Cedar

Cedar Intelligence and the Kora voice agent are real model driven capability, and Kora is trained on the company's own billing interaction data rather than a general model, which is where Cedar stakes its difference. Underneath sits a patient payments and billing platform that predates the AI and functions without it; Kora and the personalization engine are layers on a payments product, which the company's own framing as a performance engine for financial experience reflects.

The oversight structure is described with the threshold missing. Kora runs autonomous inbound voice, outbound voice and two way text: it verifies identity, answers billing questions, resolves coordination of benefits issues and sets up payment plans.

Cedar says it handles routine work end to end, reserves live staff for complex cases, transfers with full context whenever human escalation is required, uses real time sentiment analysis, and gives providers configurable safety controls and auditable decision logs. What is not published is what the agent may not do, or the condition that triggers a transfer; 'whenever escalation is required' names no threshold.

The training data is characterized and the models are not. Cedar says Kora is trained on 1.5 billion+ patient interactions and $13.6 billion in processed payments, that its collection logic improves daily from data across customers, and that a context engine remembers patient history and predicts the next step, combining revenue cycle logic with conversational AI. No model, technique, version, accuracy figure or escalation threshold is published. The figures published measure volume and deflection (40 percent of calls resolved without a live agent), not whether answers were right.

The architecture is described and no model provider is named. Cedar names AWS as its host and Cloudflare for DDoS protection, and describes a vendor review program. A voice agent also needs speech recognition, speech synthesis and telephony, and none of those providers is named, nor is any base model; 'trained on Cedar's data' describes the training corpus, not who supplies or runs the model. No subprocessor list is published.

Named deployments with outcome figures, short of independent evaluation. Cedar's case studies name Gastro Health (Kora voice support), ApolloMD (patient payments up 42 percent), U.S. Anesthesia Partners, NAPA (post insurance payments up over 70 percent), Talkiatry (96 percent of payments online), Unio Health Partners and Advanced Dermatology and Cosmetic Surgery ($9.5 million increase in net profit in one year).

The Kora Platform page reports 600,000+ calls handled, 40 percent fully resolved without a live agent, a 21 percent increase in seven day payment rates from outbound voice, a 22 percent reduction in staff and 24 percent less live handle time. The site's footnote says Kora and Cedar Support metrics come from pilots and surveys from 2024 through 2026 and are illustrative. Resolution quality, meaning whether the answer given was right, is not reported.

Categorical statements on training use and caller verification, without the retention schedule behind them. The data here is protected health information joined to payment and financial hardship. Kora verifies the patient's identity before discussing an account, which is the primary safety control for an agent that states what a named person owes.

Cedar says Kora is trained on 1.5 billion+ patient interactions and $13.6 billion in processed payments, and that collection logic improves daily from network effects across customers, so one provider's patient interactions shape the agent other providers deploy. The security page describes role based access control for PHI and monitoring of all access to it.

Nothing published states whether calls are recorded, how long recordings or transcripts are kept, or whether data is de identified before training. Safety engineering is not published either: guardrails beyond the stated controls, and how a safety event is handled.

A status is stated and the only privacy document behind it covers the website. Cedar's privacy policy (last updated November 2024) states that for information it processes on behalf of health systems and providers it acts as a data processor and/or business associate, with the customer determining how that information is used; the policy itself is written for the website. The Kora page describes security aligned with HIPAA standards.

No business associate agreement, no service level privacy notice for patients using Cedar's billing channels, and no statement on how call recordings and transcripts are treated are published. The fact that a named person received a billed service at a provider is protected health information whether or not a diagnosis appears.

Controls are described, and any assurance is left to a linked trust center. The security page, headed 'secure, compliant, certified', names no certification; it describes a 24/7 security operations center, monitoring of all access to PHI, continuous vulnerability scanning, code review, disaster recovery testing, single sign on and role based access. The Kora Platform page describes security 'aligned with' HITRUST, PCI DSS and HIPAA standards, which is not certification. The trust center, linked from the footer, sits on a compliance automation platform and may say more.

Patient billing and payments sit outside FDA's jurisdiction, so no device claim is made and none applies. The regimes in range are consumer financial ones: debt collection rules where a vendor helps a provider collect patient balances, PCI DSS for card payments, and the Telephone Consumer Protection Act for outbound calls, which since the FCC's February 2024 ruling treats AI generated voices as artificial voices requiring prior express consent.

Cedar describes Kora's outbound calling and messaging as consent aware and compliant with that act, and its security as aligned with PCI DSS. Inbound calls raise none of this. The site does not say where consent is captured for outbound Kora or who holds the record.

Governance is committed to in product language, with no evaluation of the AI published. The Kora Platform page describes auditable guardrails, auditable decision logs, configurable safety controls and strict revenue cycle controls. Nothing published evaluates whether Kora's answers, resolution rate or outbound targeting differ across patient groups, languages or ability to pay.

That is where the question sits for this product: an agent that decides whom to call about a balance, and when, shapes who is pursued, and Cedar says its collection logic improves daily from data across all its customers. Kora offers full Spanish language coverage, yet no resolution or escalation rates by language are shown, and nothing says how outbound targeting treats patients who qualify for financial assistance.

Mechanisms exist and nothing stands behind them. Kora transfers a caller to a live agent with the full case context whenever escalation is required, so a patient disputing a balance reaches a person without starting over, and the Kora Platform page describes auditable decision logs and configurable safety controls.

Cedar describes its outbound calling and messaging as consent aware and compliant with the Telephone Consumer Protection Act; the provider deploying outbound calls still carries that exposure, and the patient's private right of action runs against the provider. Nothing published sets an accuracy commitment, a remedy when Kora gives a wrong balance, or an indemnity, and Cedar's footer states its metrics are illustrative and not a guarantee.

Named systems with production scale, without documentation to verify the depth. Cedar's implementation page states 50+ implementations including Epic, athenahealth and Oracle Health EMRs, 20+ unique systems, and a variety of integration methods, and the Kora Platform page describes a modular deployment alongside a provider's EHR, telephony and call center.

An agent that states a current balance and posts a payment has to read and write billing data, but no integration documentation, listing or data flow description shows which fields move in each direction or how fresh they are.

A single hosted service with the location implied. The security page states Cedar runs across multiple Amazon availability zones more than 50 miles apart, can fail over to an alternate region without data loss, tests disaster recovery and backup restores, and uses Cloudflare for DDoS protection. The privacy policy describes Cedar as a United States company. No region, residency commitment or tenant separation is stated, and no subprocessor list names the telephony or speech providers that carry Kora's calls.

There is no published price, but the selling model is laid out. Cedar sells enterprise agreements to health systems and clinician services providers, and Kora is sold modularly: a provider can deploy only the use cases it needs alongside its existing EHR, telephony and call center, without replacing its patient portal. The site's footnote says certain functions may require third party integrations or service specific terms or fees.

Nothing states whether Kora is priced per call, per resolved interaction, per collected dollar or within the payments platform. If any fee scales with collections, it bears on the agent's outbound targeting, since that targeting decides whose balance is pursued.

Named and supported: patient financial engagement for health systems and hospitals and for clinician services providers, across Epic, athenahealth and Oracle Health environments (50+ implementations). The case studies back the specialty spread with named deployments: gastroenterology (Gastro Health), emergency medicine (ApolloMD), anesthesia (U.S. Anesthesia Partners, NAPA), psychiatry (Talkiatry), dermatology and a multispecialty group (Unio Health Partners). No clinical claims are made, which is right for a billing product.