Brellium

Clinical AI performs the main chart audit and coding tasks. It interprets narrative documentation against payer requirements, clinical standards, and customer criteria, then flags deficiencies or proposes codes with supporting reasoning. Reporting, configuration, and human coding services surround that automated review.

They are important operating components, but the core promise of reviewing large volumes of notes depends on model interpretation rather than conventional database queries alone. Removing the models would materially change the coverage and workflow offered to quality and revenue cycle teams, even where people remain responsible for reviewing findings and deciding how to respond.

The platform agreement treats outputs as recommendations or drafts requiring independent customer review before use. Managed coding adds certified human coders who review, correct, and communicate findings. Those are meaningful human controls, but current coding material also assures customers that every encounter is coded correctly. The statement has no reliability qualification attached to it, and separate agreement results of 85% to 92% do not support absolute correctness.

The operating model therefore includes review while the advertised assurance overstates its limits. Human participation can address errors without establishing that the model or resulting workflow is infallible.

Anthropic is identified among processing suppliers, and the coding product uses clinical note content and medical decision-making guidelines to recommend evaluation and management codes. The company describes adapting recommendations to organizational feedback and draws on experience from more than nine million behavioral health encounters.

Those statements explain the task and some development context, but they do not identify a production model version or establish the composition of a formal training dataset. Model selection, release-specific evaluation thresholds, update approval, and supplier roles by module remain unspecified. Technical detail is therefore partial across chart auditing and coding.

The security page names AWS, Azure, Anthropic, Google, and several other service providers, with a stated BAA commitment for each. The list is expressly dated February 2025, so it identifies a partial supplier chain without establishing that it is complete for every current module. The architecture maps some storage and audit processing steps, while production model assignments remain unclear.

Supplier specific training restrictions, inference retention periods, regional processing paths, and a fully current processor register remain unspecified. The named model supplier improves visibility, but does not resolve the full downstream handling of clinical notes and generated findings.

A coding comparison used 200 behavioral health notes at each of two unnamed clients and measured agreement with their own expert coders. The reported agreement ranged from 85% to 92%. This gives a task, reference reviewers, and sample size, but leaves observation dates, note selection, model version, and client identities unspecified. Comparisons with historical human coding studies involve different populations and methods, so they do not establish independent superiority. Named customer stories add operational context, while independent validation of the current coding release and matched comparative outcomes remain incomplete.

Customer data retention defaults to four years, with shorter or longer arrangements available. The security policy excludes PHI from model training, while the current platform agreement expressly permits training with deidentified data. The BAA defines that deidentification by reference to the HIPAA standard. These terms distinguish identifiable health information from permitted reuse after deidentification rather than promising no data use at all.

The contract also addresses post-termination export and deletion, with exceptions for backup systems. Backup deletion timing, detailed safeguards against fabricated clinical findings, and a dedicated AI safety incident process remain unspecified.

The March 2026 BAA identifies Brellium as business associate and sets safeguards, breach reporting, minimum necessary use, and corresponding written obligations for subcontractors handling PHI. The August platform agreement expressly applies that BAA to covered-entity use in trials, pilots, and production, and makes it controlling for PHI processing when terms conflict. This establishes the relationship, actual agreement text, environment coverage, and downstream obligations.

The BAA also addresses return or destruction at termination and continued protections when that is infeasible. These are contractual service commitments rather than a general website claim that the company follows HIPAA.

SOC 2 Type I and Type II completion is claimed, with Secureframe and the Johanson Group named in the assurance description. Reports require a request, so the current reporting period and complete system scope are not openly established. The site also describes encryption, single sign-on, access controls, and separate customer storage. The listed penetration test dates to March 2, 2025; a more recent completed test remains unverified. The available material supports a recognized attestation claim while leaving the current report and recent testing evidence unavailable for direct inspection.

Current marketing depicts alerts for self-harm risk, medication discrepancies, and treatment discontinuation concerns, with escalation to clinical staff. These functions suggest a role in identifying clinical risk. The August platform agreement, however, limits use to documentation analysis, excludes making clinical decisions or delivering care, and states that outputs are not intended to diagnose or treat disease.

The regulatory positioning of the clinical alert functions remains unresolved between those descriptions. Customer review and contractual restrictions define responsibility, but they do not identify the classification or authorization applicable to the current risk detection functionality.

Rula describes tailoring audit criteria with clinicians, scaling use gradually, and manually checking a sample of notes each week. Headspace likewise controls its own quality criteria and uses results to direct provider support. These examples show customer participation in operational quality assurance. The security material separately requires senior approval for production code changes.

A current formal framework for model governance, comparative patient subgroup results, release-specific behavioral evaluation, and independent oversight artifacts remain unspecified. Customer sampling and software code review therefore provide useful controls without establishing systematic governance of model changes and population-level performance.

The current agreement provides a conditional remedy for payer clawbacks caused by an error in Brellium's services. Customers must first contest the clawback, notify Brellium within 30 days of discovery, and supply supporting information. Brellium determines whether its error caused the loss, with reimbursement limited to fees paid in the preceding six months.

Coding, medical decision-making products, and pilots are excluded, as are specified customer-data, instruction, and later policy causes. This is an actual output-related financial remedy within a narrow scope. It does not promise blanket accuracy, cover every module, or guarantee payment merely because a customer attributes a clawback to the platform.

Athenahealth is a named integration partner, and the security architecture describes API retrieval of clinical notes from the EMR into the audit environment. Rula provides a concrete example of sending information in both directions between Brellium and its internal database. That example establishes an operating API workflow, but the database is not identified as a major EHR. A named production customer with bidirectional chart writeback into a major EHR remains unverified. The evidence therefore supports clinical data ingestion and configurable exchange without establishing the same depth for every claimed EMR connection.

The platform is hosted and uses a multi-tenant application with individual S3 buckets for each customer's data. The security material identifies Ohio for AWS storage and describes audit processing in AWS and Azure, followed by results stored in an AWS database. This gives concrete information about storage location and customer separation. The complete location of model inference, cross-border support access, downstream copies, and processing by every AI supplier remains unspecified. US storage and isolated buckets therefore establish useful parts of the architecture without defining the entire residency boundary for each module and its external services.

Subscription and professional service charges are defined in sales orders. The current agreement includes a default 10% annual renewal increase unless the parties agree otherwise, and it assigns EMR integration charges to the customer. These provisions explain some contract mechanics and potential cost drivers. Base subscription prices, included chart volumes, implementation amounts, and module-specific fees remain unspecified before a sales discussion. The renewal percentage is a relative increase rather than an entry price or a complete deployment budget.

Headspace, Rula, and Lightfully provide named examples in behavioral healthcare, while customer and partner references also include ABA organizations and other provider groups. Headspace reports reviewing more than 187,000 notes and expanding coverage from 2% to 100% with the same three-person quality team. Rula uses note analysis across its nationwide therapy and psychiatry network. These examples establish operating use in several behavioral care contexts.

They do not demonstrate equivalent coding accuracy or clinical risk detection across every medical specialty, payer population, or age group. Review coverage measures the proportion examined rather than the correctness of every finding.