Assort Health

The product is the AI agent layer for patient communications, inbound and outbound.

Configurable stop logic disclosed: warm handoff triggered when identity cannot be confirmed, required details are missing, or a patient signals clinical urgency. Escalation criteria described but less formalized than a certification pipeline.

Synapse proprietary model named with training scale disclosed (190 million interactions, 62,000 care protocols, 1.6 million decision pathways) and real time updating described; no model card.

Two controls here are specific rather than aspirational and one omission is named by the company's own guidance. On the controls: identity is verified against the patient before any protected detail is disclosed, which places a gate ahead of the information rather than relying on the model to behave, and downstream business associate agreements are maintained across the sub processor chain a voice call passes through.

That second point is worth crediting carefully, because it is a different answer from a published list: it does not tell a buyer who the parties are, and it does tell them the contractual chain reaches them, which is what determines whether an obligation follows the data. A patient facing privacy policy exists separately from the corporate one, which is the right instrument for the affected party. The omission is the corpus.

The platform is marketed as trained on more than two hundred million patient interactions, and nothing published states whose interactions those are, whether customer call data contributes to model development, or what de identification is applied.

The company's own buyer guidance tells purchasers to have training use and de identification methods written into the contract, which is sound advice it does not follow publicly, and a vendor that has written the diligence checklist has already conceded the item it fails. No retention period is stated, and the agent draws on prior patient context across calls, so some patient derived history persists between encounters. Ask for the sub processor names, training use, retention and purge rights.

Vendor reported metrics (90 percent plus resolution rate, 99 percent scheduling accuracy, 5 percent appointment volume lift) with automated testing methodology described; no independent validation.

Two controls stand out and both are specific rather than aspirational. Identity is verified against the patient before any protected detail is disclosed, which places a gate ahead of PHI rather than relying on the model to behave, and downstream business associate agreements are maintained across the sub processor chain that a voice call passes through. A patient facing privacy policy exists separately from the corporate one.

Against that, the single most consequential question is unanswered. The platform is marketed as trained on more than 200 million patient interactions, and nothing published states whose interactions those are, whether customer call data contributes to model development, or what de identification is applied.

The company's own buyer guidance tells purchasers to have PHI use for model training and de identification methods written into the contract, which is sound advice it does not follow publicly. No retention period is stated, and the agent draws on prior patient context across calls, so some patient derived history persists between encounters. Worth resolving training use, retention and purge rights in contract.

The strongest business associate position published by any vendor in this category, and it is strong for a specific reason. The company states that it operates under a signed BAA and maintains downstream BAAs across its sub processor chain.

That second half is what matters: a single voice AI call may pass through speech to text, text to speech, telephony and model inference providers, each of which touches protected health information, and vendor level HIPAA compliance alone does not cover them. Almost no competitor addresses the chain at all.

A patient first identity verification step is also described, confirming who is calling before any protected detail is disclosed, and a patient privacy policy is maintained separately from the corporate one. Held below the top of the band because none of it is evidenced publicly. Sub processors are not named, no BAA terms or HIPAA documentation are published, and no attestation is offered. Worth requesting the sub processor list and the downstream BAA structure in writing.

Nothing is published on the company's own site. There is no trust center, no security page, and no certification claim anywhere in its own materials; the footer offers terms, a privacy policy and a patient privacy policy. SOC 2 Type II and HITRUST appear against the company in third party directory listings, but a directory entry is not a vendor claim and cannot support a grade on its own.

What makes the gap notable rather than ordinary is that the company publishes a buyer's due diligence checklist advising healthcare IT teams to require exactly these artefacts before signing: an executed BAA covering current AI features, a SOC 2 Type II report, HITRUST or an AI security assessment, encryption detail, multi factor authentication and least privilege controls, audit logs, data flow maps and a complete sub processor list. That is a well judged standard, and the company does not publicly meet it. The material may well exist under NDA. Worth asking for the full package named in its own guidance.

This is patient access and administrative automation rather than a diagnostic product, so no FDA clearance applies and none is claimed. Read against the frameworks that would govern it, though, the published position is thin. Nothing maps the platform to HIPAA Security Rule safeguards as a framework, to health sector cybersecurity performance goals, or to any recognised practice standard, and no regulatory posture statement exists beyond assertions of HIPAA compliant operation.

