes in, codes or abstracted quality measures come out, each cited to the passage that supports it. There is no workflow layer, network or platform underneath that would function without the model, and the company describes both products as configurations of a single engineering stack rather than separate systems.

The coder audit interface and the human review workflow sit on top of model output rather than beside it, which is the correct design for this category and does not reduce centrality. Worth noting that the parent relationship runs the other way from the usual pattern: the company was founded inside a medical billing services firm, and what was spun out is the software rather than the service.

The oversight philosophy is the most carefully articulated in this lane and the autonomy boundary is not quantified.

Coding is described as fully autonomous and specialty agnostic, with output scrubbed for compliance and able to route directly to the billing system. Around it sits an integrated coder audit workflow presenting justifications and references for fast human review. Three design commitments go further than competitors bother to: the system flags disagreement rather than resolving it silently, output reflects documentation ambiguity where it exists, and the company states that quiet defaults are how systems hide errors from the people responsible for catching them. That is a direct statement about the failure mode this axis exists to examine.

What is missing is the number. No automation rate, direct to bill share or confidence threshold is published, and the company's own site deliberately avoids a headline accuracy figure, arguing that measurement discipline matters more than the number. A press release cites accuracy above 99 percent from a related party audit, and the site does not repeat it. The argument for methodology over headline is defensible and it leaves a buyer unable to size the automated share without running the pilot. Ask what percentage of charts is submitted with no human touch.

The architectural claim is specific, falsifiable and unlike anything else in this lane. The company argues that most healthcare artificial intelligence compresses a chart into a summary before the model sees it because full inpatient records exceed standard context windows, that roughly eighty percent of clinical signal lives in unstructured prose, and that its architecture processes the entire record including handwriting rather than a summary of it. It then invites buyers to ask competitors whether their system processes the whole chart or a summary, which is a testable question rather than a slogan.

Every output is cited to the supporting passage in source documentation. A patent is pending on upstream data structuring, described as fixing the data quality problem before coding or quality measurement runs.

Below that the disclosure thins. No foundation model, model class or version is named. The commitment that customer data is never used to train any foundation model confirms external foundation models are in the stack without identifying them. No accuracy, precision or recall figure appears on the site at all, by design, so the technology claim rests on architecture description plus a pilot rather than on published measurement.

The best on this axis in the lane, and it gets there through governance rather than enumeration.

The training position is stated and contractually binding: customer data is never used to train any foundation model, written into every business associate agreement. That is stronger than CombineHealth's permission based formulation because it is absolute rather than conditional. Vendor and subprocessor management is one of ten continuously monitored control categories, covering vendor due diligence, a vendor register and agreements, compliance monitoring against industry frameworks, communication of subprocessor changes to customers, and privacy and security requirements written into third party agreements. The company also states it does not route data through third party interfaces hosted outside the United States, which implies it knows and controls its dependency set.

What is still absent is the list itself. No foundation model provider, model class or version is named, and no public subprocessor register was located, only the commitment that changes to it are communicated. The cloud platform is named, which most competitors do not manage.

Held at B rather than A because a monitored process for managing subprocessors is not the same as publishing who they are. Ask for the base model and the current subprocessor register.

The methodology is described more rigorously than any competitor's and the headline validation is compromised by who performed it.

The company publicised in August 2026 a two year audit in which coders certified by the professional coding association measured engine output at above 99 percent accuracy across a large and diverse record sample, tracked continuously rather than at one point. The auditor was Professional Consulting Services, described in the release as a channel partner. The company's own about page states that AccuCode was founded inside that firm and that its chief operating officer spent eighteen years there. An audit by the organisation a vendor was founded inside, conducted by a partner with a commercial interest in the result, is a related party exercise. It may well be methodologically sound and it is not third party verification, and the release does not disclose the relationship.

The stated validation discipline is otherwise excellent: hundreds of thousands of records manually confirmed against source documentation rather than sampled or synthesised, accuracy measured against ground truth consensus reached after disputed cases are investigated to source, and an explicit refusal to benchmark against its own prior results.

Other evidence is genuine but thin. Baptist Health Systems has been a named clinical quality partner since August 2024. A partnership with the cardiovascular organisation affiliated with the American College of Cardiology supports the cardiovascular claim. No research organisation coverage, peer reviewed publication or unaffiliated audit exists. Graded C. Ask for a customer audit conducted by a party with no commercial relationship to the company.

The strongest stewardship disclosure in the index, surpassing CombineHealth on the two questions that matter most.

On training the commitment is absolute and contractual rather than permission based: customer data is never used to train any foundation model, written into every business associate agreement. CombineHealth commits not to train without permission, which leaves a door open; this does not.

