CarePilot

CarePilot sells four model driven products on top of the practice's existing record system. Scribe turns the visit conversation into a structured note, Coder proposes diagnosis and procedure codes from what was said and done, Script turns spoken plans into pended orders, and Amelia answers questions against the loaded chart. The practice already runs athenaOne as its record, and CarePilot adds no record of its own. EverCommerce chose it in 2026 as the AI partner behind EverHealth Scribe for DrChrono practices rather than build that layer itself.

Every output arrives as a draft. Notes, codes and orders open for the clinician to edit or discard, orders wait pended in the athenaOne queue until signed, and Amelia is described as drafting but never signing. In the company's own words, nothing reaches the chart without a clinician's signature. The inbox product follows the same pattern: it triages results, refills and messages, and each item ends at the clinician's sign off.

What is left open is the edge of the system's judgment. There is no stated point at which a draft is marked as low confidence, no description of how the inbox decides what is urgent, and no account of what happens to a rejected draft beyond the clinician's correction feeding calibration.

The engines are named even if the models are not. CarePilot runs on large language models from OpenAI, used through Microsoft Azure, and from Anthropic, according to its security page, and its trust portal lists Deepgram, a speech recognition provider, among its subprocessors. Startland News reported in January 2026 that the company processed 100 billion OpenAI tokens in 2025.

Which models sit behind Scribe, Coder and Script, which versions are in use and how a change reaches customers are not described, so a practice cannot tell when the system drafting its notes has changed. There is no model card or account of how the work is divided between the speech and language models.

Most of the chain is named. CarePilot's security page lists OpenAI, used through Microsoft Azure, and Anthropic as its model providers, with AWS as the host, and states that each model provider works under a business associate agreement, keeps nothing and trains on nothing.

The trust portal keeps a separate subprocessor list: AWS, Azure, Deepgram for speech recognition, Google Workspace and Intercom. It does not name OpenAI or Anthropic, and the security page does not name Deepgram, so neither list is complete on its own. Read together they give a practice every party the company acknowledges and the terms that govern patient data once it reaches the model layer.

The headline figures come from CarePilot's own customer base: 78 minutes a day returned to each provider, 98 percent ICD-10 accuracy during the visit, a 32 percent rise in same day claim submissions and 65 percent fewer manual administrative tasks. The company says these are measured across its customer practices, with no period, sample, method or definition of accuracy attached.

The customer list is more concrete. Twenty organizations are named, among them Astrana Health, Community Hospital Corporation, Prism Health North Texas and TrustCare Health, which piloted in September 2025 and expanded five times over the next seven months. Clinician testimonials describe documentation falling from ten minutes a visit to one or two.

When EverCommerce launched EverHealth Scribe in March 2026 it reported eight minutes saved per visit, attributed to CarePilot data, alongside a 32 percent rise in same day claim submissions. No study or outside evaluation sits behind any of these numbers.

Two commitments define how CarePilot handles patient data. Visit audio is deleted within 24 hours, and CarePilot states that it never uses customer health data to train or improve AI models, with its model providers bound to keep nothing and train on nothing. Each practice sets its own note retention and can request complete deletion at any time.

The edges are less clear. Transcripts have no stated retention window and de identification is not addressed. The FAQ says clinician corrections feed calibration without saying what is calibrated, and DrChrono's transparency note for EverHealth Scribe says de identified data may be used to improve the system, a use CarePilot's own pages neither confirm nor rule out. Guardrails against fabricated content, and how a safety event would be handled, are not described.

CarePilot acts as a business associate and signs an agreement with every customer before the first recorded visit, as well as with every subprocessor that touches patient data, model providers included. Its privacy policy places protected health information under that agreement and a separate master subscription agreement, and the security page describes how the data is encrypted, hosted, retained and deleted.

The agreement itself cannot be read before contracting, so its handling of subcontractors, breach timelines and the return of data at the end of a subscription can only be checked once a practice has a copy. The website terms carry generic language saying the services are not tailored to industry regulations; those terms cover only the marketing site, and the platform runs under the separate agreements.

CarePilot holds a SOC 2 Type II report from Prescient Assurance covering May to August 2025. Its trust portal lists the report alongside a cyber insurance document, and the full report is released under a nondisclosure agreement on request. The covered period ended in August 2025, and the company says a broader audit is already planned.