One boundary deserves a direct question rather than an assumption. The platform performs intelligent triage and routing, and triage that takes symptom information from a patient and directs them to a level of care sits closer to the clinical decision support boundary than scheduling does. Nothing published addresses where the company draws that line, what the agent will not assess, or how a clinical escalation is triggered. Worth asking for the written scope of the triage function and its escalation criteria.

One genuinely creditable acknowledgement sits in an otherwise empty picture: the company states that risks beyond security certification require review because AI systems carry behavioural risks such as hallucination. Naming hallucination as a procurement risk is more candour than most vendors in this category offer. Beyond that there is no governance substance.

No AI management framework or certification, no model documentation, no description of the training corpus beyond its scale, and no accuracy, containment or escalation failure figures. The omission is pointed because the company's own buyer guidance instructs purchasers to require containment rates from production deployments before signing, and it publishes none of its own.

What is published instead is satisfaction: an average rating of 4.3 out of 5 across roughly 344,000 patient ratings, which is a real and unusually large sample but measures how calls felt rather than whether they were clinically correct. No performance breakdown by language, accent or specialty is offered. Worth requesting containment and escalation rates, and performance by language.

The proprietary model is named and its scale is decomposed across three different quantities rather than reported as one corpus figure, covering interactions, care protocols and decision pathways, with real time updating described.

Decomposing scale that way is more informative than a single number, because those three describe different things: interaction volume speaks to language coverage, protocol count to clinical breadth, and pathway count to how finely the system branches, and a reader can judge whether the three are consistent with each other. Most vendors in this category publish one figure or none. Held at C because nothing measures the system.

No model card, accuracy figure, containment rate, escalation rate or evaluation methodology was located, and no warranty, indemnity or remediation commitment. The failure that matters on a patient facing line is the call that was handled rather than escalated: a system confident enough to answer produces a patient who acted on what they were told, and no artefact records that the answer was wrong.

Real time updating adds a second question, since a system that changes continuously is a different artefact from week to week and nothing describes how a health system is told when behaviour changes. Ask for containment and escalation rates, intent recognition accuracy on clinical topics, and how updates are notified.

Breadth is the strength here. Real time write back is documented across more than twenty electronic health record and practice management systems, with native Epic and athenahealth integration named and the athenahealth connection described as the most developed in the market.

Write back matters more than the count: a read only lookup can tell a patient what slots appear free, but only a write can hold the appointment, apply provider specific scheduling rules and update the record without someone tidying up afterwards. That is the difference between an agent that answers the phone and one that finishes the job. Worth understanding when comparing against competitors in this category, because depth and breadth diverge here.

This platform reaches more systems and writes scheduling data reliably into them; others reach fewer systems but write clinical documentation rather than appointments. Neither is better in the abstract. A practice whose constraint is its scheduling stack should weight breadth; one that wants conversations to become chart content should weight the other. Worth confirming which of the twenty are native versus partner built.

Delivered as a vendor hosted service that layers over existing EHR, practice management and telephony systems rather than replacing them, which is a low friction model and is described as such. Underneath that description almost nothing is published. No hosting provider is named, no cloud region or data residency commitment is offered, no tenant isolation model is described, and there is no customer hosted option.

The gap carries more weight in this category than it would elsewhere because voice adds parties: the call itself traverses telephony, speech recognition and synthesis providers before reaching the model, and the company acknowledges this chain in its own buyer guidance without saying where any of it runs. Patient context also persists between calls, so data accumulates rather than passing through. Worth establishing where calls are processed and recordings stored, which providers sit in the path, how long audio and transcripts are retained, and whether any of it can be region bound.

An unusual profile: outcome economics are published in detail while price is not published at all. The company reports roughly 3.3 million dollars in annual revenue per hundred providers, a 115 percent lift in labour capacity, and named customer results including 2.3 million and 1.3 million dollars in captured revenue, a 97 percent reduction in hold times and an 81 percent fall in call abandonment, each attributed to an identified practice with a named executive.

That is materially more return detail than competitors offer. What is absent is the other half of the equation. No pricing, pricing metric or contract structure appears anywhere, so a buyer cannot tell whether charging is per call, per provider, per location or per resolved interaction, and without a cost the published return figures cannot be converted into a return on investment. Worth establishing the pricing metric early, since per call and per provider models diverge sharply as volume grows.

More than 22 specialties explicitly enumerated, from orthopedics and dermatology through behavioral health and oncology, with named practice deployments.