CodaMetrix

The model is the product, and the company's origin makes that unusually clear. The platform began as coding AI built inside Mass General Brigham in 2016 to solve that system's own problem, and was spun out in 2019 because the technology proved useful beyond it.

What is sold is autonomous code assignment from clinical documentation using machine learning, deep learning and language processing; the modules around it (touchless coding, coder feedback into the model, and reporting on automation performance) exist to run and measure that coder. There is no coding services bureau or offshore workforce underneath it, and remove the model and nothing is left to sell.

Autonomous by design, with a review path described and the threshold missing. CMX Automate codes and bills cases touchlessly, with no human intervention; the cases it does not code go to coders in their native record system environment, with human review retained where needed, and CMX Amplify feeds every coder reviewed decision back into the platform while CMX Insights reports automation performance in real time. Coding is an administrative determination reviewable after the fact, and the company reports a 70 percent reduction in manual coding.

What is not published is the confidence threshold at which a case routes to a coder, which decides how many codes reach a payer without a person seeing them. The home page's tagline, "The right encounter. The right code. The right bill.", sits beside a published 98 percent average accuracy, which on the company's own figure leaves an average of 2 percent of codes wrong.

The approach is named at a general level and nothing is identified. The company describes contextual coding automation built on machine learning, deep learning and language processing over a longitudinal, patient centered view of care, originally developed inside Mass General Brigham, with modules for touchless coding (CMX Automate), coder feedback (CMX Amplify) and performance reporting (CMX Insights), and a platform that learns continuously from coders' decisions across health systems. The health systems page publishes 98 percent average coding accuracy, and the home page says accuracy is validated through Rosetta, the company's coding quality framework.

Nothing is published on which models run, what data trains them, accuracy by specialty with its method and denominator, or a version practice that tells a customer when continuous learning has changed the model coding its claims. Continuous real time learning makes that last gap sharper, since the model can change between one billing run and the next.

The architecture is described and no party in the chain is named. CMX CARE ingests clinical notes (including ambient documentation), registration events, surgical schedules, orders, charges and provider information from the record and ancillary systems, builds a longitudinal view of each patient's care, and codes from it with the company's own machine learning, deep learning and language processing models. The solution page says the platform learns continuously from coding decisions made by the customer's team and by the coding teams of other health systems, so one customer's coding shapes the model another customer receives.

No hosting provider, model provider or subprocessor is named on the home, health systems, solution or resources pages, and whether the language components run on the company's own models or a licensed one is not stated. If the whole stack is built and run in house, the chain is short and a list would show it.

Adoption at academic medical centers is the strongest signal here. Named deployments include Mass General Brigham, Yale Medicine, University of Colorado Medicine, and Henry Ford Health, with reported scale of more than 25 provider organizations covering over 200 hospitals and 50,000 providers. KLAS Research ranked it number one in the Reduce Cost of Care category, which reflects direct customer feedback rather than vendor assertion.

Reported outcomes of roughly 70 percent manual labor reduction and 59 percent fewer coding related denials are vendor stated and unaudited. Several named academic customers are also investors through their physician organizations, which signals alignment and is also a caveat on independence.

A training use is stated plainly, and the retention schedule behind it is not. The solution page says the platform continuously learns, in real time, from coding decisions made by the customer's team and by the coding teams of top performing health systems, and the company's security material says it analyzes denials information shared by customers to improve its models. That is a categorical statement about training use, specific enough to be held to. It also means learning pools across customers: one health system's coders' decisions improve a model other systems use, and theirs shape its own. Named controls sit beside it: encryption in motion and at rest, a full audit trail, role based access and least privilege.

No retention period is published for documentation or derived artifacts, no de identification step is described before model improvement, nothing says whether the training use can be declined, and nothing covers what happens to accumulated data at termination. Contextual coding reads the longitudinal record, a wider exposure than a note level tool. No safety engineering is published beyond coder review of routed cases.

The company states a position, and it is more specific than a compliance assertion.

Technical and procedural safeguards are described as implemented for HIPAA, and named individually elsewhere in its security material as encryption in motion and at rest, a full audit trail, role based access and a least privilege model. Naming the safeguards rather than asserting compliance means each one can be tested.

The role is unambiguous. The health system is the covered entity. This platform reads clinical documentation and produces codes on its behalf, which makes it a business associate with direct liability under the rule.

The audit trail is more than generic security hygiene here. Where an automated system assigns a billing code from the record, the ability to reconstruct which documentation produced which code is simultaneously a privacy control, a compliance artifact and the customer's defense if a claim is later challenged. It is the right control to have built and it is stated.

The instrument itself is not published: no business associate agreement text, provider facing addendum, subcontractor flow down, breach notification timetable or review cadence.

Recognized certifications are named as the company's own, and no artifact can be opened. The home page carries a SOC compliance badge, and the company's security material, published through a healthcare marketplace profile it authored, names ISO 27001 certification and a SOC 2 Type 2 report, with controls listed individually: encryption in motion and at rest, a full audit trail, a documented information security management system, third party penetration testing, static and dynamic code vulnerability scanning, role based access and least privilege. Naming code scanning describes how the software is built as well as how data is protected once it exists.

