BrainCheck

Deliberate C, and the most important grade on this record. BrainCheck Assess is a digitized, normed battery of established neuropsychological instruments (Stroop, Trail Making, Digit Symbol Substitution, recognition memory) delivered on a tablet with an expanding normative database for scoring. That is digitization plus norming, not a machine learning diagnostic model, and no located material describes a trained model doing the classification.

The moat is the validated battery, the normative data and the reimbursement workflow, not the AI. Same principle applied to ModMed, Indica Labs and the credentialing lane: where the asset is the data or the platform rather than the model, AI Centrality is graded down regardless of how the company is tagged elsewhere.

A on candour, the MD-Staff precedent. The company states plainly that BrainCheck is not intended for use as a stand-alone diagnostic tool, that Assess is designed to support clinical interpretation rather than replace it, and that structured cognitive data should be interpreted alongside history, exam findings and functional status, never in isolation. Explicit, repeated, and placed in product copy rather than buried in a disclaimer. Where a vendor's scope limits are this clearly drawn, the index credits it.

The battery composition is fully disclosed down to the individual instruments and the cognitive domains each targets, and the normative database is described as an expanding reference set. That is more transparency than most vendors offer. Graded B rather than A because there is no published model card or algorithmic description, which is consistent with there being little algorithmic content to describe.

This is the first record in the backfill where a vendor states a policy of not enumerating its chain, which is a different thing from an omission and should be graded as one. The published policy says the company does not publish its list of service providers because they change from time to time, offering to supply names by email on request instead.

Category level disclosure does exist and is better than nothing, since sharing of test results with third party cognitive health services is disclosed plainly and described as including care management providers, brain training products and pharmaceutical companies, gated behind consent. Naming categories is not naming parties. What decides the grade is a separate published term that makes any list a snapshot rather than an answer.

The test taker privacy policy permits the company to use, share, disclose and sell personal data in anonymised or aggregated form without restriction. An unrestricted permission to sell de identified data means the set of recipients is open ended by design, so even a complete list supplied on request would describe today's chain and carry no commitment about tomorrow's.

Retention compounds it: data transferred to United States servers may be maintained indefinitely, the retention section commits to no period, and backups may persist with no expiry stated. Nothing addresses whether test results train models, and the unrestricted permission would encompass that use. Ask for a retention period, ask whether the sale permission can be struck from the agreement, and request the provider list.

The strongest axis on this record and unusually complete for a company of this size. A validation study of 99 participants reported at least 88 percent sensitivity and specificity separating normal cognition from dementia and at least 77 percent separating mild cognitive impairment from the other groups, with three-group true positive rates reported separately and honestly, including the weaker 64 percent for the MCI group.

A later analysis found a Pearson correlation of 0.77 against the Montreal Cognitive Assessment with confidence interval reported. A 529 participant study across four US clinical sites, run with BrainBox Solutions and registered as NCT04423198, tested test retest reliability and concurrent validity against the corresponding paper instruments.

A separate finding that remote self-administration is statistically indistinguishable from coordinator led in-person sessions directly validates the deployment claim rather than just the test. Published in peer reviewed venues and reporting the unflattering numbers alongside the good ones.

The disclosure here is unusually detailed, and the grade reflects what the published terms permit rather than any silence. Assessment data is handled under role based access controls with activity logging, encrypted in transit and at rest, and BrainCheck states that retention and deletion can be aligned to customer contractual requirements. Sharing of test results with third party cognitive health services, which the policy says may include care management providers, brain training products and pharmaceutical companies, is gated behind consent and disclosed plainly in the policy rather than left to inference.

Three published terms work against the buyer. The test taker privacy policy permits BrainCheck to use, share, disclose and sell personal data in anonymised or aggregated form without restriction. It states that data transferred to United States servers may be maintained indefinitely, and the retention section commits to no period at all, adding that copies may persist in backups for additional time with no expiry given. BrainCheck also states as a matter of policy that it does not publish its list of service providers because they change from time to time, offering to supply names by email on request instead.

Nothing published addresses whether test results are used to train or improve models, and the unrestricted permission over de identified data would encompass that use. The policy collects race and ethnicity, which is ordinary practice for demographically adjusted cognitive norms but does mean the data required to answer questions about performance across patient groups is already held. Buyers should ask for a retention period in writing, ask whether the sale permission over de identified data can be struck from the agreement, and request the service provider list. The policy was last updated in September 2024 and its change of control clause refers to a different company's assets, which suggests it has not been reviewed recently.

BrainCheck publishes its Business Associate Agreement in full as a public web page rather than merely referring to one, and repeats the agreement text inside its terms of service. It also publishes a HIPAA Compliance Program Declaration as a separate document. The agreement identifies BrainCheck as the business associate, acknowledges the security and breach notification provisions, agrees to make its internal practices, books and records available to Health and Human Services for the purpose of determining compliance, and accepts the HITECH Act privacy provisions including the restrictions on marketing and sale of protected health information and the minimum necessary standard. The service agreement names HIPAA, HITECH and their implementing regulations at 45 CFR parts 160, 162 and 164, and additionally names Washington state privacy law. The security page states that BrainCheck executes a business associate agreement with covered entities and eligible partners.

Most vendors assessed in this index either assert HIPAA alignment without naming the instrument at all, or name the agreement without providing it. Publishing the operative terms is materially more useful, because it lets a buyer read the obligations and the liability allocation before entering a sales process rather than after.

