Bluesight

Graded on the diversion product per the product-scoping rule. The AI necessity argument is explicit and well made by the company itself: simple statistics such as standard deviations and averages are inadequate against diverters who conceal their activity, because diversion patterns are visible only when many variables are compared simultaneously and evaluated against other patterns.

Unsupervised machine learning with continuous learning is the stated method, which is the technically appropriate choice given diversion is a rare, evolving and deliberately concealed behaviour with no reliable labelled training set. Note the wider Bluesight suite includes RFID inventory and purchasing optimisation products where AI is less central; this grade covers ControlCheck.

Detection and triage feeding human investigation, correctly positioned given that an alert here is a suspicion about a named clinician.

The company frames the product as an early warning system giving pharmacy directors control of discrepancy identification, with exception reports focusing attention on important discrepancies and automatic tracking of resolutions to produce a complete audit trail. It also explicitly supports building a diversion prevention programme with clinically driven workflows and cross departmental cooperation, which is an honest acknowledgement that the software is one component of a human governance process rather than the process itself.

Graded B rather than A because no alert precision or false positive rate is published, and in a product generating suspicion about individuals that is the number that matters most.

The strongest methodological transparency of any vendor in this category, and unusual anywhere in the index. The company published a substantive explanation of the data science behind the product, naming the technique as unsupervised machine learning, describing what it does as separating signal from noise across many simultaneous variables to reveal subtle behavioural differences among staff, and stating plainly why the simpler statistical approaches it replaces fail.

Naming unsupervised learning specifically, rather than saying AI, tells a technically literate buyer a great deal about how the system behaves, including that it surfaces outliers rather than matching known diversion signatures. Explaining the limits of the prior art is a form of candour most vendors avoid.

One deployment choice narrows the surface deliberately and no party is named. The company states it leverages existing reports and multiple data delivery options rather than requiring complex data integrations and approvals, which reduces both the integration surface and the number of directly connected systems, and data minimisation achieved by design rather than by retention policy is the more durable form.

That is a real architectural position and it is unusual to see it stated as a selling point rather than as a limitation. What the platform nonetheless holds is worth naming precisely, because it is two sensitive categories joined: medication administration records linked to identifiable patients, and the behavioural profile of identifiable staff derived from them.

A diversion detection system is necessarily a staff monitoring system, and the employee record it constructs is not something the employee sees. On enumeration there is nothing beyond a stated compliant cloud: no provider named, no sub processor list, no retention policy and no statement on whether customer data trains the models, which matters for an unsupervised method whose baseline is learned from observed behaviour. Ask which cloud, for a sub processor list, for retention on the staff behavioural profiles specifically, and whether one customer's data informs another's baselines.

Strong third party and scale evidence, though no published detection performance. Best in KLAS three years running for the diversion product, which is independent customer-sourced research, alongside market share leadership, more than 100 million medication transactions tracked, and over 1,000 US and Canadian hospitals using Bluesight solutions.

Named deployments include OhioHealth across 10 hospitals and Children's Hospital of the King's Daughters across 20 operating rooms, with the OhioHealth implementation reported to have produced diversion investigations. Graded B rather than A because no published data quantifies detection performance, meaning diversion events identified that manual reconciliation would have missed, nor any false positive rate. Scale of transactions audited is a coverage measure, not an efficacy measure, and the index applies that distinction consistently.

Runs on a stated HIPAA-compliant cloud platform, and the deployment design is deliberately in a way worth crediting: the company states it leverages existing reports and multiple data delivery options rather than requiring complex data integrations and approvals, which reduces both the integration surface and the volume of directly connected systems. The platform nonetheless processes medication administration records linked to identifiable patients and identifiable staff. Graded B rather than A because no published retention policy or statement on model training use was located.

HIPAA-compliant cloud platform stated directly, with the company noting patient data is secured without requiring complex data integrations and approvals. Graded B rather than A because no BAA terms were located in published form.

Converted from Not Rated. No independent attestation was located, consistent with every vendor this index holds in the category.

No SOC 2 of either type, no HITRUST, no ISO 27001, no trust centre and no penetration testing statement was retrieved.

The holding here is narrower than the privacy monitoring platforms graded alongside it and no less sensitive. Medication intelligence requires ingesting controlled substance transaction data from automated dispensing cabinets, pharmacy systems and administration records, tied to the individual staff members who withdrew, wasted and administered each dose. That is a complete account of which named clinicians handled which controlled substances, when, and in what quantities, across an institution.

Two things follow. It is directly useful to anyone seeking to divert without detection, because it maps exactly where reconciliation is weak. And it is employment sensitive in a way clinical data is not, since the subject of the record is a member of staff rather than a patient, and the consequence of exposure is professional rather than medical.

