CombineHealth

Five agents carry the work: Amy codes, Mark bills and verifies eligibility, Adam works accounts receivable, Rachel drafts appeals and Taylor tracks more than 50 revenue cycle indicators. Around them sit a revenue cycle platform and a human review tier.

Much of Mark's job is form completion, payer portal navigation, payment posting and reconciliation, and Taylor's is reporting, work that would stay useful as software with the models removed. The quality process ends with certified coders, and whether they are the customer's staff or CombineHealth's is not stated; if they are CombineHealth's, part of what is sold is a service.

Oversight is described in detail: confidence scoring with uncertainty flags, secondary model validation, final review by certified coders, live tracking of claims and corrections, a confidence threshold the customer configures, and a commitment that the AI makes no irreversible decisions. The trust page says human review is built into every step, while the FAQ says only uncertain cases are flagged, and an 85 percent claim automation rate appears elsewhere.

The FAQ then promises that continuous learning ensures '100% compliant and accurate outputs' and that flagging uncertain codes 'ensures that no code is assigned incorrectly due to AI uncertainty'. Either claim, taken at face value, removes the reason to audit codes the model was confident about and got wrong, and the company's own 97.2 percent accuracy figure contradicts both.

CombineHealth describes natural language processing for clinical notes, machine learning over coding patterns and payer outcomes, deep learning for pattern recognition and agentic automation for steps that follow fixed rules, and says models can be tuned on a customer's historical data, coding grid and preferred guidelines. Each code arrives with its rationale and the documentation that supports it.

The trust page calls the models proprietary and trained on healthcare datasets. No foundation model, model class or version is named.

No foundation model provider, hosting provider or subprocessor is named, and there is no subprocessor list.

The product is described as generative and agentic, which usually means an outside model service sits somewhere in the chain. The trust page's commitment that customer data is not shared with third parties does not say whether a model provider counts as one.

A parallel coding study on 1,000 emergency department charts compared CombineHealth's output with expert human coders working the same charts, and reports 97 percent accuracy, turnaround roughly halved and five times as many documentation gaps found. The company designed, ran and reported the study, with no published protocol or outside audit.

Customer results include Brault scaling autonomous coding from pilot to five times the volume at more than 98 percent accuracy, an anesthesia hospital group verifying eligibility 85 percent faster with eligibility denials down 6 percent, an internal medicine practice cutting eligibility work by 80 percent, and a health center with more than 30 providers reporting 20 percent fewer denials. Rachel is said to cut appeal turnaround by up to 70 percent. Most stories identify the customer by type rather than by name.

Customers own their data under the trust page's terms: it is not sold, shared with third parties or repurposed, deletion or export can be requested at any time, and models are trained only on de identified data or with permission. The FAQ qualifies that, saying data is de identified for AI training and analysis where appropriate. Data minimization, encryption, audit logs of model decisions and access, and outside penetration testing are described.

No retention period is given for charts, codes, claims or logs, and nothing says what happens to data or tuned models when a customer leaves without requesting deletion. Guardrails against wrong output are described only through the quality process.

CombineHealth's FAQ answers the HIPAA question with named controls: encryption in transit and at rest, role based access, audit trails of all data access and changes, regular security audits and vulnerability assessments, HIPAA training for all staff, and de identification of data used for AI training where appropriate. The trust page adds exportable audit logs for a customer's compliance officer.

No business associate agreement, subcontractor terms or breach notification period is available to read.

A SOC 2 Type 2 report covering security, availability, processing integrity, confidentiality and privacy is available on request, according to the FAQ, and the homepage carries an AICPA SOC 2 logo. The trust page lists AES-256 encryption, single sign on, role based permissions, API security, a security operations function, vulnerability management and regular outside penetration testing.

No audit period or auditor is given, and there is no trust center from which to download the report.

Coding and billing are administrative determinations, and no device pathway applies or is claimed.

The exposure sits in claims. Codes are representations to a payer, and errors fall on the billing provider under the False Claims Act and payer audit rules. CombineHealth's design addresses that risk with a rationale and supporting documentation on each code, exportable audit logs for compliance officers, and a documentation integrity function that flags gaps before a claim goes out.

Every coding decision carries a traceable rationale, and logs of decisions, user actions and access can be exported, so a compliance team can audit how each review stage performed.

The models learn continuously from payer outcomes, including denials, reimbursements and underpayments. A model rewarded for codes that get paid is related to, but not the same as, one rewarded for codes that are correct, and the two diverge where the money is. No distribution of assigned evaluation and management levels against a benchmark, no result by specialty, payer or physician, and no outside audit of coded output is available.

The customer sets the confidence threshold that routes charts to people, the AI makes no irreversible decisions, and overrides and exceptions are tracked, so an error can be caught and traced back to the decision that produced it.

No service level agreement, warranty, indemnity or remediation commitment is offered, and accuracy is not broken down by code type, although evaluation and management levels are the element most often challenged on audit.

Twelve record and practice management systems are named as integrations: Epic, Oracle Cerner, athenahealth, eClinicalWorks, NextGen Healthcare, Greenway Health, ModMed, Allscripts, AdvancedMD, CareCloud, DrChrono and Practice Fusion. The FAQ says integration runs through APIs, HL7 and custom interfaces built with the customer's IT staff, and the billing agent enters charges directly into billing software, so the connection writes as well as reads.

No marketplace listing or integration documentation is available, and FHIR is not mentioned.

Data residency controls, secure transmission and physical data center security are listed on the trust page, and the FAQ mentions data centers with physical security protocols.

No hosting provider, region or tenancy model is stated, and whether the residency controls are set by the customer or fixed by CombineHealth is not explained.

Cost is not visible before a sales conversation. CombineHealth gives no unit of charge, price range, implementation fee, minimum commitment or trial terms, and its FAQ covers integration, training, support and security without reaching cost.

The agent comparison table says cost per claim 'reduces effortlessly with volume', which describes the customer's own operating cost rather than CombineHealth's fee.

Emergency medicine and anesthesia carry most of the evidence: an emergency department coding study, emergency physician billing at Brault, and anesthesia groups for claims and eligibility. Named customers also include Medcor, Kodiak KANA, Homeward, Edelberg, Fountain Hills, McFarland Clinic, SignatureCare ER and El Mirage ER and Medical Center, and unnamed ones range from a community health center to hospitals of 400 and 500 beds.

Coding regimes outside the United States are not addressed, and outside emergency medicine and anesthesia the results are thin.