Andros

The company describes data matching algorithms automating primary source verification and data learning supporting monitoring, but its own positioning centers on a provider data repository covering more than eight million providers plus end to end network services. Recruitment, contracting, and committee facilitation are service lines delivered by people.

The algorithmic layer is real and does meaningful work, but the business is a network management operation with a large data asset rather than an AI product, so this grades alongside CertifyOS rather than with algorithm first vendors.

The most interesting autonomy claim in the credentialing group and the one worth testing: the company states two of three applications complete with no direct provider input, meaning the system assembles a complete credentialing file from data it already holds rather than asking the practitioner. That is genuine autonomy on the data gathering step and the source of the reported burden reduction.

Credentialing decisions remain human, with the company explicitly supporting file preparation and committee meetings so customers make documented, consistent decisions. A buyer should ask what happens in the remaining third of cases and how errors in auto assembled files are detected.

Capability is described at the level of data matching algorithms and data learning without model detail, accuracy measurement, or error rate disclosure. The eight million provider repository is quantified, but how matching decisions are made, how conflicts between sources are resolved, and how often auto assembled applications require correction are not published. Typical for the category and weaker than what a technical buyer would need to assess risk.

The scoping point for this segment applies: the core dataset is provider identity data rather than patient data, covering identifiers, registrations, licences, certifications, education and training history, malpractice history, sanctions checks and commonly social security numbers, which is highly sensitive and largely outside the health privacy regime, so a middling grade here does not carry the meaning it would for a clinical product. What is published is indirect and real.

An audited attestation explicitly covers confidentiality as a scoped criterion, and two accreditations examine file handling and audit trail practice, so three external bodies have inspected how this data is managed even though the vendor publishes little directly. That is worth crediting as evidence rather than dismissing as indirect.

What is absent is everything this axis asks in its own right, and one question is sharper here than elsewhere in the segment because of the vendor's own architecture. The platform aggregates and re uses provider data to eliminate redundant steps across credentialing cycles, and re use is the product's efficiency mechanism and a good one, and re use is the opposite of purging.

So establish how long verification artefacts persist, across how many customers the re used data is visible, and whether a provider can see or correct their own aggregated record, since the person the record describes is not the customer and has the most at stake in its accuracy. Ask also whether provider data trains the matching models.

Operational claims are concrete, including credentialing delivered in under 14 days across thousands of files and the two in three no touch application figure, but all are vendor stated with no independent verification, named customer case study, or audited benchmark located. The dual NCQA and URAC accreditation is meaningful third party validation of process conformance rather than of performance outcomes. Reasonable credibility signals, no external evidence.

The core dataset here is provider identity data rather than patient data: national provider identifiers, DEA registrations, state licences, board certifications, education and training history, malpractice history, sanctions and exclusion checks, and commonly Social Security numbers. Highly sensitive, largely outside HIPAA, and a low grade on this axis does not carry the meaning it would for a clinical product. What is published is indirect but real.

The SOC 2 Type 2 attestation explicitly covers confidentiality as a scoped trust services criterion, and NCQA and URAC accreditation both examine file handling and audit trail practice, so third parties have inspected how this data is managed even though the vendor publishes little directly.

What is absent is everything this axis asks for in its own right: no retention or deletion schedule for verification source documents, no statement on whether provider data is used to train or improve the matching models, no data classification policy and no subprocessor disclosure. The retention question is sharper here than elsewhere in this segment because of the vendor's own architecture.

The platform aggregates and re uses provider data to eliminate redundant steps across credentialing cycles. Re use is the product's efficiency mechanism and a good one, but re use is the opposite of purging, so it is worth establishing how long verification artefacts persist, across how many customers that re used data is visible, and whether a provider can see or correct their own aggregated record.

No business associate agreement statement, terms, tier or execution path was located, and no explicit HIPAA assertion was found. The segment scoping point applies and is not an excuse: a credentialing platform's core dataset is provider identity data, so HIPAA is not the primary governing regime for most of what this vendor holds, and such an agreement may legitimately be narrower in scope here than at a clinical vendor.

But this record sits closer to protected health information than most of its peers, and that should be said. The company sells network development, adequacy monitoring and payer enrolment alongside credentialing, and works directly with health plans, so configurations touching membership and network data are plausible and an agreement is very likely executed in practice.

The data outside HIPAA is not low risk either: Social Security numbers, DEA registrations and licensure records concentrate identity theft exposure governed by state breach notification law, the FTC Act and payer contract terms.

What partly offsets the gap is that NCQA and URAC accreditation both impose confidentiality and file handling requirements that are externally audited, and the SOC 2 Type 2 scope includes confidentiality, so the obligations exist and are inspected even though the contractual instrument is not published.

Two questions are worth putting directly: whether an agreement is executed as standard, and which regulatory regime the vendor treats as governing for provider information falling outside HIPAA. No privacy policy, terms of service or compliance page was located in this review.

A SOC 2 Type 2 attestation was completed and announced in November 2025, with the scope named rather than left vague: security, availability, processing integrity and confidentiality, evaluated over a period of time. Naming the trust services criteria in scope is better practice than the bare SOC 2 claim common in this index, and the announcement correctly distinguishes what a Type 2 demonstrates, that controls not only exist but operate effectively and consistently across the period.

The attestation is attributed to a named executive, which places accountability on a person rather than on a badge. A stronger security adjacent signal sits on the regulatory axis and is easy to miss: NCQA credentials verification organisation certification at the strictest level, and a full three year URAC accreditation, both involve external examination of file handling, access control and audit trail practice.

