Artera

The virtual agents, Flows Agents, and AI Co-Pilots are model driven and are what the company is now selling against. Held back from A because the underlying asset is an eleven year old patient communications and messaging platform; AI is the current layer on a messaging infrastructure whose value stood before it. The vendor's own framing is instructive: its CEO argues that building AI agents is becoming commoditized and that the moat is domain experience, data, and distribution rather than the models.

Among the clearest autonomy disclosures in the index because the vendor sells the gradient explicitly rather than a single mode. Organizations choose among multiple virtual agent options ranging from staff augmentation to a fully autonomous digital workforce, agentic AI is coordinated across the patient journey with staff brought in when needed, and staff retain full context and control including a complete log of all conversation history. Letting a buyer select the autonomy level, and saying so plainly, is better practice than asserting a single posture.

Capabilities are described clearly and the technology beneath them is not.

What is public: an agent platform coordinating conversations across the patient journey, workflow agents applying natural language understanding to multi step interactions, assistive tools for staff covering translation, message shortening and conversation summarisation, and operation across voice, text and web in 109 languages. A buyer can tell what each component does.

What is absent is every technical particular. No model is named, no statement of whether models are the company's own or licensed from a third party, no architecture, no description of how the agent decides to escalate, no versioning or change notification practice, and no evaluation results for comprehension, generation or speech recognition.

The translation capability deserves a specific mention. Rendering health instructions across a hundred languages is a substantial technical undertaking, and nothing published states what performs it, whether output is reviewed, or how quality is assessed for languages with limited training resources, which is precisely where machine translation degrades and where the affected patients are least likely to complain.

One disclosure is worth crediting because it is uncommon. The company's own marketing materials note that audio demonstrations may include both simulated interactions and real de identified patient calls used with consent. Labelling which is which in a sales asset is a small honesty that most vendors do not bother with.

Ask which models underlie the agents and the translation, whether any are third party, and how changes are notified.

The instruments are strong and the one explicit commitment carries a qualification worth reading closely. On instruments: an audited attestation that includes the privacy criterion rather than security alone, certification to the privacy information management standard, and certification to the cloud personal information standard. Few vendors in this index hold all three, and together they are the right set for a company processing patient communications at scale.

The commitment is stated plainly and repeatedly: identifiable patient information is not used to train its models. That is a genuine training exclusion and it is the question every customer should ask first of a vendor whose product generates language. The qualification is in the wording rather than in anything hidden.

Excluding identifiable information from training is not the same as excluding customer data from training, because de identified data falls outside the exclusion entirely, and at a reported two billion communications a year across a hundred million patients the de identified corpus available here is among the largest conversational health datasets in existence.

Nothing published states whether it is used for model development, what de identification method is applied to free text and voice, or whether customers can opt out. Voice adds its own problem: a recording carries identity in the voice itself, which no text de identification process removes. Ask whether de identified conversations train models, the method used on audio, and recording retention.

Scale is substantial and consistently reported across independent trade coverage: roughly 2 billion communications annually and 100 million patients engaged a year. However these are volume metrics, not outcome metrics. The decisive figure for this category, containment rate, was not published, and no independent study of resolution quality or patient outcome was retrieved.

Strong instruments and one explicit commitment, with a qualification in that commitment worth reading closely.

The instruments are real: a SOC 2 Type 2 that includes the privacy trust services criterion rather than security alone, certification to the privacy information management standard, and certification to the cloud personal information standard. Together those are the right set for a company processing patient communications at scale, and few vendors in this index hold all three.

The commitment is stated plainly and repeatedly on the company's own materials: identifiable patient information is not used to train its models. That is the fourth genuine training exclusion this index has recorded, and it is the question every customer should ask first of a vendor whose product generates language.

The qualification is in the wording. Excluding identifiable information from training is not the same as excluding customer data from training, because de identified data falls outside the exclusion entirely. At a reported two billion communications a year across a hundred million patients, the de identified corpus available to this company is among the largest conversational health datasets in existence, and nothing published states whether it is used for model development, what de identification method is applied to free text and voice, or whether customers can opt out.

Voice adds its own question. A recording carries identity in the voice itself, which no text de identification process removes.

