Arcadia

The scarce asset here is assembled data, and the models mostly sit on top of it rather than constitute it.

What the company does that is hard is ingest clinical records from more than fifty record systems, claims, admission and discharge feeds, pharmacy data and social determinants information, resolve them to one member through a proprietary master patient index, and keep that current at population scale. Machine learning is used inside that pipeline for mapping and normalizing source data, a natural language processing engine reads unstructured notes, an AI engine drives predictive and next best action algorithms, and a generative assistant built on OpenAI models summarizes records for care teams. The Epic risk suspecting app turns that work into suggested diagnoses at the point of care.

Strip the models out and a very large amount of value remains, because a unified, deduplicated, benchmarked longitudinal record is worth buying on its own, and the marketplace listing prices that data platform as the base every package is added to. AI is a substantial feature layer on a product whose value stands without it.

The system mostly informs decisions, and where it writes into a record a clinician review step is described. Risk and quality insights surface to care teams, gap lists drive outreach that people conduct, and network and contract analysis informs decisions executives make. The one place the platform acts on a record is the Epic HCC Risk Suspecting App: suspected diagnoses are written automatically to the Epic problem list, and the clinician reviews and reconciles them before they become billable codes. The generative assistant summarizes records and drafts material for care team members.

What is missing is the threshold. Nothing says what level of evidence triggers a suspected diagnosis being written to the problem list, what a clinician sees of the basis for it beyond the source data types named (notes, labs, orders, vitals), whether a rejection is recorded, or how often suggestions are accepted. A problem list entry is visible to every later reader of the chart, which makes the write step consequential even with review.

The architecture and one model supplier are named, without the version and update discipline behind them. The platform is described component by component: a data gateway with proprietary source adapters, a lakehouse, a matching and normalization layer built on a proprietary master patient index, a natural language processing engine for unstructured text, a data core computing expense grouping, risk adjustment and quality measures, and an AI engine whose training dictionary drives predictive and next best action algorithms. The generative assistant is stated on Arcadia's own pages to run on OpenAI large language models.

No model version, accuracy, calibration or validation figure is published for any component, and nothing describes retraining or how drift is caught as customers add sources. The natural language processing engine matters most, because its output feeds quality and risk submissions that determine payment, and whether it errs toward missing findings or adding them is the difference between a submission that survives audit and one that does not.

The model supplier is named for the generative layer, and the rest of the chain is partly visible. Arcadia's own pages state that its point of care generative AI assistant, used in its care management and EHR integration products, is powered by OpenAI large language models reading the longitudinal records curated in the Arcadia platform. National benchmark data entered the platform with the CareJourney acquisition in June 2024 and derives from Medicare claims. The platform is deployed on AWS, per the company's AWS Marketplace listing.

The terms are missing. No subprocessor list is published, and nothing states how OpenAI is reached (directly or through a cloud service), what OpenAI retains from clinical content, or whether that content can be used for training. Benchmarks drawn from Medicare claims describe an older, differently insured population than a commercial book.

Named customers and vendor reported figures, with no method behind the figures. The company publishes results including 81 percent in visit diagnosis capture, 59 percent more closed risk per patient and a 24 percent reduction in inpatient admissions, each the right kind of measure for this product and each without a denominator, period, comparison group or method. The case study library names Southwestern Health Resources, Ascension Illinois (AMITA Health ACO and CIN), Belong Health and others, told as narratives rather than measured results.

The NCQA designations shown on the home page, Data Aggregator Validation and the HEDIS and AMP measure certifications, are real outside checks that the data is fit to be scored on. They answer whether the data is right, not whether using the platform improves outcomes. No peer reviewed publication is cited.

Credible custodial engineering, and a named model provider whose terms are not published.

The stewardship apparatus is real. Identity resolution runs through a proprietary master patient index, ingestion is monitored for volume and quality anomalies with alerting to a support team, and the platform is described as HIPAA compliant and HITRUST certified. For a business whose function is joining records that were separate, deliberate patient matching and continuous data quality monitoring are the right controls.

