Codoxo

Codoxo uses learned analysis to find suspicious payment patterns and generative AI to interpret the records behind a claim. Fraud Scope combines anomaly detection, rules and claims analytics to prioritize investigations, while ClaimPilot handles medical record review, contract interpretation and payment concept development. Those capabilities supply the central value of the Unified Cost Containment Platform.

Audit queues, provider outreach and case management organize the resulting work, and optional professional services can carry out reviews. Removing the models would leave those administrative tools but would remove the automated discovery and interpretation that distinguish the current software offer.

Clinical ClaimPilot places summaries, supporting records and potential payment adjustments in an auditor's workflow. Reviewers can inspect original documents, record findings and choose whether remaining charges should be approved or denied. These are concrete human review controls. The broader platform also promises to avoid denials, appeals and resubmissions entirely by improving claims before submission, creating an absolute expectation about downstream claim outcomes.

That expectation is stronger than the review process can substantiate. Published workflow detail does not specify confidence thresholds, mandatory escalation conditions or recovery procedures for a mistaken recommendation across the full product suite.

Forensic AI is the proprietary engine behind pattern detection and risk prioritization. Its approach combines learned anomalies in claims and provider behavior with rules, analytics and evidence chains. Fraud Scope adds natural language querying, while ClaimPilot uses generative AI to summarize records and propose review findings. A demonstration describes adaptation to reviewer choices, such as excluding irrelevant charge types from later audits.

This explains more than a generic AI label, but model versions, training cohort characteristics, benchmark definitions and release controls remain unspecified. The generative model family and the relationship between product updates and model changes are also unclear.

Codoxo identifies its own Forensic AI engine and AWS as the hosting environment. The current suite also includes generative models for record interpretation, contract work and natural language queries. Their providers and processing boundaries are not enumerated, so an in house fraud detection engine does not establish that the whole suite has a single party model supply chain.

The public material does not specify which external services receive record content, their retention periods or their training rights. Customer isolation at the infrastructure layer is useful, but it does not resolve the separate question of downstream model processing.

The National Health Plan case compares Fraud Scope findings with investigation leads from hotlines, law enforcement, other vendors and internal work. It reports roughly 97% of exposure captured while flagging 8% of providers, plus additional leads. The customer is unnamed, and the account lacks a calendar period, sample counts and independent adjudication. This supports a specific operational use case but does not establish a transferable detection rate.

Clinical ClaimPilot's shorter review times and higher daily audit capacity are separate product claims. Those claims concern a different product and do not establish independently measured clinical outcomes.

Platform protections include encryption, access management, monitoring and incident response, with customer specific encryption keys and isolated environments. Those controls address unauthorized access to claims and medical records. They do not explain how long original records, prompts, generated summaries or audit logs remain available, or whether model improvement uses customer material.

ClaimPilot can adapt to reviewer input, making the boundary between local configuration and broader model training particularly relevant. Product specific deletion schedules, deidentification methods and training permissions are not stated. Medical record links aid review of a result, but they are a separate safeguard from retention and reuse controls.

The software is described as HIPAA compliant and operates in a HITRUST certified environment. Claims files, medical records and audit evidence can contain protected health information, so the contracted service relationship matters independently of those security statements. The public privacy policy covers website visitors, marketing contacts and web analytics rather than the processing terms for payer records.

The public service terms do not establish business associate agreement availability across products or detailed subcontractor obligations. The compliance claim establishes an intended healthcare posture, but the website policy cannot supply the missing service agreement terms.

The July 2025 security announcement identifies HITRUST r2 certification and repeated recertification, alongside a second year of NIST 800 53 Revision 5 compliance. It describes encryption, access controls, monitoring and incident response across the cost containment platform. HITRUST is a named external assurance signal; NIST alignment identifies a control framework and does not by itself establish a separate certification or FedRAMP authorization.

A certificate or detailed assessment report is not publicly accessible from the security announcement. Assessment boundaries, covered entities and the exact relationship between the certified environment and each current generative AI product remain matters of scope.

The current products support payment integrity, fraud investigation, coding review and payer administration. Clinical ClaimPilot uses clinical records to help an auditor assess a billed claim; its recommendations concern audit findings and reimbursement adjustments. This distinguishes the described purpose from diagnosing a patient or choosing treatment at the point of care. No FDA clearance or authorization is attached to the current offer.

The word clinical in the product name refers to the records and expertise involved in review, not evidence of a regulated diagnostic indication. Any future expansion into patient management would require its own intended use assessment.

The AI vision includes a commitment to responsible innovation, and the security program covers controls throughout the model lifecycle. Fraud Scope also exposes evidence behind suspicious patterns, allowing investigators to assess a lead before pursuing it. These are useful governance elements, but security certification is not an evaluation of fairness or payment decision quality.

Subgroup performance for provider populations, patient demographics and claim categories remains unspecified, as does independent assessment of the AI governance framework. The available material does not describe how disparate impacts are monitored or how a contested model behavior leads to a controlled update.

Fraud Scope gathers evidence chains, and ClaimPilot lets an auditor inspect source records and preserve findings during a review. These features make a disputed recommendation more traceable and provide a practical opportunity to correct it before acting. The national health plan's detection percentage is a retrospective case result, not a contractual promise that a future claim will be handled correctly.

No output accuracy warranty, reimbursement indemnity or defined financial remedy is stated for an erroneous recommendation. A human audit workflow reduces reliance on an unchecked result, but it does not specify who bears losses after an incorrect payment decision.

The implementation approach uses an organization's existing data feeds and brings claims, medical records and other audit documents into a shared review environment. Within ClaimPilot, reviewers can move from a summary to the original record and track document collection. This supports ingestion and internal workflow continuity, rather than a demonstrated connection to a named electronic health record.

Specific EHR connectors, production marketplace listings and detailed bidirectional interfaces are not identified. The available integration description does not establish which transactions can be written back, how source identities are reconciled or how conflicting updates are handled.

Each customer has an AWS environment with a separate tenant and customer specific encryption keys. Its ClaimPilot demonstration also describes a customer specific virtual private cloud for records and other data. That gives meaningful information about isolation and hosting architecture. A named processing region, backup location and cross border support policy are not stated, and there is no clear menu of on premises or customer hosted alternatives.

The isolation design does not establish a residency commitment. Implementation timing of eight to twelve weeks for an initial product concerns onboarding, rather than a guarantee about where data remains.

The offer consists of separately described software products and optional medical record review, data mining and investigation services. A health plan can therefore scope an engagement around fraud detection, prepayment review, provider education or a broader payment integrity program. Sales demonstrations are the entry point, and implementation guidance describes adapting existing data feeds.

Subscription amounts, billing units, minimum commitments and implementation charges are not available as a rate card. Savings per member and projected return on investment describe potential customer benefits rather than fees. The total cost remains dependent on the selected software and contracted service scope.

The principal users are health plans, pharmacy benefit managers and government health agencies. Fraud Scope covers medical, pharmacy and dental claims across Medicare, Medicaid and commercial business, with investigators reviewing provider and claim outliers. Clinical ClaimPilot adds inpatient and facility audits, including itemized bills, diagnosis related group validation, short stays and readmissions.

The national health plan case establishes actual payer use of Fraud Scope, while other product pages broaden the intended scope. The available results do not establish equivalent performance in every claim type or line of business. This is payment oversight across specialties, rather than a tool for direct clinical care.