Candid Health

Deliberate B, and the reasoning matters for consistency with the rest of the RCM lane. The core engine is a rules engine carrying reverse-engineered payer requirements, which is sophisticated data engineering rather than machine learning, and the company describes AI as automating the feedback loop between claim insights and rule changes rather than as making the claim decisions.

Graded B not C because that ML feedback loop is a substantive and specific role, and because there is genuinely no offshore billing bureau underneath, unlike most of the category. Not A because the moat is the payer rules corpus and the data model, not the model. Compare CodaMetrix, graded A because the coding decision itself is the model output.

The autonomy claim is quantified with a defined, checkable metric, which is rare in this category. Touchless claim rate is explicitly defined on the product page as the percentage of claims submitted and finalised without human intervention, and the company reports rates above 95 percent. Publishing the definition alongside the number is what earns the A: a buyer can audit against it.

Customers also retain direct control over the automation, authoring and managing their own custom rules and enforcing their own workflows, so the autonomy is configurable rather than opaque. Contrast CodaMetrix, graded B precisely because its human routing threshold is not published.

The architecture is described concretely: a rules engine holding reverse-engineered payer requirements kept current, pre-submission claim validation and autocorrection, and ML applied to the insight-to-rule feedback loop. The company is also refreshingly non-inflationary about it, describing the approach as modern data engineering and automation rather than dressing the rules engine as artificial intelligence. Graded B rather than A because no model detail, training data description or accuracy methodology is published, and the 95 percent figures carry no stated denominator, sample or audit basis.

The audited attestation explicitly covers confidentiality alongside security and availability, which is a meaningful attested control over how patient information is handled rather than a claim, and the scoping distinction matters more than the certificate: most vendors in this index cite an attestation without saying which criteria it covered, and a report scoped to security alone establishes that the systems are defended while saying nothing about who inside the organisation may see what, or what the company may do with it.

Naming confidentiality as in scope answers a different and more relevant question. End to end encryption is also reported. Held at C because the question this business model turns on is unanswered. No published statement was located on data retention or on whether customer claims data is used to improve the shared rules corpus, and that is the pertinent question for a platform whose value compounds across customers: the corpus of reverse engineered payer requirements gets better precisely because many customers submit through it, so a customer is plausibly contributing to an asset their competitors use.

That may be entirely acceptable and it should be a stated term rather than an inference. No model, hosting arrangement or sub processor list was located either. Ask whether submission data informs the shared rules corpus, whether that can be declined, and for a retention schedule.

All performance evidence is vendor generated. Touchless claim rate and payor net collection rates above 95 percent, increased net collections and faster reimbursement are reported by the company without an independent audit, a named customer result, a stated measurement period or a baseline comparison. Revenue growth of nearly 250 percent year over year is a business metric, not evidence of customer outcome.

Named customers exist, including Talkiatry and Nourish, and a MedTech Award for Best RCM Software in 2025 is third party recognition, but neither is a measured result. Same standard applied to QuantHealth and Infervision: specific numbers with no disclosed methodology are still vendor claims. Not a clinical product, so this axis is read as operational evidence.

The SOC 2 report explicitly covers confidentiality alongside security and availability, which is a meaningful attested control over PHI handling rather than a claim. End-to-end encryption is reported. Graded B rather than A because no published statement was located on data retention or whether customer claims data is used to improve the shared rules corpus, which is the pertinent question for a platform whose value compounds across customers.

HIPAA-compliant security reported by third party review, and the platform processes claims containing PHI as core function. Graded B rather than A because no BAA terms or execution process were published in located materials.

Holds a SOC 2 report against the AICPA trust services criteria for security, availability and confidentiality, covering the Revenue Cycle Automation Platform specifically. A real named attestation, scoped to the product rather than to the company generally, puts this ahead of most vendors assessed in the same category, several of which hold none at all.

Graded B rather than A because the located announcement does not specify Type I versus Type II, and that distinction carries most of the weight in a SOC 2 report: a Type I covers the design of controls at a single moment, a Type II their operating effectiveness over a period. A buyer should require the report itself and check its scope section against the systems being purchased. The top band on this axis is reserved for vendors publishing a complete certification set with scope and audit dates available for inspection.

Converted from Not Rated. The prior scoping was correct and this vendor answers the substitute regime better than most in its category.

No device pathway applies. Claims processing and billing automation sit entirely outside software as a medical device. What governs is payer compliance and claims accuracy, and the structural point this index has established for the provider side holds: no vendor level regulator exists, and liability for an incorrect claim sits with the submitting organisation under the False Claims Act.

