ClinicalKey AI

Artificial intelligence is a feature layer on a product whose value stands without it. ClinicalKey AI answers from Elsevier's copyright cleared clinical knowledge base: point of care content, reference texts such as Braunwald's Heart Disease, Goldman-Cecil Medicine and the Nelson Textbook of Pediatrics, society guidelines from the ACC, AACE, ACEP, CHEST, ESMO and others, and full text from Elsevier and other journals including The Lancet, the New England Journal of Medicine and JAMA. Remove the generative layer and a complete, widely licensed product remains, which is what ClinicalKey was before the AI launched in 2024.

The generative layer is a retrieval augmented system over that corpus: a vector search retrieves documents and one of several large language models composes a summary with citations, plus a reading assistant that summarizes and answers questions inside a source. It is real engineering and it is the marketed center of the product, and the content library is still the asset.

The oversight structure is described and one part is missing. The provenance mechanisms are published as functions: every summary links its citations to the supporting published evidence, real time citation validation checks each data point and assertion against the cited references, references are selected for relevance with guidelines, meta-analyses, Cochrane reviews and large randomized trials prioritized, and a quarterly clinician in the loop evaluation reviews responses before major releases. The clinician controls the context: responses consider age, comorbidities and current medications only when the clinician supplies them.

What is missing is what the system does when it should not answer. Nothing published says what a clinician sees when citation validation fails, when the evidence is thin or conflicting, or when a question falls outside the corpus, and no condition routes a case to a person. The company's own evaluation (JAMIA Open, 2025) found 2 of 426 responses carrying potential clinical harm, which is the case the missing threshold would govern.

The FAQ says citation validation ensures each data point and assertion is checked against cited references; that describes a uniform check, not a promise that every answer is right. No absolute accuracy claim is made.

The approach and the suppliers are named, without versions or an update record. The FAQ describes a retrieval augmented generation system: vector search over Elsevier's content database retrieves semantically similar documents, and a large language model composes them into a summary, with multiple LLMs in use. Elsevier's security and AI page says it selects the most appropriate model for each use case from providers including OpenAI, Anthropic and others, hosted on Microsoft Azure or AWS, and uses smaller models for less intensive tasks. The corpus is enumerated in detail, refreshed daily and described as copyright cleared, and a reference ranking rule is published (relevance first, with guidelines, meta-analyses, Cochrane reviews, expert panels and large randomized trials prioritized). Real time citation validation is described as a step the system performs.

Which model answers a ClinicalKey AI query, at what version, and when that changed are not published, and the multi model approach means the model can differ by task. The 2024 launch was developed with OpenEvidence as a technology partner; the current pages do not say whether that partnership still supplies any part of the product.

Substantial partial disclosure with the terms that govern data once it arrives, and a party list left open. Elsevier's security and AI page names the model providers it uses across its AI products as OpenAI, Anthropic and others, hosted on Microsoft Azure or AWS (Bedrock), and states that its enterprise agreements with AWS, Microsoft Azure, OpenAI and Anthropic include zero retention contracts, so prompts and documents are never used for model development, and that neither Microsoft nor AWS retains content or prompts for training or storage. The ClinicalKey AI FAQ adds that no access is granted to cloud providers or third party AI partners for training purposes.

The list ends with "and others", so not every party is enumerated; the disclosure is company wide rather than a subprocessor list for ClinicalKey AI; and nothing says which providers a ClinicalKey AI query actually reaches. The corpus licensors (society guidelines, journals and reference texts) are named, which is provenance of the content rather than a party receiving the user's data.

Peer reviewed evaluation of the product with the method available to read, run and written by the company. Livingston et al., JAMIA Open 2025;8(3):ooaf054 (doi 10.1093/jamiaopen/ooaf054, open access): a five dimension framework (query comprehension, helpfulness, correctness, completeness, potential clinical harm) applied to ClinicalKey AI. Of 633 queries drawn from user logs, a benchmark dataset and subject matter expert curated questions, 614 (96.99 percent) produced evaluable responses, and 41 board certified physicians and pharmacists, recruited and paid as external contractors, evaluated 426 query and response pairs. Correctness was 95.5 percent, comprehension 98.6 percent and helpfulness 94.4 percent; 2 responses (0.47 percent) scored as potential clinical harm. Pairwise raters agreed in 60.6 percent of evaluations, with the rest resolved by a third reviewer, and the authors name subjective scoring of open ended answers and consensus on harm as the method's weak points.