On handling the specifics are enumerated. Data at rest and in transit under strong cryptographic algorithms with key generation and rotation procedures, device encryption on personnel endpoints, least privilege provisioning with deprovisioning inside one business day of termination, role based access control, centralised authentication with multi factor, session timeouts and unique user identifiers. Audit logging runs across every production system with trails for privileged access and invalid access attempts. Data minimisation, allowable use controls and a record of processing activity are named.

On location, customer data, protected health information, audit logs, backups and archives are stored only in United States infrastructure with no cross border replicas, and every person able to access protected health information is based in Little Rock or Seattle with no offshoring or third party outsourcing of access. Both commitments are stated as contractually binding.

What remains is a retention schedule with stated periods, which is described as a policy available on request rather than published.

The first A on this axis in the index, and it is not close. Every other record in this lane carries a note that no business associate agreement posture was located. This company publishes one in detail.

All three components of the federal framework are named individually rather than gestured at collectively: the privacy rule, the security rule and the breach notification rule. Agreement execution with every covered customer is not merely claimed but sits inside a continuously monitored control category, alongside allowable use and disclosure controls, data subject rights procedures, a record of processing activity, and a quarterly privacy compliance review.

The breach notification commitment is the part that goes beyond compliance into contract. The company states the statutory floor is sixty days, commits to notification well inside that window with specific terms written into every agreement it signs, and directs buyers to ask competitors what their contractual window is, noting that sixty days is the legal minimum rather than a commitment. Residency and the prohibition on foundation model training are also stated as contractually binding through the same instrument.

Graded A because the posture is specific, contractual and verifiable in negotiation, not because the underlying obligations are unusual. A buyer should still read the executed agreement rather than the description of it.

The strongest security disclosure encountered in this index, and the reason is a verifiable artefact rather than a badge.

The company publishes a publicly linked, daily updated security posture report generated by a continuous compliance monitoring platform connected to its infrastructure, version control, identity provider, endpoints and human resources systems, covering 244 controls. It states this is the same report shared with its auditors and open to any prospective customer without a sales conversation. That converts security posture from a claim into something a buyer can inspect before first contact, and no competitor in this lane offers anything comparable. The report was not opened during this pass, so the grade reflects the disclosure being made and the artefact being published rather than verification of its contents; a buyer should open it.

The controls report is named at the second type with its scope stated, covering security, availability, processing integrity, confidentiality and privacy over a period of operation, and the company explicitly distinguishes annual attestation from daily verification rather than conflating them.

Ten control categories are enumerated with specifics, including penetration testing, continuous vulnerability scanning with risk based remediation timelines, automated patching, static application security testing, software composition analysis, background checks, phishing simulation and quarterly policy review by a security steering committee. Any policy is offered by name on request.

Graded A. What is absent is a health specific framework certification, which two competitors in the adjacent lane hold.

No device pathway applies to either product and none is claimed. Assigning billing codes and abstracting quality measures from documentation are administrative determinations rather than clinical ones, so the absence of a clearance is correct.

The coding side carries the usual exposure: codes on a claim are representations to a payer, and error is governed by federal false claims enforcement landing on the billing provider. Source citation for every code and an integrated audit workflow are the right posture against it.

The quality side carries an exposure no other record in this index has, and it is not addressed. The product performs fully automated calculation and submission of quality measures directly to federal programmes, the hospital accreditation body and specialty registries, with the company stating no manual intervention is required and no rekeying occurs. Submitted quality data drives payment adjustment, public reporting and accreditation standing, and an incorrect automated submission is a different kind of event from a miscoded claim. Nothing published describes who attests to a submitted measure, whether a human signs off before transmission, what happens when a submission is later found wrong, or how corrections and resubmissions are handled.

Graded C because the regulatory position is correctly represented and the accountability chain on automated regulatory submission is undocumented. Ask who attests.

The governance commitments are better articulated than anywhere else in this lane, and no result from them is published.

Four are stated explicitly and each names a failure mode this index looks for. The system reads the whole chart even when an answer appears in a structured field, because the field is sometimes wrong and a system trusting it by default propagates the error. It flags disagreement rather than resolving it silently, with output reflecting documentation ambiguity, on the stated reasoning that quiet defaults hide errors from the people responsible for catching them. It benchmarks against ground truth rather than its own prior results, noting that self comparison produces smooth improvement charts that do not survive audit. And it commits that every audit cycle surfaces things the system missed or got wrong into the customer report rather than smoothing them over.

Processing the entire record rather than a summary is itself a bias control, since summarisation decides what the model never sees. Source citation on every output makes each decision individually contestable.

Held at B because all of it is commitment rather than measurement. No distribution of assigned codes against a benchmark, no breakdown by specialty, payer or physician, no published precision or acceptance rate, no bias or fairness testing, and no external audit of coded output by an unaffiliated party. Ask to see a customer audit cycle report.

Real contractual commitments exist, and none of them is about coding accuracy.