This vendor has therefore been inspected by three separate external bodies against three different standards. Held below a higher grade on what is absent. No public trust centre was located, so certificates and audit dates cannot be checked without asking, and no penetration testing statement, ISO 27001 or subprocessor list was retrieved. One claim is explicitly not relied on here: a competitor comparison site lists HITRUST alongside SOC 2 for this vendor, which was not confirmed from an Andros source.

No FDA clearance, none claimed and none conceivably applicable, since credentialing is administrative and network integrity work rather than clinical. This grade is awarded against the regulatory regime that actually governs this segment, and reading it any other way makes it unintelligible. The equivalent of a device clearance here is accreditation by the bodies that set credentialing standards, and Andros holds the strongest position available.

It is a fully NCQA certified credentials verification organisation and states it holds the strictest level of NCQA certification available, which is the standard its health plan customers are themselves surveyed against, so the accreditation transfers directly into the customer's own audit position. It also holds a second, independent accreditation: a full three year CVO accreditation from URAC, awarded recently and running alongside the longstanding NCQA certification.

The company states that fewer than 25 credentialing organisations nationwide hold both, and that claim is checkable against two public accreditor registers. Dual accreditation matters beyond badge counting, because NCQA and URAC apply overlapping but distinct verification standards, so the verification process has been examined twice by different bodies with different methodologies. The company also publicly tracks forthcoming NCQA standard changes, which signals it treats the standard as a live obligation rather than a one off certificate.

No AI governance artefact was located: no responsible AI statement, no bias or fairness position, no accuracy or error rate for the matching logic, no error taxonomy and no published evaluation output. This is the record in the segment where that absence matters most, because two of the company's own published claims combine into an exposure nobody has named.

First, the automation is explicit and algorithmic: the company states its data matching algorithms provide instant automated primary source verification, driving credentialing workflows up to ten times faster than industry averages and complete files in under 14 days. Second, the company states that two out of three of its application processes do not require any provider input. That is marketed as convenience, and it genuinely is.

It also means that in roughly two thirds of cases the provider never sees the file being assembled about them, so they have no opportunity to notice or contest a mismatch before it reaches a credentialing committee. Combine that with the structural bias exposure in this segment, where automated sanctions and exclusion matching produces false positives clustering on common surnames, transliterated non Latin names and compound surnames, and the consequence is concrete: a matching error delays credentialing, which delays network participation and income, and the person best placed to catch the error has been designed out of the loop. Credit where due, a human decision layer does exist above the matching, since the company publishes that its team prepares practitioner files and facilitates committee meetings.

Capability is described at the level of data matching algorithms and data learning, with no model detail, no accuracy measurement, no error rate disclosure, no evaluation methodology and no warranty, indemnity or remediation commitment. The repository is quantified at millions of providers, which describes scale rather than performance. Three specific things are unpublished and each corresponds to a way the system can be wrong about a named person.

How matching decisions are made, which determines whether a provider is confused with another practitioner. How conflicts between sources are resolved, which determines whose version of a licence status or a malpractice history prevails when two authorities disagree, and source disagreement is common rather than exceptional in this data.

And how often auto assembled applications require correction, which is the only figure that would tell a customer how much review the automation actually saves rather than how much it appears to. The affected party is a clinician who does not know the system exists, experiences an error as an unexplained delay or a rejected application, and has no described route to see the assembled record or contest it. Ask for the false match rate, the source conflict resolution rule, the correction rate on assembled applications, and what a provider can obtain about their own record.

Positioned as a centralized platform consolidating network data rather than as connective infrastructure, which is close to the opposite of the CertifyOS approach in the same category. No published API documentation, named connector list, or integration surface was located in the materials reviewed. Gartner listings note additional cost may apply for integrations, which implies integration is project work rather than a productized interface.

The delivery model is a hybrid of software and services, and naming that matters because it is why this vendor sits differently from an API first competitor. Andros sells its platform alongside a staffed NCQA certified credentials verification operation: its team prepares practitioner files and facilitates credentialing committee meetings, and it offers monitoring and network approval management as services rather than as features.

The practical consequence for a buyer is that what is being purchased is an outcome and a turnaround time, not only software, which is consistent with published performance claims of complete files in under 14 days and workflows up to ten times faster than industry averages. Data intake is genuinely flexible and described concretely: client API, batch upload, or a provider filed application, any of which triggers the process.

The company positions the whole as a provider network lifecycle offering, a category it introduced publicly in March 2025. Held at this level on the absences this axis exists to catch, which are common across this segment. There is no data residency statement of any kind, no region and no residency commitment, no hosting provider or cloud named, and no named customer, implementation timeline, uptime commitment or support model.

One point specific to the services component is worth asking about: a staffed verification operation means human reviewers handling provider Social Security numbers and licensure files at scale, so personnel screening, access control and staffing location are live questions here in a way they are not for a pure software vendor, and none is addressed publicly.

No pricing is published. Third party listings indicate pricing is customized by scope across credentialing, network management, and automation needs, with plans varying by functionality and possible additional costs for integrations or volume, and direct vendor contact required for figures.

The blended software plus services model means a buyer should establish what is licensed versus what is delivered by the vendor's team, since that determines whether costs scale with headcount or with volume.

Covers the full network lifecycle, recruitment, contracting, credentialing, monitoring, and network adequacy, which is broader than credentialing only competitors and is the company's deliberate positioning as network development rather than back office administration. Sold primarily to health plans, large provider networks, and larger telehealth organizations, with particular depth in delegated credentialing at scale. Specialty agnostic, administrative rather than clinical.