CertifyOS

A learned component sits inside the product rather than at its center. The platform page says AI resolves duplicates, maps taxonomies and standardizes addresses, and describes AI powered roster intake; the home page calls the verification step an intelligence layer.

What customers pay for is the connection to more than 600 primary sources, NCQA certified verification, continuous monitoring and the API that delivers one provider record into other systems, and most of that would remain with the models removed. The company names no model and publishes no evaluation of these components, so how much of the cleansing is learned rather than rule based is unclear.

The structure is described and the threshold is missing. Verification runs largely unattended: the company says more than 90 percent of verification elements complete without manual intervention and that monitoring against OIG, SAM.gov, state Medicaid and license sources runs continuously, alerting the customer when something changes.

The credentialing decision itself stays with the customer: the company holds NCQA verification certification, and its own material places committee approval of providers with the health plan or health system. What is not published is where automation stops: which verification or matching results go to a person before a status changes or an event such as provider terminated is sent to customer systems, and what happens after a wrong determination. The home page line that the intelligence layer validates every record describes coverage of the process, not a claim that the result is correct.

Transparent as software, opaque as AI. The company describes its integration surface in detail, with versioned endpoints, a webhooks endpoint and named event types such as credentialing completed and provider terminated, and says the API is documented for developers. Of the models it says only what they do: resolve duplicates, map taxonomies, standardize addresses and read rosters. No model type, version, update practice or accuracy measure is published, and the 90 percent data accuracy figure on the platform page has no method or scope.

Each stage of the pipeline is laid out, and no model provider is named. The platform page sets out ingestion from rosters, primary sources, medical records and claims, verification, an AI cleansing step that resolves duplicates, maps taxonomies and standardizes addresses, and delivery by API, webhooks and export. It does not say whether those models are built in house or supplied, and no hosting provider or subprocessor list is published.

The parties the company does name are peripheral: Google Analytics on the website under the site privacy policy, Virtru for encrypting data sent in answer to a subject access request, and CAQH and other primary sources as data inputs.

Named customers and vendor reported percentages with no method, denominator, baseline or period. The home page claims 75 percent lower re-credentialing costs, 50 percent fewer roster mismatches and ten times faster onboarding; the platform page claims 80 percent shorter credentialing times, a 19 percent rise in provider satisfaction scores, 50 percent faster onboarding and 90 percent data accuracy; a 2026 post says more than 90 percent of verification elements complete without manual intervention.

None names the customer, volume or measurement behind it. Named customers are Alma and OncoHealth, both quoted on general partnership value, and the company says eight of the ten publicly listed US health plans are clients, which is scale of use rather than evidence of benefit. NCQA certification tests conformance of the verification process, not these figures.

General assurances only. The company's security posts describe encryption, monitoring and documented policies, and its 2023 post frames its data as providers' personal information rather than patient data. Nothing says how long primary source verification files and supporting documents are kept, whether provider data is used to train or improve the matching and cleansing models, or whether anything is deidentified.

The one retention clause published (information kept until you ask for deletion) belongs to the website privacy policy and covers site visitors, not platform data. The data is sensitive whatever regime governs it, and the platform also lists medical records and claims among its inputs.

A status is stated and nothing supports it. The company's own July 2023 post says it is unique among digital healthcare solutions in that "we don't work directly with PHI - because we don't work directly with patients". The platform page lists what it takes in as "Real time APIs or batch uploads from rosters, 600+ primary sources, EMRs, claims, and more."

Claims feeds and record extracts normally carry patient identifiers even when used only to derive provider data, and nothing in its published material says whether these feeds are stripped to provider fields, deidentified before they arrive, or covered by a business associate agreement. That is tension rather than contradiction, but it leaves the patient data question open.

No service privacy document stands behind the statement either: the privacy policy covers visits to the website only (device and browsing data, Google Analytics), and the terms, which do reach the platform, carry only a short subject access clause. No business associate status, HIPAA claim or agreement appears on the home or platform pages.

The company presents a SOC 2 Type 2 report as its own, with a period and scope: its blog states Type 1 in July 2023 and Type 2 covering 1 March 2023 to 28 February 2024, scoped to its credentialing software service. It also holds NCQA Credentials Verification Organization certification, whose standards include protecting credentialing information. No later SOC 2 period is published, so whether the report is current is not shown.