The standing finding across this category now holds after individual checks on seven vendors: companies whose product is assessing whether others are secure or compliant do not evidence their own posture.

Ask for the attestation and period, and for the retention and access controls over staff level transaction data.

Converted from Not Rated. The prior scoping was correct and the product's relationship to the governing regime is direct rather than incidental.

No device pathway applies. What governs is the Controlled Substances Act and the recordkeeping obligations that follow from it, and the company frames the product against them explicitly, describing the closing of gaps in the controlled substance record as a fundamental component of remaining compliant. State pharmacy and nursing board reporting duties attach when diversion is substantiated.

That framing is accurate and it is the reason this grades above a bare scoping note. Federal recordkeeping requires a complete and reconcilable account of controlled substance movement, and the practical failure mode in a hospital is not refusal to keep records but gaps that nobody reconciles because the volume defeats manual audit. A product that closes those gaps is discharging the obligation rather than reporting on it.

The exposure worth naming is the same one this pass has flagged for every diversion and privacy monitoring vendor. A substantiated finding can end a clinician's career and trigger a mandatory report to a licensing board. The consequence lands on an individual, and the vendor supplies the evidence. Nothing published describes what accuracy standard applies before escalation or what recourse the accused has.

Ask what precedes a substantiated finding, and what the false positive rate is on cases escalated to board reporting.

No governance framework, subgroup analysis or bias evaluation located, and the concern mirrors Protenus. This is workforce surveillance analysing behavioural patterns of named clinicians, where an alert can trigger investigation, employment action, licensure board referral or criminal referral.

Unsupervised anomaly detection carries a specific version of this risk: it flags statistical outliers, and a clinician whose legitimate practice differs from their peer group, through specialty, shift pattern, patient acuity or working in a small unit where peer comparison is thin, may be flagged for being unusual rather than for diverting.

The company's own citation that roughly one in ten healthcare providers is using or abusing drugs sets a high prior that could compound over-investigation. No published fairness evaluation or false accusation rate was located.

Naming the technique is doing real work here, and it is worth explaining why it counts as a limitation disclosure rather than only as transparency. The company published a substantive explanation of the data science, naming the method as unsupervised machine learning, describing it as separating signal from noise across many simultaneous variables to reveal subtle behavioural differences among staff, and stating plainly why the simpler statistical approaches it replaces fail.

Naming unsupervised learning specifically tells a technically literate buyer how the system behaves without any further disclosure: it surfaces outliers rather than matching known diversion signatures, which means it can catch novel patterns and equally that being statistically unusual is itself the trigger. A nurse whose practice differs legitimately, through shift pattern, unit, patient mix or simply working differently, is exactly the profile such a method surfaces.

Explaining the limits of the prior art is also a form of candour most vendors avoid. Held at C because nothing measures it. No precision figure, false positive rate or validation was located, and the affected party is a named clinician: a flag initiates a diversion investigation, an allegation that suspends and ends careers, attaching to someone with no access to the model and no route to see what triggered it. Ask for precision at the operating threshold, and what an investigated employee is entitled to see.

Integration is the product's precondition and it is executed with unusually low friction. The platform connects automated dispensing cabinets, electronic medical records and other systems to reconcile the full dispense, administration, waste and return chain, which requires bridging pharmacy and clinical systems that rarely share a view.

The company states it leverages existing reports and multiple data delivery options so health systems onboard quickly with minimal IT involvement, and the OhioHealth deployment across 10 hospitals in a reported 33 days is concrete evidence rather than a claim. Achieving that speed across a multi-hospital system in an integration-heavy domain is a genuine differentiator.

Cloud platform explicitly designed to avoid the integration burden that stalls deployments in this category, using existing reports and flexible data delivery rather than requiring bespoke interfaces and approvals. Demonstrated at speed with a 10-hospital rollout in a reported 33 days with minimal IT involvement, which is exceptional for a system touching both dispensing cabinets and EMRs. No data residency disclosure located, the only qualification.

No pricing published and no pricing basis disclosed. The suite structure adds complexity, since ControlCheck sits alongside RFID inventory management and purchasing optimisation products, and how those are bundled or licensed separately is not public.

Deep across the controlled substance chain rather than broad across security. Covers the full custody path from purchase through dispense, administration, waste and return, spanning pharmacy and patient care areas including operating theatres, deployed across more than 1,000 US and Canadian hospitals. Serves pharmacy, nursing and compliance functions.

Graded B rather than A because within this index's cybersecurity category the coverage is a single risk domain, medication diversion, without the privacy monitoring breadth of Protenus or the multi-asset scope of the device security vendors.