Ask whether de identified customer conversations train or tune models, what method de identifies text and audio, and what retention applies to call recordings.

The posture is stated and the certification backing it is meaningful, with the contracting detail unpublished.

The company states compliance with the health privacy rule on its own materials, and holds certification against the healthcare control framework continuously since 2019. That framework matters here more than a generic security standard because it is built around the requirements of the privacy and security rules specifically, so certification against it is closer to independent examination of health privacy controls than a general attestation would be. The SOC 2 covering the privacy criterion reinforces the same point.

The customer base makes the underlying relationship unambiguous. More than a thousand provider organisations, plus federal health agencies, all covered entities, means business associate agreements exist as a matter of course, and a vendor operating at this scale in this segment has an established process for them.

What was not located is the detail a counterparty needs before signing: an availability statement, the contracting entity, what the agreement permits by way of data use for product improvement, the subprocessor list, and the breach notification commitment.

The subprocessor question deserves particular attention for this product class and is easy to overlook. Text and voice communications traverse telecommunications carriers and messaging aggregators. Message content therefore passes through third parties the vendor does not own, and at two billion communications annually that is not an edge case. Ask which carriers and aggregators are in the path, what they retain, and how they are covered contractually.

The strongest security disclosure in this category and among the strongest in the index.

What is held and published: certification against the healthcare control framework continuously since 2019; a SOC 2 Type 2 covering security, availability and privacy rather than security alone; certification to the information security management standard together with the cloud controls, cloud personal information and privacy information management standards; and a published trust centre. The company describes this as its sixth independent third party assessment, which is a useful way of stating a security programme's maturity because it counts examinations rather than logos.

The federal work adds a further layer. The platform is listed on the federal cloud authorisation marketplace at high impact level, which required demonstrating more than four hundred security controls assessed by an accredited independent assessor. That is a deeper examination than a commercial attestation, and few healthcare communication vendors undertake it.

One precision point a buyer should carry. The federal listing is an in process status, meaning authorisation is being pursued rather than granted, and the company's own site at one point renders it in wording that does not match the programme's standard terminology and reads as a completed certification. The underlying work is real and substantial; the label overstates where it had reached. Check the marketplace listing for current status rather than the marketing page.

Also stated, and credited on the stewardship axis: identifiable patient information is not used to train the models.

No device pathway applies, the company says so explicitly, and the regime that does govern this product is one most vendors in this index never encounter.

The scoping is unusually clean. The company states on its own site that its agents automate administrative workflows and do not provide medical advice, diagnosis or treatment, and that clinical decisions remain with licensed providers. Publishing the negative claim rather than leaving it implied is the right practice for a product that talks to patients in natural language, because the boundary between scheduling assistance and clinical advice is one a conversational system can cross by accident.

What actually governs is telephone consumer protection law, and it should be assessed per message type rather than per vendor. Automated calls and texts to mobile numbers generally require prior express consent. A regulatory exemption permits certain healthcare messages without it, covering things like appointment reminders, pre visit instructions, prescription notifications and post discharge follow up, subject to conditions on frequency, cost to the recipient and a working opt out. The exemption expressly does not extend to messages concerning accounts, billing, debt collection or marketing, which require the stricter consent standard.

That matters here because this platform spans both. Its described uses include scheduling, intake, forms and referrals, which sit inside the exemption, and billing questions, which do not. The same channel, the same patient and the same agent therefore carry messages governed by two different consent standards, and the classification is made per message rather than per deployment.

Ask how message types are classified, what consent record supports each, and who is liable if a message is misclassified.

No governance framework, model evaluation or performance disclosure was located, and the scale of this deployment makes one question unusually consequential.

The company reports operating across 109 languages and reaching roughly a hundred million patients a year through voice, text and web. Language is therefore not a feature of this product, it is the product, and performance in language is where a communication platform succeeds or fails for a given patient.

The questions follow directly and none is answered. Whether agent comprehension and generation quality are measured per language rather than in aggregate. Whether voice recognition performance has been assessed across accents, dialects, speech rate and age, all of which are known to affect automatic speech recognition. Whether translation of clinical or administrative instructions is validated, given that an appointment instruction rendered wrongly produces a missed appointment rather than an obvious error. And what happens when an agent does not understand: whether it escalates to a person, retries, or ends the interaction.

