Cohere Health

A reported 350 or more clinically trained models perform the determination itself. Auto approving 85 percent of prior authorization requests in real time is not achievable with rules alone, and the models are what the plan is buying.

The most important design disclosure in this category, and it turns on direction rather than degree. The AI auto approves; it does not auto deny. The company states that up to 85 percent of submissions receive real time approval and that the remaining submissions are reviewed by a clinician before final determination.

That asymmetry is the correct architecture for prior authorization: an erroneous automated approval costs the plan money, while an erroneous automated denial costs a patient care, and only one of those should ever be delegated to a model. Buyers and regulators should verify the asymmetry holds in contract and configuration, since it is the entire safety argument.

The clinical basis is disclosed well and the models themselves are not.

What is published: decisions are guided by a named policy corpus including national and local coverage determinations, third party policies, custom plan policies and policies developed with medical societies, with American College of Cardiology guidance embedded in the cardiovascular workflow. Naming the guideline sources is a real disclosure and more than most peers offer.

What is absent is the model layer. A count of more than 350 clinically trained models is a quantity, not a description. There is no architecture, no accuracy or precision figures, and no published confidence threshold governing which submissions auto approve and which route to a clinician. That threshold is the single most useful number this vendor could publish, because the entire safety argument rests on where the line sits.

One inconsistency a buyer should resolve. The automation rate appears as 85 percent real time approvals for routine requests in one place and as up to 90 percent of routine cases in another, on the company's own pages, with different qualifiers attached. The figures may both be true of different denominators, but a reader cannot tell which is comparable to a competitor's number.

A full tier certification provides substantive evidence of privacy and security controls rather than a policy statement, and this is squarely inside protected information, since authorisation submissions carry clinical documentation and the platform extracts clinical data from those documents at the scale of millions of authorisations a year. Two exposures deserve naming.

The intake channels include phone and fax by design, which is the right choice for reaching a whole provider network rather than only its digitally mature members, and it also means clinical documentation arrives outside a controlled digital pipeline, with nothing published describing how those channels are handled. An inclusive design decision has created the exposure, which is worth stating so it is not mistaken for carelessness.

The second is a category question rather than a control gap and it is the sharper one. A provider analytics capability examines individual clinicians' historical behaviour and guideline adherence to identify trusted providers and reduce their authorisation requirements.

That is a behavioural profile of a named clinician rather than patient data, so a business associate agreement may not reach it at all, and the most consequential record about a provider may be the one governed by the least. Also unpublished: any retention or deletion schedule for submitted clinical documentation, any statement on whether member data trains the models, and any sub processor list. Ask what governs the provider profile, and who can see it.

Volume and outcome evidence are both substantial and specific: more than 15 million prior authorization submissions carried through the APIs, 47 million payer provider interactions annually, care access reported 70 percent faster than traditional processes, up to 9x return on investment, and 50 percent faster inpatient and outpatient reviews.

Provider satisfaction is measured from the counterparty rather than the customer, at 94 percent with an NPS of 67, which is unusual and meaningful: a payer tool that providers rate well is evidence the automation is not simply obstructing care. Named plan relationships include Humana and Geisinger.

Squarely inside protected health information. Prior authorization submissions carry clinical documentation, and the platform extracts clinical data from those documents to assist reviewers, so this is patient data handled at the scale of millions of authorizations a year. HITRUST r2 certification is substantive evidence of privacy and security controls rather than a policy statement.

Two exposures are worth naming.

The intake channels include phone and fax by design, which is the right choice for reaching a whole provider network rather than only its digitally mature members. It also means clinical documentation arrives outside a controlled digital pipeline, and nothing published describes how those channels are handled.

The second is a category question rather than a control gap. Cohere Align analyses individual providers' historical behaviour and guideline adherence to identify trusted clinicians and reduce their authorization requirements. That is a behavioural profile of a named clinician, not patient data, so a business associate agreement may not reach it at all. The most consequential record about a provider may be the one governed by the least.

Also unpublished: any retention or deletion schedule for clinical documentation submitted with authorization requests, any statement on whether member data trains the models, and any subprocessor list.

Business associate status follows from the work rather than from interpretation. Cohere processes clinical documentation and makes coverage determinations on behalf of health plans, so it handles protected health information as a matter of course.

The supporting evidence is stronger than a policy page. HITRUST r2 certification maps directly onto the HIPAA Security Rule and is externally validated, and the URAC and NCQA accreditations both involve outside examination of how determination files are handled, documented and retained. In practice three independent bodies have looked at the controls.

Held at B because the posture itself is not published. No business associate agreement or its terms appear publicly, the company does not state its role in those words, and no review or evaluation cadence is given. None of the three routes to a higher grade in this index is taken: publishing the instrument, publishing the role alongside an evaluation cadence, or publishing both roles and the switch between them.

For a vendor with this much external validation, the gap is presentational rather than substantive, and closing it would cost very little.

HITRUST r2 certification, first earned in August 2022 and maintained through recertification. Among the healthcare security frameworks this is the demanding end. r2 is the tailored, risk based certification rather than the fixed control set of the lower tiers, and maintaining it requires ongoing third party monitoring across hundreds of tested controls, so it evidences a programme rather than a single audit.

Three external bodies have examined this operation against three different standards, since URAC and NCQA accreditation additionally involve inspection of decision file handling, documentation and review processes.

Two honest limits keep the A legible rather than generous. No SOC 2 report is claimed, and no public trust centre publishes current certificates, so a buyer cannot self serve the evidence. And the most recent recertification confirmed from public sources is 2024, which means currency should be verified directly rather than assumed.