All seven authors are current or former Elsevier employees, and no independent replication is published. The design is a retrospective test set rated by experts, not a study of clinical outcomes, and the harm dimension matters as much as the headline correctness rate.

Adoption is described through customer quotes on the product page (St. Elizabeth Healthcare, AZ Delta, Aspen Valley Health) and is not evidence of benefit.

Categorical commitments are published and specific enough to hold the company to, without a retention schedule for Elsevier's own copy. Elsevier's security and AI page states that its enterprise agreements with AWS, Microsoft Azure, OpenAI and Anthropic include zero retention contracts, so prompts and documents are never used for large language model development; that neither Microsoft nor AWS retains Elsevier content or customer prompts for training or storage; that Elsevier does not use customer data in its private cloud environments for model development; and that aggregated, anonymized insights are used to improve the service. The ClinicalKey AI FAQ adds that all user data is encrypted in transit and at rest, that access is limited to authorized personnel under pseudonymization for product support only, and that no access is granted to cloud providers or third party AI partners for training. Users can save, search, share or remove past queries in a privacy panel.

What is not stated is how long Elsevier itself keeps queries and query history, and the product now invites patient detail: responses can be tailored to age, comorbidities and current medications when the clinician includes them, so what a query may contain matters.

No safety engineering is published beyond citation validation: no guardrails policy, no process for handling a safety event, and the FAQ describes the architecture as helping to minimize hallucinations rather than stating what happens when one occurs.

Compliance is claimed and nothing underneath it can be inspected. The product page says ClinicalKey AI is built to be HIPAA compliant, with a footnote that HIPAA compliance is applicable where recognized by country regulators, and the FAQ repeats the claim alongside encryption and pseudonymized access. Elsevier's security and AI page says personal data is treated under applicable privacy laws such as GDPR and CCPA.

No business associate status, business associate agreement, tier or execution path is published, and no statement says whether the product is meant to receive protected health information. It now invites patient detail: responses can be tailored to age, comorbidities and current medications when the clinician includes them, which makes the unanswered question more pointed.

A recognized certification is named in the company's own material without the artifact. Elsevier's security and compliance page states that Elsevier maintains compliance with leading security frameworks, holds certifications such as ISO 27001, and undergoes regular audits and independent assessments; ClinicalKey AI is an Elsevier product and that page is the product's own security surface. The ClinicalKey AI FAQ describes the controls: encryption in transit and at rest, pseudonymized access limited to authorized support personnel, security vetting and assessments, and continuous vulnerability scanning.

No certificate, scope statement, certification body or date is published, so whether the ISO 27001 scope covers ClinicalKey AI's environment is the buyer's question, and no SOC 2 report or trust center is published for the product.

No device claim is made and no regulatory position is published, beside a product marketed closer to the patient than a reference. The product page calls ClinicalKey AI an EHR and API enabled clinical decision support tool, says responses can be tailored to a patient's age, comorbidities and current medications when prompted, and quotes a customer saying it can help clinicians explore and develop a differential diagnosis. No clearance, submission or analysis of device status in the United States, the European Union or elsewhere is published.

The basis of each answer is reviewable: citations link to the supporting published evidence and a validation step checks assertions against them, which is what the clinical decision support exclusion in the 21st Century Cures Act turns on. Even so, a product sold for differential diagnosis and patient tailored answers publishes no position on where it sits.

A governance framework with named process behind it, and no bias results. The product is developed under Elsevier's five responsible AI principles, which commit to considering real world impact on people, acting to prevent the creation or reinforcement of unfair bias, being able to explain how solutions work, accountability through human oversight, and privacy and data governance. The FAQ describes a clinician in the loop evaluation run quarterly and before major releases, in which licensed clinicians across major specialties review responses for accuracy and bias, and says Elsevier aligns to guidance from the Coalition for Health AI (CHAI) and CHIME and has contributed to CHAI's testing and evaluation guidelines as a member.