The consequence of uneven performance here is access rather than diagnosis. A patient whose language is well served gets a working front door to care; one whose language is served poorly gets friction, missed appointments and eventually disengagement, and the pattern shows up in no clinical audit because nothing was misdiagnosed.

The existing autonomy grade on this record reflects a well designed handover to staff, which is a real mitigation. Ask for per language performance data, escalation rates by language, and how translation quality is validated.

One small honesty is worth crediting because almost nobody bothers with it, and one capability needs measurement more than anything else on the record. The honesty: the company's own marketing notes that audio demonstrations may include both simulated interactions and real de identified patient calls used with consent.

Labelling which is which in a sales asset costs the vendor something and gives a prospective buyer an accurate picture of what they are hearing, and this index has recorded plenty of demonstrations where the provenance is left to assumption. The capability is translation.

Operating across more than a hundred languages is a substantial undertaking and nothing published states what performs it, whether output is reviewed, or how quality is assessed for languages with limited training resources. That last is where the harm concentrates, because machine translation degrades exactly there, and the patients receiving degraded health instructions in those languages are the least likely to complain, the least likely to be believed if they do, and the least likely to have an alternative.

An aggregate quality claim across a hundred languages would describe the well resourced ones. Nothing else is measured either: no model named, no architecture, no escalation logic, no versioning practice and no evaluation of comprehension, generation or recognition. Ask for translation quality by language tier, what review applies, and the escalation rule.

Named integrations across both commercial and federal record systems, which is rare enough in this index to earn the top grade.

Most vendors claim electronic health record integration without naming a system. This company names three, including a major commercial platform and two federal systems used by the veterans health administration and the tribal health system respectively. Naming federal record systems is meaningful because those environments are technically idiosyncratic, long lived and rarely supported by commercial vendors, so an integration with them is not something that can be asserted casually.

The integration is also bidirectional in the way that matters for this product class. Communications must be triggered by events in the record, appointments booked, visits completed, prescriptions ready, and the outcomes of those conversations must return to the record so that staff see what a patient said without opening another system. The company's description of coordinating agents across scheduling, intake, forms, referrals and billing only works if both directions function.

Scale corroborates it. More than a thousand provider organisations spanning specialty groups, federally qualified health centres, large integrated delivery networks and federal agencies is a customer base that cannot be served without working integrations across a wide range of systems, and the reported communication volume is not achievable through manual configuration.

What a buyer should still confirm is depth rather than existence: which events can trigger a workflow in their specific version, what the agent can write back, and whether write back lands in a discrete field or as a note.

Better characterised than most records in this index, and short of the top grade on detail rather than on posture.

What is stated: the platform is delivered as a cloud service, data is hosted on the company's own infrastructure in domestic data centres that are themselves independently attested, and a separate federal edition exists for government customers. Onshore hosting stated plainly is more than most vendors offer, and the existence of a distinct federal build is itself a residency and isolation statement, because federal cloud authorisation at high impact level imposes requirements on where systems run and who may administer them.

What is not published: region detail, the tenancy model separating one provider organisation from another, retention periods for messages and call recordings, and the subprocessor register.

That last omission carries more weight in this category than elsewhere. A patient communication platform cannot deliver a text or place a call without telecommunications carriers and messaging aggregators in the path, so parties outside the vendor's control necessarily handle message content, and at the reported volume the exposure is continuous rather than incidental. A buyer assessing where data lives should treat the carrier layer as part of the answer rather than as plumbing.

Ask for the tenancy and isolation model, retention for text content and voice recordings, the carrier and aggregator list, and whether the commercial and federal environments share any component.

No public pricing. Contact the vendor. Enterprise agreements with provider organizations and federal agencies; no published rate card. The May 2026 AI services model adds a professional services component whose commercial structure is also undisclosed.

Coverage is broad and enumerated: more than 1,000 provider organizations spanning specialty groups, federally qualified health centers, large IDNs, and federal agencies, across 109 languages and every major EHR. FQHC and federal coverage is a genuinely distinct capability, since those environments have procurement and accessibility requirements most vendors do not meet.