ClinicalKey AI

The same structural position as the other two reference incumbents, with one addition that sharpens it. The asset is a proprietary content library built over decades: reference texts, society guidelines, journals and point of care monographs. Remove the generative layer and a complete, widely licensed product remains, which is what ClinicalKey was before February 2024.

The addition is that the generative capability itself was developed in partnership with OpenEvidence rather than built alone. The company states this openly and has repeated it in later announcements, so it is disclosure rather than discovery. But it means the model layer of this product is not straightforwardly the vendor's own capability, and OpenEvidence has since become a large, directly competing product in the same category. Supplier concentration and continuity are ordinary procurement questions and they apply here in an unusual shape.

The grade describes the mechanism, not the quality. Graded identically to UpToDate and DynaMed for the same reason, and the note says so plainly so the record does not read as an attack on a strong product.

The best provenance architecture in this category, resting on three named mechanisms rather than on a posture.

Traceability is at paragraph level. A generated answer links to the specific passage in the source it was drawn from, not merely to the document. Every other vendor in this segment cites at document level, which leaves a clinician to find the relevant sentence themselves, and that friction is exactly where spot checking stops in practice.

A real time citation validation step checks that a generated response is confirmed to be grounded in the evidence cited. That is an automated guard on the grounding claim rather than a UI affordance, and nothing else graded here describes one.

And the clinician toggles explicitly between adult and paediatric context. This index has been asking since the UpToDate build whether a generative clinical product states what it assumed about the patient. This is a different and in some ways better answer: rather than declaring an assumption after the fact, it makes the population an explicit setting the clinician controls before the answer is generated. A query history privacy panel gives the clinician control over their own retained queries.

Held short of perfect only by silence on abstention. Nothing published states what the product does when the evidence is thin, absent or in conflict, and the citation validation step is described but its behaviour on failure is not. Ask what a clinician sees when validation does not pass.

The corpus is enumerated in more detail than anywhere else in this category. Named reference texts, named society guideline sources, named journals, government publications and proprietary point of care content, with a stated daily refresh and an explicit claim that the knowledge base is copyright cleared. That last point is unusual and worth noting: a publisher indexing its own and licensed content can make a provenance claim that a broad web scraper cannot.

Mechanism is named at two levels: the technology partner is disclosed, and the citation validation and paragraph traceability steps are described as functions rather than as adjectives.

Below that it stops. No model class or provider is named, no retrieval architecture is described in detail, and the behaviour of the validation step is not specified. One dated change is recorded on the vendor record rather than treated as a contradiction: material from 2025 described third party journals as abstracts, while the February 2026 release describes full text for more than 130 premium journals. A buyer evaluating on older material should confirm which depth applies to the journals they care about.

The most structured evaluation any vendor in this category has published about its own generative product, and it fills the gap this index has repeatedly recorded elsewhere.

The company built a clinician centred evaluation framework assessing generated responses on five named dimensions: query comprehension, response helpfulness, correctness, completeness, and potential for clinical harm. Including a harm dimension at all is rare. It then ran the framework on this product with a panel of 41 board certified physicians and clinical pharmacists across 426 query and response pairs, and published the results: 94.4 percent of responses rated helpful, 95.5 percent assessed completely correct, and 0.47 percent flagged for potential improvement. The framework itself was stated in June 2025 to be headed for the open access Journal of the American Medical Informatics Association.

Two things hold it at B rather than A. The evaluation was designed, commissioned and reported by the vendor, and the reviewing panel was assembled by the vendor, so it is a structured self assessment rather than an independent one. And the publication status of the framework paper was not confirmed this pass, so verify it on refresh; if it has appeared peer reviewed, this axis should be revisited.

The placement is the useful part. This sits clearly above UpToDate and DynaMed, which publish an evaluation framework or a set of principles and no results at all, and clearly below OpenEvidence, whose product has been assessed in eleven independent evaluations including a systematic review the vendor did not run. Publishing your own results is a real step. Submitting to someone else's is the next one.

The architecture carries no patient data by necessity, since the model reads a curated content library rather than a chart, which is the strongest of the three structural answers to this question that the index tracks.

The published commitments go beyond that and several are specific enough to hold a vendor to. User data is encrypted in transit and at rest. Personnel access is limited to authorised staff under pseudonymisation and for product support only. Access is stated not to be granted to cloud providers or to third party artificial intelligence partners for training purposes, which is a precise commitment and a pointed one given that the generative layer was built with an outside partner. A query history privacy panel gives the clinician direct control over their own retained queries, which no other vendor in this category offers.

Held at B on the absences. No retention period, no data residency statement and no subprocessor list were located, and the corporate privacy and terms documents were not opened this pass. Recorded explicitly rather than left implicit.

A consistent assertion with an unusually honest qualifier attached, and nothing underneath it.

The product is described as built to be HIPAA compliant, with privacy and security controls intended to protect protected health information. The qualifier is the part worth crediting: the company states that HIPAA compliance is applicable where recognised by country regulators. For a product sold in more than 50 countries that is a real limitation to publish, and it is the kind of negative scope statement this index asks for and rarely gets.

Beyond the assertion there is nothing a counterparty can inspect. No business associate agreement was located, no terms, no covered entity or business associate language, no execution path and no tier at which an agreement becomes available. The corporate privacy and terms documents were not opened this pass and are places such a statement could sit, so this is graded on what a buyer can find rather than as a finding that no agreement exists.

The segment contrast is the same one recorded against DynaMed. Vera Health, a fraction of the size, publishes its business associate agreement in full at a public address.