The auditor is not named, and the scope covered credentialing, not the licensing, monitoring and roster products since added. No trust center is linked from the site, and no HITRUST or ISO 27001 is claimed.

No FDA position is stated, and the product does not diagnose, treat or inform treatment: it verifies clinicians' credentials and maintains provider data. The regime that governs the work is credentialing regulation, and the company holds the credential that matters there.

It states NCQA Credentials Verification Organization certification across all 11 verification elements (repeated in April 2026 posts), first announced in 2022 as accreditation running through June 2024; the platform page describes NCQA and Medicaid primary source verification and directory outputs meant to meet CMS and No Surprises Act requirements. That is conformance to a standard, not a regulatory pathway.

Nothing is published on how the models are governed or tested. The home and platform pages describe an intelligence layer that validates records, resolves duplicates, maps taxonomies and standardizes addresses, and the platform page gives a 90 percent data accuracy figure, but there is no responsible AI statement, no evaluation method, no error taxonomy and no subgroup result on those pages, in the privacy policy or terms, or in the company's posts on its API, CAQH, SOC 2 and NCQA certification.

The exposure is specific to this work. Duplicate resolution and sanctions or exclusion screening are name matching, and matching errors are not evenly spread: false matches tend to cluster on common surnames, transliterated names and compound surnames. A false match delays a clinician's credentialing and income; a missed match lets an excluded practitioner through.

Mechanisms exist that let a customer check an output, and nothing stands behind it. The platform page describes audit logs, the NCQA standards post describes timestamped logs for every verification, exclusion check and monitoring event, and the API returns a signed link to each provider's primary source verification file, so a determination can be traced to its source.

The published terms, which reach the site, services and platform, provide the site as is without warranty, put indemnity on the user, and give individuals a subject access request answered within 14 days; that is a route to see data, not a bound remedy when a verification is wrong. There is no accuracy commitment, remediation obligation or error rate with method and denominator. The harm lands on a clinician: a false duplicate match or an erroneous provider terminated event reaches every subscribed system before anyone notices.

The integration surface is published as an API rather than as named record system connections. The company describes versioned REST endpoints, including one that pulls a provider's CAQH ProView data and one that returns a signed link to the provider's primary source verification file, and a webhooks endpoint that pushes events such as credentialing completed and provider terminated into customer systems.

Its CAQH guide describes automatic rostering into CAQH, so CAQH is a named system read from and written to. The platform page says data can be ingested from rosters, more than 600 primary sources, electronic medical records and claims, and delivered by API, webhooks and bulk export to directories, claims and analytics systems. No clinical record system is named on the home or platform pages or in the API and CAQH material, and no production connection to one is shown. CAQH is a provider data network, not a record system.

The delivery model is described: a hosted provider data platform reached through one API and dashboard, with rosters and feeds arriving by API or secure file exchange and verified data leaving by API, webhooks and bulk export. Nothing says where it runs or where the data rests. No cloud or hosting provider, region, residency commitment, tenant isolation or processing path is named on the home or platform pages, and the privacy policy and terms say nothing about hosting.

The data concentrated here is sensitive whatever regime governs it: license and DEA registration numbers, education and malpractice history, sanctions results, and in many credentialing workflows social security numbers, held as one record serving many payers and health systems.

No price is published. The company sells a platform with configurable products on top (credentialing, licensing, monitoring, roster management and SharedCred) through a demo, and quantifies return in percentages, 75 percent lower re-credentialing costs on the home page, with no rates. Nor is a unit of charge stated, whether per credentialing event, per provider under monitoring, per API call or a platform subscription. One time verification and continuous monitoring cost very differently at scale, and API integration effort sits with the customer.

Broad across the provider data lifecycle rather than a single workflow, spanning credentialing, licensing, payer enrollment, roster reconciliation, sanctions and exclusions monitoring, and network adequacy, sold to payers, provider groups, health systems, and digital health companies. Specialty agnostic by design, with the company noting five core data entry points serve any provider type or specialty. Coverage is administrative rather than clinical, so it does not extend into care delivery.