Alaffia Health

Two things are sold: model driven software and the work of the company's own clinicians. Alaffia's AI agents digitize unstructured bills and medical records, extract clinical facts, cross reference claims against the record and plan policy, route clear approvals for immediate processing and flag complex cases; the company's security page describes generative AI and large language models trained on each plan's own data. Alongside the software, Alaffia sells managed services in which its own clinical experts perform the reviews using the platform, in insourced, hybrid or fully outsourced engagements.

The boundary is published and the threshold is not. Alaffia says its AI agents route clear approvals for immediate processing and flag complex cases for clinicians, that the AI is never used to deny care, and that every AI generated recommendation is reviewed by a licensed clinician, with final decisions on care or reimbursement made by a licensed clinician; each recommendation carries a clinical rationale and traceable citations. That is an asymmetry a plan can hold it to: automation may approve, only a person may deny or reduce.

No criterion is published for what counts as a "clear" approval routed automatically versus a complex case, and the home page's "routine cases are automated end to end" sits beside the security page's "every AI generated recommendation is reviewed by a licensed clinician" without saying how the two fit.

The approach is described in general terms. The security page's AI explainer says Alaffia uses large language models and generative AI to process clinical documents, guidelines and patient information, and AI agents that follow structured workflows to review claims; the home page adds proprietary digitization of unstructured records. The platform is trained on each plan's own guidelines, records and claims within its environment and improves from new data and clinician feedback. No model, provider, version, update practice or evaluation method is named, and the "97%+ accuracy rate" has no definition.

The architecture and two data commitments are published; the model provider is not. The security page says plan data stays in a dedicated environment, is never shared with or used to train external models, and that learning is per plan, which answers the pooling question that matters among competing payers. It also says the platform uses large language models, and does not say whose: a language model can run inside a dedicated environment and still come from an outside provider. No cloud host, model provider or subprocessor list is named, and the privacy policy lists service providers only by category.

Vendor figures and anonymized customers, without method. The home page reports a 20 times increase in throughput, a "97%+ accuracy rate" across client implementations and a 5 times return on investment, and a case study headline says a regional payvider realized $30 million in savings; the managed services page offers a savings estimator ($37.5 million to $75 million for a plan of 750,000 lives).

Testimonials come from unnamed regional health plan executives and a former Medicaid chief medical officer. No baseline, period, named plan or method sits behind the figures, and savings attribution in payment integrity is hard to isolate because a reduced claim counts as a saving whether or not the reduction was right.

Categorical commitments are published; retention is not. The security page says each plan's data is processed in a dedicated environment, is never shared with or used to train external models, and that the platform learns only from that plan's workflows, policies and claims data, so what it infers is not pooled across customers; protected health information is encrypted at rest and in transit and never shared or sold, with multi factor authentication and role based access. The platform ingests itemized bills and full medical records, so this is protected health information throughout.

No retention or deletion period for medical records or model training data is published, and the page says the platform improves continuously from new data and clinician feedback without saying how long training data is kept. Nothing is published on safety engineering beyond clinician review.

HIPAA compliance is claimed and no business associate position is published. The security page says Alaffia adheres to SOC 2 Type II, HIPAA and HITRUST security standards and shows a "HIPAA Compliant" badge, and describes how plan data is handled (dedicated environment, encryption, never shared or sold). The privacy policy (effective 1 January 2025) covers personal data of site and service users and does not address protected health information or business associate status. No business associate agreement, tier or subcontractor terms are published.

Recognized certifications are named without the artifacts. The security page shows HITRUST and "SOC 2 Type 2 Certified" badges, says Alaffia adheres to SOC 2 Type II, HIPAA and HITRUST security standards, and describes encryption at rest and in transit, multi factor authentication and role based access. No report, certificate, audit period or HITRUST level (i1 or r2) is published, and there is no trust portal.

The product is scoped to payer claims review and makes no device claim. Payment integrity, utilization management and appeals support are administrative and financial review, and Alaffia states that its platform does not make care decisions, that final decisions on care or reimbursement are made by licensed clinicians, and that the AI is never used to deny care. The regimes that govern this work are utilization management accreditation (URAC, NCQA) and federal and state rules on prior authorization and adverse determinations, not device regulation.

Principles are published and no evaluation stands behind them. Alaffia's security page lists guiding AI principles: radical transparency (every recommendation carries a citation), privacy first, clinician judgment, continuous learning from feedback, accountable design that lets clinicians, clients and auditors trace every recommendation, and "equitable, unbiased outcomes", saying its tools are tested and tuned to work fairly across diverse populations. It also says licensed clinicians review every AI recommendation and that the AI is never used to deny care.

The fairness sentence is a parity claim with no groups or results behind it: no analysis of recommendations, reductions or determinations by member population, provider type or plan is published.

Review and traceability are built in, and nothing stands behind the output. Alaffia says every AI generated recommendation is reviewed by a licensed clinician, carries a clinical rationale with traceable source citations to the records and policy documents, and can be traced by clinicians, clients and auditors, and that the AI is never used to deny care. That is review before a decision, with traceable sources.

No warranty, indemnity or remediation commitment for a wrong finding is published. The home page's "97%+ accuracy rate across all client implementations" has no method, denominator or definition of accuracy, so it is not an error rate a plan can hold the vendor to. The company's own buyer guide recommends contingency based pricing as aligning incentives, but nothing says Alaffia's own fee is contingent on savings, so no fee at risk commitment is established.

Integration is claimed and nothing is named. For a payer the systems that matter are claims platforms, utilization management systems and clinical criteria tools. The FAQ says the platform integrates with existing claims management systems, EHR data feeds and clinical criteria tools without replacing infrastructure, and goes live in about 30 days, but no claims platform, criteria product, standard transaction format or interface is named.

Isolation is stated and location is not. The security page says each plan's data is processed in a dedicated environment and stored in secure, HIPAA compliant cloud environments with strict access controls and encryption, and that the platform learns only within that environment. No cloud provider, region, residency commitment or subprocessor list is published, and the privacy policy lists hosting providers only as a category. Implementation takes about 30 days.

How Alaffia is bought is clear; its own price and fee basis are not. The site sells AI agents for a plan's own team or managed services in which Alaffia's clinicians do the reviews, in insourced, hybrid or fully outsourced engagements, live in about 30 days, and offers a savings estimator by plan size or medical spend. The company's buyer guide to payment integrity vendors recommends contingency based pricing and lists contingency, transactional, licensing and hybrid fee structures, without stating which Alaffia uses or at what rate.

If fees are contingent on identified savings, the incentive runs toward finding more reductions, which makes the clinician review the control that matters.

Narrow and clearly named, with thin validation behind it. Alaffia serves health plans across payment integrity (itemized bill, DRG and complex claims review, pre and post payment), utilization management (prior authorization) and appeals, as software for the plan's team or as a managed service. Validation is a case study headline for a regional payvider and testimonials from unnamed regional plans and a former Medicaid chief medical officer.

The setting is named and only partly supported: no named plan, line of business (commercial, Medicare Advantage, Medicaid) or claim type result is published.