This is the Curbside Health shape and it belongs at the top of the grade rather than the bottom. The controls are described in more operational detail than most vendors manage: encryption in transit and at rest under industry standard protocols, authorised personnel access under pseudonymisation limited to product support, an explicit exclusion of cloud providers and third party artificial intelligence partners from any training access, security vetting and assessments, and continuous vulnerability scanning.

What is missing is anything a third party has verified. Two retrieval passes located no SOC 2 report of either type, no ISO 27001, no HITRUST certification and no trust centre for this product. Description and attestation are different goods, and this index grades on what a counterparty can check.

Recorded as a retrieval outcome rather than a finding that controls are absent. A division of a large listed information services group selling into hospitals in more than 50 countries will hold attestations; the question is why they are not published against this product. Ask for the SOC 2 report and its type, and flag this axis for refresh.

No clearance, no submission and no published device positioning statement were located.

The argument for sitting outside device regulation is stronger for this product than for most of the category, and it rests on the architecture rather than on assertion. The clinical decision support exclusion turns on whether a clinician can independently review the basis of what the software presents. Paragraph level traceability into a named, copyright cleared corpus, combined with an automated check that a response is grounded in the evidence it cites, is close to the strongest available answer to that test.

Graded C because the vendor publishes no analysis of where it sits, in any jurisdiction. That matters more here than for a United States only product: this one is sold in more than 50 countries, and the company already acknowledges elsewhere that its compliance claims vary by national regulator. Ask specifically how the product is classified in the European Union, where the artificial intelligence regime is the live question for this whole category.

This axis has two halves and this vendor is strong on one and silent on the other, which is exactly what the grade should say.

On governance the position is the best in the category so far. Five responsible artificial intelligence principles are published, including explicit commitments to consider real world impact on people, to take action to prevent the creation or reinforcement of unfair bias, and to be able to explain how the solutions work. A named evaluation function exists inside the company with a director level owner. Most importantly, the company built an evaluation framework and then published its results, which is precisely what UpToDate and EBSCO Clinical Decisions each declined to do after publishing a framework or a set of principles. The framework was designed with clinical subject matter experts across multiple specialties and includes potential for clinical harm as a scored dimension.

On bias disclosure there is nothing. The company states that its evaluation process assesses the tool for accuracy and bias, and no bias result has been published: no subgroup analysis, no breakdown by specialty, population or question type, and no error taxonomy. A vendor that has already demonstrated it will publish evaluation results is unusually well placed to publish the bias half, and that is the specific thing to ask for.

Integration is real and stated on the vendor's own material rather than on directories. Single sign on into the electronic health record uses the Smart on Fhir standard, and the product is application programming interface enabled so it can be embedded in systems beyond the record, with stated compatibility with workflow tools. Access also runs through web and a mobile application with voice dictation.

Held at B rather than A on the one thing DynaMed has and this does not. No marketplace listing was located on any electronic health record vendor's own storefront, and a marketplace credential is issued by the record vendor rather than asserted by the supplier, which is why this index weights it heavily. No conformance statement, no published integration effort and no named live customer integration were located either.

The direction of travel is right. The February 2026 release led with application programming interface based integration options as a headline improvement, which suggests the company knows this is the gap.

Delivered as a hosted service with web, mobile and record embedded access, and available in more than 50 countries with multi language support.

That geographic position is worth reading against the rest of the category, because it is the outlier. One vendor here withdrew from the European Union and United Kingdom entirely rather than meet emerging artificial intelligence requirements, one bounds its generative layer to two North American markets, and one geofences its generative layer out of the European Union while continuing to sell the reference product there. This vendor has gone the other way and expanded. Whether that reflects a different legal analysis, a different risk appetite or a different classification of the product is not published, and it is worth asking, because the four vendors are selling substantially the same thing into the same regulatory environment and have reached four different answers.

Held at B on the absences that apply to almost every vendor in this category: no hosting provider named, no cloud region, no data residency statement and no alternative deployment model for an institution that requires data to stay inside its own environment. The company does state that cloud providers are not granted access for training purposes, which implies third party hosting without naming it.

One published price point exists and it is a giveaway rather than a rate: medical students receive one year free. Nothing else is published.

No tier structure, no per clinician rate, no institutional pricing mechanism, no add on price for the artificial intelligence layer over a base content subscription, and no implementation fee schedule were located. There is no public webstore or self serve purchase route for a practising clinician, which distinguishes this from both of the other reference incumbents: UpToDate sells personal and trainee subscriptions through a public store, and DynaMed sells individual subscriptions direct with a free trial.

That makes this the least commercially transparent of the three incumbents in the category, and the gap is not marginal. A clinician cannot establish what the product costs without entering a sales process, and an institution cannot establish whether the artificial intelligence layer is included in an existing content licence or priced separately.

Breadth is genuine and the corpus composition supports it rather than merely asserting it: reference texts spanning cardiology, internal medicine and paediatrics, society guidelines from bodies covering cardiology, endocrinology, emergency medicine, chest medicine and oncology, and more than 130 premium journals in full text. Availability spans more than 50 countries with multi language support, and continuing education and maintenance of certification credit accrue from ordinary use, which is now the fourth instance of that model in this category.

One feature deserves specific credit on this axis rather than being buried under oversight. The clinician can toggle explicitly between adult and paediatric context. Paediatric coverage is where general purpose clinical reference tools most often fail quietly, because an answer correct for an adult can be wrong and occasionally dangerous for a child, and making the population an explicit control rather than an inference is a real design decision.

Held at B because no performance evidence is published for any individual specialty or setting. The 426 pair evaluation covered a diverse set of clinical queries and reported aggregate figures only, with no breakdown by specialty, so breadth of availability is established while breadth of demonstrated usefulness is not.