One claim to read carefully rather than credit twice. HITRUST materials describe certification as demonstrating alignment with ISO, NIST, PCI, HIPAA and GDPR. That is the framework's control mapping, not five separate certifications, and should not be recorded as such.

Graded against the regime that governs utilization management rather than against the FDA, which has no jurisdiction here. On that basis this is the strongest regulatory position in the payer side group.

Cohere holds URAC Health Utilization Management accreditation and NCQA Utilization Management Accreditation, and was the first digital prior authorization platform to earn the NCQA credential, in July 2021, since reaccredited. Two accreditors with overlapping but distinct methodologies have examined the same operation, which is a materially different thing from holding one badge twice.

The accreditation is worth more than a credential to the buyer. Under URAC's modular approach a plan working with an accredited partner does not have to run its own delegation oversight and relies on the partner's accreditation instead, so this transfers directly into the customer's own audit position.

On the statutory side the platform is stated as fully compliant with CMS-0057-F, the interoperability and prior authorization rule, and the company participates in the Da Vinci Project on the implementation guides and in the CMS Electronic Prior Authorization Acceleration initiative.

Grading this axis on the absence of an FDA clearance would have produced a C and all of it.

Governance surface is real but thin relative to the stakes. The company positions itself around decision transparency and full auditability, supports CMS-0057-F electronic prior authorization compliance, and joined the CMS Electronic Prior Authorization Acceleration initiative, which is regulatory alignment rather than model governance.

Third party commentary raises the standing concern that models trained on historical authorization data can reinforce existing patterns of denial, and no bias evaluation, subgroup performance analysis, or independent audit was retrieved to address it. For a system making coverage determinations at this volume, that is the most consequential gap in the record.

The clinical basis is disclosed well and the model layer is not. Decisions are guided by a named policy corpus including national and local coverage determinations, third party policies, custom plan policies and policies developed with medical societies, with a named society's guidance embedded in the cardiovascular workflow.

Naming the guideline sources is a real disclosure and more than most peers offer, because it tells a provider what their request was actually measured against and gives them a document to argue from. What is absent is the model layer. A count of clinically trained models is a quantity rather than a description, no architecture or accuracy figures are published, and no confidence threshold governing which submissions auto approve and which route to a clinician is disclosed.

That threshold is the single most useful number this vendor could publish, because the entire safety argument rests on where the line sits. One structural feature is favourable and should be credited: automation applies to approvals while anything not approved routes to a human, so the error the system makes on its own is an approval that should have been reviewed rather than a denial nobody saw. A buyer should confirm that asymmetry holds in their configuration.

One inconsistency to resolve: the automation rate appears in two different forms on the company's own pages with different qualifiers, and a reader cannot tell which is comparable to a competitor's number. Ask for the threshold and the denominator.

Multi channel by design and deliberately undemanding of the provider: submissions accepted by phone, fax, and web intake as well as direct EHR integration, with mature APIs supporting CMS-0057-F compliance. Meeting providers on legacy channels rather than requiring integration is what allows a payer side product to reach the whole network rather than only its digitally mature members.

The engagement model is disclosed unusually well, and one part of it is genuinely buyer favourable. Cohere offers both a platform a plan runs itself and a fully delegated service where Cohere's own nurses and physicians operate utilization management end to end for named specialties, plus blends of the two. It publishes a transition path from delegated back to in house operation, which is the opposite of the lock in most outsourcing arrangements are designed to create.

The platform is positioned to augment rather than replace existing plan systems, with a single integration exposing capabilities across utilization management, clinical decision support and prior authorization. Intake is deliberately multi channel, accepting phone, fax and web submission as well as direct integration, with FHIR APIs for the CMS-0057-F workflow requirements.

Held at B on the residency half of the axis. No hosting provider is named, no region or data centre location is published, and there is no subprocessor list. A buyer can tell exactly how the service is operated and not at all where the data sits.

No public pricing and no published pricing mechanism. Engagements are enterprise agreements with health plans across two shapes, a platform the plan runs and a fully delegated service, which makes the commercial structure harder to infer rather than easier.

The only economics disclosed are return on investment multiples, cited between 8x and 18x depending on product, alongside per member per month savings figures. Those describe what the plan gets back, never what it pays, and a multiple without a denominator cannot be compared to anything.

The question a buyer should settle in negotiation is what compensation is actually indexed to. Savings linked economics create opposite incentives depending on the definition: compensation that scales with denials rewards refusing care, while compensation that scales with cycle time or approval speed rewards the opposite. Nothing published says which applies here, and given that this vendor's central safety claim is that its models only ever auto approve, the commercial answer either reinforces that architecture or quietly works against it.

Worth reading against Alaffia Health, the other payer side vendor in this index, which publishes its mechanism plainly as a contingency fee set as a percentage of recovered funds. Alaffia does not publish its percentage either, but a buyer at least knows what it is being charged for.

Broad within utilization management and specific about where it operates. Delegated specialty coverage spans musculoskeletal, cardiology, diagnostic imaging, gastrointestinal and sleep medicine, with surgical services deployed nationally for one large plan. Coverage extends across outpatient and acute inpatient review, and the platform reaches payment integrity and appeals as well as authorization.

Scale is named rather than implied: roughly 5.5 million prior authorizations a year, more than 15 million plan members touched, and around 420,000 providers. Named plan relationships include Humana and Geisinger, alongside two large Blue Cross Blue Shield plans, two regional plans and a national risk bearing provider.

One scoping point matters when comparing this record with provider side tools. The buyer is the health plan and the company states plainly that providers and manufacturers do not license the platform. Providers experience the product without choosing it, which is a different relationship from any tool a clinician buys.