The company published its evaluation method and results for this product in JAMIA Open (2025), with potential clinical harm as a scored dimension, which is material a customer's own review committee can work with.

What is not published is the bias half: no bias result, no subgroup analysis, and no breakdown of the evaluation by specialty, population or question type, although the stated quarterly review assesses bias.

A published error rate with its method and denominator, in the company's own peer reviewed paper. Livingston, Featherstone-Uwague, Barry, Barretto, Morey, Herrmannova and Avula, all of Elsevier Health Markets, JAMIA Open 2025;8(3):ooaf054 (doi 10.1093/jamiaopen/ooaf054): 633 queries drawn from user logs, a benchmark dataset and expert curated questions, 614 of which produced evaluable responses; 41 board certified physicians and pharmacists, paid external contractors, scored 426 query and response pairs on comprehension, helpfulness, correctness, completeness and potential clinical harm, with disagreements resolved by a mode and modified Delphi protocol. Responses were rated correct in 95.5 percent of the 426, and 2 of 426 (0.47 percent) received scores indicating potential clinical harm. The company authored the paper and links its evaluation framework from the product page. The figures are a test set result, not performance in use.

The mechanisms behind each answer are described as functions: citations link to the supporting published evidence, and real time citation validation checks each data point and assertion in a response against the cited references. What the validation step does when a check fails (suppress, flag or deliver) is not stated. The Elsevier website terms govern the site; no warranty, indemnity or correction commitment attaching to an answer is published.

Standards support with named deployments behind it, and no marketplace credential. The product page states SMART on FHIR single sign on for access inside the EHR, an API so the product can be integrated into tools beyond the EHR, and link resolver support connecting to an institution's own full text holdings. Named customers are quoted on the product page (St. Elizabeth Healthcare's chief medical information officer, AZ Delta, Aspen Valley Health), and Elsevier received a 2025 Healthiverse Heroes technology partner award for DrFirst medication management used through ClinicalKey AI, which names a connected system.

No EHR vendor marketplace listing, conformance statement or published integration effort is shown, and the pages do not say which record system each named customer runs it in. SMART on FHIR is a launch and sign on standard; nothing published describes the product reading or writing record data.

Options and residency are stated, with the processing path for a given customer left open. Elsevier's security and AI page states that all Elsevier AI services, including product environments, are hosted in AWS or Microsoft Azure data centers, that services may be hosted in Europe or the United States based on application and regulatory requirements, that model calls run through providers including OpenAI and Anthropic under zero retention contracts, and that data is encrypted at rest and in transit. The product is delivered on the web, as a mobile app with voice dictation, inside the EHR through SMART on FHIR single sign on, and through an API, and the HIPAA footnote on the product page (applicable where recognized by country regulators) reflects sale outside the United States.

What is not published for ClinicalKey AI specifically: which region serves which customer, which model provider processes a given query, tenant isolation, and any deployment inside a customer's own environment.

No price is published and the sales posture is discoverable. Clinicians and residents can try the product free for 90 days, medical students in the United States and Canada get one year of full access free, and institutions are directed to request institutional access or speak with an Elsevier sales representative.

No subscription price, tier structure, per clinician rate, institutional pricing basis or implementation fee is published, and nothing says whether the AI layer is included in an existing ClinicalKey content license or priced as an add on. A clinician can try the product without contact, and cannot establish what it costs after the trial without entering a sales process.

Coverage is named, with validation behind part of it. The corpus spans cardiology, internal medicine and pediatrics reference texts, society guidelines covering cardiology, endocrinology, emergency medicine, chest medicine and oncology, drug information, and full text journals, and responses can take a patient's age, comorbidities and medications into account when the clinician supplies them. Continuing education and maintenance of certification credit accrue from use, and customers quoted on the product page include a US community health system, a Belgian hospital and a rural US health system.

The company's evaluation (JAMIA Open, 2025) drew 633 queries from user logs, a benchmark dataset and expert curated questions and reports aggregate results only, with no breakdown by specialty or setting, so breadth of availability is established and breadth of demonstrated performance is not.