The gap is what happens to data inside the models. Arcadia's own pages say its generative assistant is powered by OpenAI large language models reading longitudinal patient records, so clinical content reaches an outside model provider by design. Nothing on the home, integration, privacy or marketplace pages states what OpenAI retains, whether prompts and outputs are logged and for how long, whether customer data trains or tunes any model, or whether learning crosses customer boundaries. The website privacy policy covers the website only.

The compliance posture is stated plainly and the terms behind it are not published.

The platform is described as HIPAA compliant on Arcadia's AWS Marketplace listing, and HITRUST certification maps that framework onto an audited control set, so a covered entity has a reasonable basis to believe the obligations were engineered for rather than assumed. The privacy policy on the company site (Arcadia Solutions, LLC, effective April 2025) covers information given through the website, not the platform that handles patient data.

What is missing is the agreement. No business associate agreement, breach notification window, liability cap, audit rights statement or data return and destruction provision is published on the home, privacy or marketplace pages, and the generative assistant sends clinical content to OpenAI, which makes the subcontractor terms a live question rather than a formality.

This platform holds identified longitudinal records for very large populations aggregated from many sources, which makes it a concentration point: a failure affects the joined records of many contributing organizations, and nothing describes how obligations flow back to them.

Recognized certifications are named as the company's own, with open questions about currency. The home page carries badges stating an ISO 27001 certification (the badge names the 2013 edition), a SOC 2 Type One report and HITRUST i1 certification (a 2023 seal), and the AWS Marketplace listing describes the platform as HITRUST CSF certified.

Three questions remain. A SOC 2 Type One report tests whether controls were designed correctly at a point in time, not whether they operated over a period, and Type Two is what healthcare buyers normally require. The ISO badge names the 2013 edition, which certification bodies stopped certifying against after the transition to the 2022 edition. And no date is given for the HITRUST i1, which runs one year. The marketplace listing links a trust center, which may hold current reports.

Outside device regulation for most of what it sells, with the point of care features closest to the line.

Population analytics, quality measurement, risk stratification for program targeting and network design are administrative and financial functions rather than diagnosis or treatment, and no clearance is claimed. The regulatory weight the company carries sits in the payment domain: NCQA Data Aggregator Validation and measure certifications govern whether its data may be used in quality measurement that determines payment under shared savings and risk contracts.

The boundary cases are at the point of care. The Epic risk suspecting app surfaces suspected diagnoses from notes, labs, orders and vitals and writes them to the problem list for the clinician to reconcile, and the generative assistant summarizes records during care. Both are support for a clinician whose basis the clinician can review, and neither is described as diagnosing or deciding treatment; nothing states the company's position on them.

Nothing published on how model behavior is governed or tested. The home, integration, privacy and marketplace pages carry no bias testing, subgroup results, statement of what the risk models predict, or fairness review before a model reaches a customer.

The exposure is a documented one for population health risk models. Obermeyer and colleagues showed in Science in 2019 that a population health algorithm using cost as a proxy for need understated the illness of Black patients, because less had been spent on their care at the same level of illness; correcting the target changed who was enrolled in extra care by a large margin. Arcadia ranks populations for care management from claims derived features, and a patient scored too low is simply never contacted, so the harm never surfaces as an incident.

Two newer features add to it. The Epic risk suspecting app writes suspected diagnoses into problem lists, and suggestion rates that differ by patient group would change both documentation and payment by group. The OpenAI based assistant summarizes records and simplifies instructions for patients, with no evaluation published across language or literacy. Social determinants data is used as a strength, which can reduce disparity and also places proxies for protected characteristics in the feature set.

Nothing published on what happens when the system is wrong. The home, integration, privacy and marketplace pages carry no indemnity, warranty on model or analytic output, accuracy commitment, service credit tied to data quality or availability, or route to dispute an output.

