Bluesight

Graded on the diversion product per the product-scoping rule. The AI necessity argument is explicit and well made by the company itself: simple statistics such as standard deviations and averages are inadequate against diverters who conceal their activity, because diversion patterns are visible only when many variables are compared simultaneously and evaluated against other patterns. Unsupervised machine learning with continuous learning is the stated method, which is the technically appropriate choice given diversion is a rare, evolving and deliberately concealed behaviour with no reliable labelled training set. Note the wider Bluesight suite includes RFID inventory and purchasing optimisation products where AI is less central; this grade covers ControlCheck.

Detection and triage feeding human investigation, correctly positioned given that an alert here is a suspicion about a named clinician. The company frames the product as an EARLY WARNING SYSTEM giving pharmacy directors control of discrepancy identification, with exception reports focusing attention on important discrepancies and automatic tracking of resolutions to produce a complete audit trail. It also explicitly supports building a diversion prevention programme with clinically driven workflows and cross-departmental cooperation, which is an honest acknowledgement that the software is one component of a human governance process rather than the process itself. Graded B rather than A because no alert precision or false positive rate is published, and in a product generating suspicion about individuals that is the number that matters most.

The strongest methodological transparency of any vendor in this category, and unusual anywhere in the index. The company published a substantive explanation of the data science behind the product, naming the technique as unsupervised machine learning, describing what it does as separating signal from noise across many simultaneous variables to reveal subtle behavioural differences among staff, and stating plainly why the simpler statistical approaches it replaces fail. Naming unsupervised learning specifically, rather than saying AI, tells a technically literate buyer a great deal about how the system behaves, including that it surfaces outliers rather than matching known diversion signatures. Explaining the limits of the prior art is a form of candour most vendors avoid.

Strong third party and scale evidence, though no published detection performance. Best in KLAS three years running for the diversion product, which is independent customer-sourced research, alongside market share leadership, more than 100 million medication transactions tracked, and over 1,000 US and Canadian hospitals using Bluesight solutions. Named deployments include OhioHealth across 10 hospitals and Children's Hospital of the King's Daughters across 20 operating rooms, with the OhioHealth implementation reported to have produced diversion investigations. Graded B rather than A because no published data quantifies detection performance, meaning diversion events identified that manual reconciliation would have missed, nor any false positive rate. Scale of transactions audited is a coverage measure, not an efficacy measure, and the index applies that distinction consistently.

Runs on a stated HIPAA-compliant cloud platform, and the deployment design is deliberately in a way worth crediting: the company states it leverages existing reports and multiple data delivery options rather than requiring complex data integrations and approvals, which reduces both the integration surface and the volume of directly connected systems. The platform nonetheless processes medication administration records linked to identifiable patients and identifiable staff. Graded B rather than A because no published retention policy or statement on model training use was located.

HIPAA-compliant cloud platform stated directly, with the company noting patient data is secured without requiring complex data integrations and approvals. Graded B rather than A because no BAA terms were located in published form.

No third party attestation such as SOC 2 Type II or HITRUST was retrieved at the time of review. Consistent with every vendor in this category, none of which publishes one.

Not an FDA regulated product. The governing regulatory surface is the Controlled Substances Act and DEA recordkeeping obligations, which the company explicitly frames the product against, noting that closing gaps in the controlled substance record is a fundamental component of remaining compliant. State pharmacy and nursing board reporting duties apply when diversion is substantiated.

No governance framework, subgroup analysis or bias evaluation located, and the concern mirrors Protenus. This is workforce surveillance analysing behavioural patterns of named clinicians, where an alert can trigger investigation, employment action, licensure board referral or criminal referral. Unsupervised anomaly detection carries a specific version of this risk: it flags statistical outliers, and a clinician whose legitimate practice differs from their peer group, through specialty, shift pattern, patient acuity or working in a small unit where peer comparison is thin, may be flagged for being unusual rather than for diverting. The company's own citation that roughly one in ten healthcare providers is using or abusing drugs sets a high prior that could compound over-investigation. No published fairness evaluation or false accusation rate was located.

Integration is the product's precondition and it is executed with unusually low friction. The platform connects automated dispensing cabinets, electronic medical records and other systems to reconcile the full dispense, administration, waste and return chain, which requires bridging pharmacy and clinical systems that rarely share a view. The company states it leverages existing reports and multiple data delivery options so health systems onboard quickly with minimal IT involvement, and the OhioHealth deployment across 10 hospitals in a reported 33 days is concrete evidence rather than a claim. Achieving that speed across a multi-hospital system in an integration-heavy domain is a genuine differentiator.

Cloud platform explicitly designed to avoid the integration burden that stalls deployments in this category, using existing reports and flexible data delivery rather than requiring bespoke interfaces and approvals. Demonstrated at speed with a 10-hospital rollout in a reported 33 days with minimal IT involvement, which is exceptional for a system touching both dispensing cabinets and EMRs. No data residency disclosure located, the only qualification.

No pricing published and no pricing basis disclosed. The suite structure adds complexity, since ControlCheck sits alongside RFID inventory management and purchasing optimisation products, and how those are bundled or licensed separately is not public.

Deep across the controlled substance chain rather than broad across security. Covers the full custody path from purchase through dispense, administration, waste and return, spanning pharmacy and patient care areas including operating theatres, deployed across more than 1,000 US and Canadian hospitals. Serves pharmacy, nursing and compliance functions. Graded B rather than A because within this index's cybersecurity category the coverage is a single risk domain, medication diversion, without the privacy monitoring breadth of Protenus or the multi-asset scope of the device security vendors.