No trust center or report that can be opened without asking appears on the home, health systems, solution or resources pages, and the SOC 2 period and the ISO certificate's scope and issuing body are not named. Epic Toolbox approval is a review by the record vendor against its integration practices, not a security attestation.

No device claim is made, and the product is scoped as administrative. CMX CARE assigns diagnosis and procedure codes and bills encounters from the documentation clinicians wrote, identifying documentation gaps and missing charges for the revenue cycle; it does not recommend a treatment or diagnose a patient, and the codes trace back to the documentation that produced them.

The rules that govern this work are payer billing and coding compliance rules, and the exposure is specific: liability for an incorrect code submitted to a federal payer sits with the billing organization under the False Claims Act, not with the software supplier. The company's quality framework, Rosetta, and its council address coding defensibility, and the platform's audit trail is the artifact a customer would use to defend a claim later. Answering to those rules is not a regulatory pathway.

A coding quality framework with a named body behind it, and nothing on drift or performance by group. The home page describes Rosetta, the company's coding quality framework, as a standardized approach to coding accuracy, consistency and defensibility across real world health systems, reviewed against practice and performance by a Coding Quality Council of industry experts; the company's June 2026 announcement convened that council with health system leaders, reported as five health systems. That is governance with a named process behind it.

No results are compared across specialties, payers or patient groups, and no monitoring for coding intensity drift is described. The platform learns from customers' coding decisions and from denials, so it learns what was accepted, which usually matches what the documentation supports and diverges exactly where an auditor would look; drift toward payer acceptance can suppress legitimate coding as easily as it can inflate it, and neither direction is visible without monitoring built to find it.

Mechanisms exist to check and correct a code, and nothing stands behind the output. Cases the platform does not code touchlessly go to coders in their native record system environment, with human review retained where needed; coder reviewed decisions feed back into the platform; the company's security material names a full audit trail, which lets a customer reconstruct which documentation produced which code; and the company measures quality against Rosetta, its coding quality framework, reviewed by a council of health system leaders.

The health systems page publishes 98 percent average coding accuracy, with no denominator, specialty split or period, so it cannot be tested as an error rate. No warranty, indemnity, accuracy commitment or remediation obligation appears on the home, health systems, solution or resources pages, and the 5x return over five years is a projection, not a fee at risk. A code submitted to a federal payer that should not have been leaves the billing organization carrying the exposure.

Integration with the dominant record system is approved by its vendor, and breadth beyond it is undocumented. The home page says the CMX CARE platform is Epic Toolbox approved, built to Epic's recommended integration standards and workflows with coders remaining in their native environment, and that it ingests clinical notes (including ambient documentation), registration events, surgical schedules, orders, charges and provider information from the record and ancillary systems, returning codes and bills into the revenue cycle. Toolbox approval is a designation granted by the record vendor, not a self description.

No connector list or interface documentation for other record systems appears on the home, health systems, solution or resources pages, and no named customer is tied to a specific integration, so evidence that the approved connection runs in production at a named site is not published.

Delivered as a software as a service platform, and nothing published states where it runs.

There is no published hosting provider, region, tenancy model, subprocessor list, backup or recovery posture, or data residency commitment.

The reason this matters more than for a typical software purchase is what the platform consumes. Contextual coding requires reading the longitudinal patient record rather than a single document, so the question is not whether a note is transmitted but whether a substantial slice of the clinical record leaves the institution and where it comes to rest. Nothing published answers it.

The integration architecture is well evidenced even though the hosting is not. Epic Toolbox approval and the ingestion of notes, orders, charges and schedules from the record and ancillary systems mean the data path into the platform is understood. What is missing is the other half: where inference runs once the data arrives, whether customer environments are logically or physically separated, and what is retained.

The company says the platform learns continuously from coding decisions made by the customer's team and by other health systems' coding teams, so model improvement crosses customer boundaries in some form. Whether what crosses is aggregated, de identified or pooled is a deployment architecture question as much as a privacy one.

No pricing is published. The value framing is unusually concrete for modeling purposes, since coding is the most expensive component of the revenue cycle and the company cites published estimates that 20 to 25 percent of US healthcare spending goes to administrative and revenue cycle tasks, giving a buyer a baseline to compare against current coding cost per chart. The commercially important unknown is whether pricing is per chart, per provider, or subscription, which determines whether savings scale with automation rate or are captured by the vendor.

Coverage is named across specialties and settings, with validation behind part of it. CMX CARE codes facility and professional fee encounters across radiology, pathology, surgery and endoscopy, specialty services and inpatient care, drawing on notes (including ambient documentation), registration events, surgical schedules, orders and charges across the enterprise. Named customers include University of Colorado Medicine, Oregon Health and Science University (turnaround of 4.82 days against 43.6), UMass Memorial Health, where radiology success led to expansion into other specialties, and WVU Medicine; the home page reports more encounters captured across radiology, pathology and endoscopy.

The published results attach to diagnostic and procedural coding, while inpatient professional fee coding, which the home page now leads with, carries no published result on the home, health systems, solution or resources pages, and facility coding is described rather than evidenced. The market is United States health systems, from academic centers to smaller organizations.