The failure modes are financial and specific. If the language engine misses documented conditions, risk adjustment revenue is understated; if the Epic app suggests diagnoses the record does not support and they are accepted, a submission fails audit and the exposure becomes a payer recovery. If quality measures are computed on incompletely ingested data, a shared savings or star rating result moves. Each loss lands on the customer and traces back to work this vendor performed, and data validated under an outside program feeds regulated submissions that carry the provider's name.

The generative assistant adds a clinical version: where it surfaces something incorrect during an encounter, nothing allocates responsibility between the clinician who acted and the vendor whose product spoke.

Named bidirectional integration with a major record system, documented by the vendor, on top of broad ingestion that an outside body validates. Arcadia's HCC Risk Suspecting App reads an integrated payer and record data asset and surfaces suspected, historical and persistent conditions inside Epic's Best Practice Advisory risk adjustment workflow through a FHIR integration; suspected diagnoses are written automatically to the Epic problem list for the clinician to review and reconcile. The company states the integration is available in Epic, and the point of care EHR overlay is priced per user on its AWS Marketplace listing.

Ingestion covers proprietary adapters for more than fifty record systems across physical and behavioral health, plus claims, admission and discharge feeds, pharmacy and social determinants data, resolved to one member through a proprietary master patient index. NCQA Data Aggregator Validation, shown on the home page, is an outside assessment of that data in use.

The soft element is production evidence for the Epic write back specifically: no customer is named against it on the page.

Cloud only, on AWS, with tenancy, residency and continuity unanswered.

The shape is established. Arcadia's AWS Marketplace listing describes a cloud based data platform deployed on AWS and sold as software as a service, which confirms the hosting provider and lets an organization with committed AWS spend buy through that agreement. The company describes a lakehouse architecture.

The unresolved questions are the ones a security review asks. Whether customer data sits in a dedicated or shared tenancy is not stated, and it matters because the whole product is aggregation. No region, residency position or on premises option is described, though the listing prices a replicated database add on, which implies a customer can hold a copy of its data. No recovery objective, availability commitment or failover description is published for a platform health systems run care management and quality reporting on daily.

Published tiers with figures and a unit of charge, on a listing a buyer can purchase from. Arcadia's own AWS Marketplace listing for its data platform prices the Arcadia Data Platform at $1,275,120 per 100,000 members over a 36 month contract, about 35 cents per member per month, with capability packages added on the same basis: basic population health analytics $720,000, advanced analytics $1,440,000, care management $1,080,000 and a health plan package $1,224,000, each per 100,000 members per 36 months, plus a replicated database at $261,000. Overage runs per member per month (40 to 80 cents by package), and the point of care EHR overlay is $900 per user. The listing states usage based charges apply on top of the contract price and that AWS infrastructure costs may be added.

What is not published is implementation. Connecting dozens of source systems and resolving patient identity across them is a real onboarding cost, and no figure for it appears on the listing or the company's own pages. Named applications on the company site, such as Network Modeler and Contract IQ, are not individually priced on the listing.

Broad across the two sides of a risk contract, deliberately narrow within them.

Buyer coverage spans health systems, independent provider groups, accountable care organizations and health plans, and the contract types named cover Medicare shared savings, accountable care organization risk models, Medicaid, commercial risk and fee for service. Serving payer and provider from one platform is a real breadth claim, because the two ask opposite questions of the same data: a provider group asks where its attributed population is leaking and which gaps are closeable, while a plan asks which providers cost more than they should and how a network should be shaped.

Data breadth supports the coverage claim rather than decorating it. Integration is stated across more than fifty electronic health record systems spanning physical and behavioral health, plus claims, admission and discharge feeds, pharmacy and social determinants sources. Behavioral health inclusion matters, since omitting it distorts a risk picture.

The boundary is functional rather than clinical. This is a platform for population level financial and quality performance, not for a specialty workflow, so a cardiology service line or an oncology pathway is addressed only insofar as it appears in claims and quality measures. Coverage of care settings outside ambulatory and inpatient, notably post acute and home, is not described in any detail.