What the company will commit to in writing is unusually concrete: breach notification materially inside the statutory sixty day floor with specific terms in every agreement, United States data residency, personnel location, and a prohibition on customer data being used to train any foundation model. Those are enforceable obligations with a counterparty, which is more than most vendors in this lane offer on anything.

On performance there is nothing to hold them to. No accuracy, precision or automation figure is published on the site, by stated design. There is no service level agreement on coding accuracy or turnaround, no warranty, no indemnity and no remediation commitment, and no denial or reversal rate for assigned codes. The one accuracy figure in circulation comes from a related party audit and is not repeated on the company's own material.

Two mechanisms partly substitute. A pilot on one hundred of the buyer's real charts within four weeks surfaces disagreements with the buyer's own coders before any commitment, and the company commits that every audit cycle reports its own misses to the customer rather than smoothing them.

Graded C because verification is available pre purchase and post purchase recourse on coding quality is absent. Ask what contractual commitment attaches to accuracy once the pilot ends, and who carries the exposure on an automated quality measure submitted to a federal programme and later found wrong.

One named credential, one named standard, and a narrow footprint.

The company states an application is available in the dominant record system vendor's marketplace, which is an externally verifiable listing of the same class as the Epic Toolbox credential that lifts Arintra, and names the modern healthcare interoperability standard alongside it. Coding output can integrate directly with the billing system for submission, and the quality product submits externally to registries and federal programmes without rekeying, so outbound integration extends beyond the record system.

What holds it below A is breadth. Only one record system is named anywhere. Competitors at similar or smaller scale enumerate ten or twelve platforms, and XpertDox lists two marketplace credentials plus four connection mechanisms. Nothing states whether integration is bidirectional, and the quality product is described as requiring integration work before it can run on real data, which suggests a heavier lift than the coding pilot.

Graded B on a real credential and a named standard, with the single platform footprint as the limit. Ask which systems beyond the one named are supported, and what the quality integration actually requires.

The first A on this axis in the index. Every other record built in this sweep carries a C for silence; this one answers the question completely.

The cloud platform is named and restricted to United States regions. Infrastructure controls are enumerated: network segmentation, restricted public access, a web application firewall, private endpoint access to storage, zone redundancy, autoscaling and continuous infrastructure log alerting.

Residency is stated at the level of each data type rather than as a slogan. Customer data, protected health information, audit logs, backups and archives are stored only inside United States infrastructure. Backups remain in region and archives remain in region. There are no cross border replicas, and data is not retained at rest outside the country. Personnel location is treated as part of residency: every person able to access protected health information works in Little Rock or Seattle, with no offshoring and no third party outsourcing of access. All of it is stated as contractually binding through the business associate agreement and as continuously monitored.

Business continuity is covered separately with documented policies, backup restore testing, recovery exercises, redundancy of processing, business impact analysis and uninterruptible power.

What would remain for a buyer is tenancy: whether the deployment is single or multi tenant is not stated. Ask.

The evaluation path is specified precisely and the economics are not published at all.

On the pilot the company is concrete in a way most competitors are not: send one hundred of your own charts, receive every code cited to source documentation, see the disagreements your current coders will register, four weeks end to end, beginning with a signed business associate agreement. For quality abstraction the first conversation covers registries and measure scope, with the interface demonstrated on synthetic data before any real deployment. A buyer knows exactly what the first engagement looks like.

On cost there is nothing. No pricing page, no unit of charge, no range, no implementation or onboarding fee position, no minimum commitment, no return calculator, and no percentage saving against existing coding spend. Whether the pilot itself is free is not stated.

Graded C rather than D because the pilot terms are specific enough to constitute a real commercial disclosure, and rather than B because no economic figure of any kind exists. Ask whether the pilot carries cost, what the pricing mechanism is, and whether coding and quality are licensed separately.

Coding coverage is asserted broadly and quality coverage is enumerated precisely, which is the reverse of most records here.

Coding is described as specialty agnostic with cardiovascular optimisation, and the cardiovascular claim is backed by a partnership with the cardiovascular organisation affiliated with the American College of Cardiology rather than left as an assertion. Beyond that no specialty enumeration exists, so a buyer cannot tell how the engine performs on complex surgical, oncology or other difficult documentation.

Quality coverage is the enumerated half and it is specific: federal quality programmes, the hospital accreditation body, and named specialty registries covering cardiac catheterisation, thoracic surgery and the guidelines based stroke and cardiac programme, plus federal merit based and value pathway submission. That registry list is real depth in cardiovascular and surgical quality reporting and no other vendor in this lane addresses registry submission at all.

Buyer range is stated as individual practices through large hospital systems, and the architecture discussion centres on inpatient charts running to hundreds of pages. Held at B because demonstrated coverage rests on one named health system and one specialty partnership at a company of roughly seven people. Nothing addresses coding regimes outside the United States, which here is a deliberate positioning choice rather than an omission.