Around the report sit an annual penetration test by an outside firm, weekly automated vulnerability scans, required MFA for every user, SAML single sign on for practices with a central identity provider, and removal of access for departing staff within 24 hours. One detail does not line up: the trust portal says company policies are still being written with outside experts, while the security page describes more than 30 policies managed in Drata and reviewed each year.

Documentation, coding and order drafting for clinicians who sign everything is how CarePilot presents its work, and none of the products is described as diagnosing or recommending treatment. No device claim is made.

What the company does not publish is a statement of intended purpose. The nearest one belongs to DrChrono: its transparency note for EverHealth Scribe scopes that product to outpatient documentation and says it does not diagnose, treat or recommend care. CarePilot has since moved past documentation. Script drafts prescriptions, labs, imaging and referrals from the conversation, and Amelia answers clinical questions against the chart, and nothing on CarePilot's own pages says where those features sit or what they must not be used for.

The evaluation material comes from the distribution side. DrChrono's published AI transparency note for EverHealth Scribe, which names CarePilot as the builder, says the engine is assessed on accents alongside provider feedback, note completeness and usage, that monitoring runs continuously, and that a detected disparity leads to changes in prompts, pipeline, tooling and model tuning. It also lists audio quality, overlapping speech, accents and medical jargon as conditions that degrade output.

The commitment arrives without results: no groups tested, no figures by accent and no definition of what counts as a disparity. CarePilot's own pages are silent on evaluation by group, including for the 54 languages it says it transcribes.

The protection CarePilot offers against a wrong output is the review step. The clinician edits or discards each draft before signing, and the company describes that as the design rather than the exception, with corrections feeding back into calibration.

Nothing stands behind the output itself. The 98 percent coding accuracy figure comes without a method or denominator, and the subscription agreement that would carry any warranty or indemnity is not public. The website terms, which govern only the marketing site, cap liability at $100 and run indemnity from the user to the company. A patient who finds an error in a note corrects it through the practice; there is no route to CarePilot directly.

The athenaOne connection runs both ways at field level. CarePilot reads the schedule, demographics, problem list, medications, chart history, provider lists and the fee schedule with payer rules, and writes back discrete SOAP fields, problem list changes, ICD-10 and CPT codes, and orders into the right athenaOne queue for signature. It is listed on the athenahealth Marketplace with a five star rating across more than 55 reviews, and the company reports more than 400 practices charting on it.

DrChrono is the second record system, reached through its own marketplace listing with each provider authorizing access using DrChrono credentials, and the same engine sits inside DrChrono's EverHealth Scribe. No other system is supported, which the company presents as a deliberate choice to go deep on athenahealth rather than chase every EHR.

Hosting is cloud only, on AWS across four United States regions, with a commitment that patient data is processed and stored only in the United States. Data at rest is encrypted with AES 256 through AWS key management, data in transit with TLS 1.2 or later, and every database holding patient data is backed up daily with recovery tested.

The company also publishes a 99.9 percent monthly uptime commitment and disaster recovery plans tested each year. How one practice's data is kept apart from another's is not described.

A practice can learn how CarePilot charges before calling, but not what it charges. The core platform, covering Scribe, Coder and Script, is one price per provider per month, set by practice size and visit volume. The inbox product is sold separately per seat, and Amelia usage is included, with add on credits for heavy use.

There are no implementation, per patient or per note fees. A two week free trial covers the full platform, billing starts only when the practice decides to roll out, and a practice that walks away keeps its data. The figure itself arrives in a quote, and Dictate appears in the product list with no word on whether the provider price covers it.

Ambulatory practices on athenaOne are the home market, with DrChrono as the second record system. The listed specialties are family medicine, primary care and internal medicine, psychiatry, pediatrics and urgent care, and the named customers reach further: neurology, dermatology, pain and spine, telehealth primary care, house calls, and rural and community hospitals through Community Hospital Corporation, including swing bed care.

Those named practices show the product running in several of the settings it claims. The language claim has less behind it. The company says it transcribes visits in 54 languages and translates patient instructions, and lists the languages, but names no customer using them and publishes nothing on how well the notes hold up outside English.