Where no regulator exists, this index grades on what the vendor publishes in its place. Three things stand out.

The headline metric is defined rather than asserted. Touchless claim rate is published alongside its definition, which is the difference between a number a buyer can compare and a number a buyer must trust. This index treats publishing the definition of a metric as a distinct credit, because most vendors publish the figure and leave the denominator unstated.

The rules are inspectable and editable by the customer. Buyers can author and manage their own payer rules directly, with training offered. That places the compliance logic where the liability already sits, with the organisation submitting the claim, rather than inside a vendor black box.

And the architecture is preventive rather than corrective, validating before submission rather than reworking denials afterwards.

Held at B because touchless by definition means no human verifies the individual claim. Oversight sits at the rule layer, which is a coherent design and a different one. Ask what proportion is reviewed and what governs rule changes.

No governance framework or bias disclosure located. The risk here is not demographic bias in the clinical sense but the same coding drift exposure flagged on CodaMetrix, in a different form: a rules engine optimised for touchless submission and net collections is optimising for claims that get paid, which is not identical to claims that are correct.

The liability asymmetry also applies, since incorrect claims to Medicare create False Claims Act exposure for the billing organisation rather than the software vendor. No published statement addresses how the rules engine is audited against coding accuracy as opposed to payment success.

One quality on this record is rare enough in this market to carry the grade, and it is a form of accuracy about the company's own product. The approach is described as modern data engineering and automation rather than dressed up as artificial intelligence, when a rules engine holding reverse engineered payer requirements is exactly the kind of system most vendors in this index would market as intelligent.

A company that declines to overstate what it has built is telling a buyer something reliable about how it will describe everything else, and it also sets the right expectation about failure modes, since a rules engine fails by having a stale or missing rule rather than by fabricating, and those need different diligence.

The architecture is described concretely around that engine, covering requirements kept current, pre submission claim validation and autocorrection, and machine learning applied to the loop that turns observed insight into a new rule, which identifies precisely where the learned component sits. Held below the top grade because nothing is measured.

No model detail, training data description or accuracy methodology is published, the headline percentage figures carry no stated denominator, sample or audit basis, and no warranty, indemnity or remediation commitment attaches. The rule currency claim is the one to test, since a rules engine's whole value is being up to date and a stale rule produces a confidently wrong submission. Ask how quickly a payer change reaches the corpus, and how the figures were measured.

API-first by design and explicit about it. The platform offers flexible modern APIs for direct integration alongside out-of-the-box connections, and is built to integrate with existing custom and commercial infrastructure, which is why it fits digital health companies with home-grown stacks as well as conventional medical groups. It also compiles provider rosters, credentialing data and custom key/value pairs into the claims process.

Same architectural posture that earned CertifyOS an A in credentialing: sold as infrastructure to build on rather than an application to log into. Note the practical caveat from third party review that data mapping setup requires dedicated time.

Converted from Not Rated. No hosting, region, tenancy or residency terms were located.

The platform is cloud delivered by implication rather than by statement. No cloud provider, no region, no indication of whether processing remains in country, no tenancy model, no subprocessor list, no backup or recovery posture and no retention schedule was retrieved.

What is documented is the connection layer rather than the hosting one, and it is documented well. The platform is interface first, offering flexible programmatic integration alongside prebuilt connections, and it compiles provider rosters, credentialing data and custom key value pairs to widen the share of the claims process it can automate. That tells a buyer how data moves in. It says nothing about where it comes to rest.

The holding is not clinical documentation but it is not trivial either: claims data carries diagnosis and procedure codes, patient identity and payment detail, and the roster and credentialing material adds provider level information. For customers that include digital health companies rather than only medical groups, that data may be the operational core of the business.

The company holds a SOC 2 report covering security, availability and confidentiality, which is graded on the security axis and does not substitute for a residency answer.

Ask where the platform is hosted, whether tenancy is isolated, and what the data return terms are at termination.

No pricing published and no pricing basis disclosed. This is a notable gap for an RCM platform specifically, because the category's dominant commercial model is a percentage of collections, which aligns vendor and customer incentives but also means cost scales with revenue. Whether Candid prices on collections percentage, per claim, or as a platform fee materially changes the buy, and none of it is public. Third party listings do not fill the gap.

Targets multi-site provider groups, medical groups and digital health companies nationally, with named customers spanning telepsychiatry and nutrition care, indicating genuine multi-specialty reach in the outpatient and virtual care setting. Graded B rather than A because coverage is ambulatory and digital health oriented, with no located evidence of hospital inpatient or facility billing, which is a materially different and harder claims environment.