One drafting point is worth raising. The test taker privacy policy frames the business associate obligation conditionally, as applying if BrainCheck ever creates, receives, maintains or transmits protected health information, which sits oddly with a product that plainly does handle it. Buyers should confirm that the published agreement is the current executed form, ask whether its terms are negotiable, and ask which BrainCheck products the agreement covers, since the company markets both regulated and unregulated components.

BrainCheck maintains a dedicated security and compliance page and holds two independent third party certifications. The platform is HITRUST certified at the i1 tier, meaning its security and privacy controls have been assessed and validated against a healthcare specific framework rather than a general one. Its cloud platform is separately certified under TX-RAMP Level 2, the Texas state programme for cloud services processing confidential or regulated government data, which aligns to NIST SP 800-53 Moderate controls. Named controls include encryption in transit and at rest, secure key management, segregated environments, role based access control, least privilege permissions, audit logging and monitoring, and defined incident response procedures. BrainCheck also runs a structured vendor security review process and states it will supply HITRUST certification materials, security architecture overviews, policy summaries and questionnaire responses on request, usually under a non disclosure agreement.

This is the strongest security position in the cognitive assessment category. Two independently assessed certifications, one healthcare specific and one a government cloud authorisation, carry the grade on their own; the index has awarded this level for a certification stack without a public trust centre before.

Four things are absent and a buyer should raise each. No SOC 2 report of any type is claimed, which most comparable vendors do hold. The HITRUST certification is at the i1 tier rather than the more extensive r2, a distinction that changes both the control count and the assessment period. No certificate is published as a document with its scope and expiry, so currency cannot be checked without asking. No penetration testing statement was located and no subprocessor list is published. Buyers should request the current HITRUST certificate, confirm the tier and the scope it covers, and ask when it expires.

BrainCheck Assess is regulated as a Class II medical device and the company is consistent about which single component carries that status: Assess is described as the only FDA registered Class II component within a platform of more than 30 tools. That scoping discipline is creditable and mirrors Milvue.

Graded B rather than A because located materials use the terms FDA cleared, FDA registered and FDA approved inconsistently across pages and third party coverage, and no specific 510(k) number was retrieved. A buyer should obtain the clearance number and intended use statement directly.

Better than most in the index on the dimension that matters for this product. Cognitive testing is acutely sensitive to language, education and cultural background, and normative data quality is the governance surface. The company has publicly expanded its normative database specifically to support accuracy and consistency, states the assessment maintains consistency across devices and demographics, and the battery is available in English and Spanish.

Graded B rather than A because no subgroup performance breakdown by race, education level or primary language was located, and those are exactly the axes on which cognitive instruments are known to misclassify.

The product's inspectability is genuine and it comes from the design rather than from disclosure practice. The battery composition is published down to the individual instruments and the cognitive domains each targets, so a clinician who wants to know what a score means can read the instrument and the construct it measures, and there is comparatively little algorithmic content standing between the test and the result.

That is a real mechanism: an unexplained output is contestable only in principle, while a score from a named instrument is contestable in practice. The normative database is described as an expanding reference set. Held at C for two reasons and the second is unusual. No accuracy or validation figure was located for the impairment determination as distinct from the individual instruments, which is the output a clinician acts on.

And several published terms work against the person being assessed rather than merely being silent: indefinite retention on United States servers, no committed retention period, backups with no stated expiry, and an unrestricted permission to sell de identified personal data. A test taker in a cognitive assessment is frequently the party least equipped to read those terms or to object to them, and they are not the purchaser.

The policy was last updated in September 2024 and its change of control clause refers to another company's assets, which suggests it has not been reviewed recently. Ask for validation of the impairment output and for a negotiated retention term.

Named live integrations with Epic and athenahealth, with athenahealth customers described as having instant integration, and assessment scheduling and results linked to the patient chart. Naming specific EHRs rather than claiming generic interoperability is worth credit.

Graded B rather than A because the integration list is short against index leaders such as SpinSci and CertifyOS, and the company notes some feature availability is determined by EHR integration, meaning capability varies by platform.

Genuinely flexible delivery: runs on any tablet or smartphone, supports both in-clinic and remote administration, and the company reports same-day setup by a US based team. The remote equivalence finding gives the deployment claim evidentiary support rather than leaving it as marketing. No data residency or hosting architecture detail was located.

No list price, but the reimbursement disclosure is the most practically useful in this part of the index and is published openly rather than gated behind a sales call. The company names the specific CPT codes involved, including 96136 and 96138 for test administration and scoring depending on whether a professional or a technician administers, 96132 for interpretation, and 99483 for cognitive care planning, states the 16 minute minimum for the time based codes, addresses modifier use when an E/M service is billed the same day, notes which codes can be delivered via telehealth including audio-only, and publishes an annually updated reimbursement guide.

It also states plainly that billing decisions remain provider-driven and payer-dependent and that the material is educational rather than billing advice. Naming the revenue path this precisely, with the caveats attached, is the Cleerly pattern applied to an outpatient workflow.

Explicitly spans primary care, neurology, geriatrics, behavioral health and research, in-clinic and remote, and the platform is used in clinical, academic and translational research across neurological disease, aging, cancer, post-viral syndromes and population health. Broad across care settings for a single clinical question. Graded B rather than A because the clinical scope is one domain, cognition, however many settings it reaches.