Candid Health

Deliberate B, and the reasoning matters for consistency with the rest of the RCM lane. The core engine is a rules engine carrying reverse-engineered payer requirements, which is sophisticated data engineering rather than machine learning, and the company describes AI as automating the feedback loop between claim insights and rule changes rather than as making the claim decisions. Graded B not C because that ML feedback loop is a substantive and specific role, and because there is genuinely no offshore billing bureau underneath, unlike most of the category. Not A because the moat is the payer rules corpus and the data model, not the model. Compare CodaMetrix, graded A because the coding decision itself is the model output.

The autonomy claim is quantified with a defined, checkable metric, which is rare in this category. Touchless claim rate is explicitly defined on the product page as the percentage of claims submitted and finalised without human intervention, and the company reports rates above 95 percent. Publishing the definition alongside the number is what earns the A: a buyer can audit against it. Customers also retain direct control over the automation, authoring and managing their own custom rules and enforcing their own workflows, so the autonomy is configurable rather than opaque. Contrast CodaMetrix, graded B precisely because its human routing threshold is not published.

The architecture is described concretely: a rules engine holding reverse-engineered payer requirements kept current, pre-submission claim validation and autocorrection, and ML applied to the insight-to-rule feedback loop. The company is also refreshingly non-inflationary about it, describing the approach as modern data engineering and automation rather than dressing the rules engine as artificial intelligence. Graded B rather than A because no model detail, training data description or accuracy methodology is published, and the 95 percent figures carry no stated denominator, sample or audit basis.

All performance evidence is vendor generated. Touchless claim rate and payor net collection rates above 95 percent, increased net collections and faster reimbursement are reported by the company without an independent audit, a named customer result, a stated measurement period or a baseline comparison. Revenue growth of nearly 250 percent year over year is a business metric, not evidence of customer outcome. Named customers exist, including Talkiatry and Nourish, and a MedTech Award for Best RCM Software in 2025 is third party recognition, but neither is a measured result. Same standard applied to QuantHealth and Infervision: specific numbers with no disclosed methodology are still vendor claims. Not a clinical product, so this axis is read as operational evidence.

The SOC 2 report explicitly covers confidentiality alongside security and availability, which is a meaningful attested control over PHI handling rather than a claim. End-to-end encryption is reported. Graded B rather than A because no published statement was located on data retention or whether customer claims data is used to improve the shared rules corpus, which is the pertinent question for a platform whose value compounds across customers.

HIPAA-compliant security reported by third party review, and the platform processes claims containing PHI as core function. Graded B rather than A because no BAA terms or execution process were published in located materials.

Holds a SOC 2 report against the AICPA trust services criteria for security, availability and confidentiality, covering the Revenue Cycle Automation Platform specifically. A real named attestation puts this ahead of most vendors in this batch, several of which have none. Graded B rather than A because the located announcement does not specify Type I versus Type II, and that distinction is the whole point of a SOC 2, so a buyer should require the report itself. Compare Ibex Medical Analytics as the index benchmark for a complete published cert set.

Not an FDA regulated product. Claims processing and billing automation fall entirely outside Software as a Medical Device. The relevant regulatory exposure is payer compliance and claims accuracy rather than device regulation.

No governance framework or bias disclosure located. The risk here is not demographic bias in the clinical sense but the same CODING DRIFT exposure flagged on CodaMetrix, in a different form: a rules engine optimised for touchless submission and net collections is optimising for claims that get paid, which is not identical to claims that are correct. The liability asymmetry also applies, since incorrect claims to Medicare create False Claims Act exposure for the billing organisation rather than the software vendor. No published statement addresses how the rules engine is audited against coding accuracy as opposed to payment success.

API-first by design and explicit about it. The platform offers flexible modern APIs for direct integration alongside out-of-the-box connections, and is built to integrate with existing custom and commercial infrastructure, which is why it fits digital health companies with home-grown stacks as well as conventional medical groups. It also compiles provider rosters, credentialing data and custom key/value pairs into the claims process. Same architectural posture that earned CertifyOS an A in credentialing: sold as infrastructure to build on rather than an application to log into. Note the practical caveat from third party review that data mapping setup requires dedicated time.

Cloud platform by implication, but no hosting architecture, deployment option or data residency disclosure was located at the time of review.

No pricing published and no pricing basis disclosed. This is a notable gap for an RCM platform specifically, because the category's dominant commercial model is a percentage of collections, which aligns vendor and customer incentives but also means cost scales with revenue. Whether Candid prices on collections percentage, per claim, or as a platform fee materially changes the buy, and none of it is public. Third party listings do not fill the gap.

Targets multi-site provider groups, medical groups and digital health companies nationally, with named customers spanning telepsychiatry and nutrition care, indicating genuine multi-specialty reach in the outpatient and virtual care setting. Graded B rather than A because coverage is ambulatory and digital health oriented, with no located evidence of hospital inpatient or facility billing, which is a materially different and harder claims environment.