DetectRx (iatricSystems)

Detection is the product and the method is named in the vendor's own voice as machine learning combined with expert written rules, a hybrid the company states openly rather than presenting everything as a model. The model is central but not alone: rules do a meaningful share of the work, and the surrounding investigation dashboard and reporting would function without a model at all.

DetectRx scores events by risk and its assistant, AVA, then acts on them. iatricSystems' AVA brochure (September 2025) says that once a user's activity is scored high risk, AVA immediately follows up with a questionnaire, automatically follows up with that user's manager, notifies a designated leader, reassesses the event's risk from the responses, escalates unanswered questionnaires, and can automatically notify, escalate or close incidents under configurable rules, documenting each step in DetectRx.

That is a described structure, with routing conditions the customer sets. The limits are not published: nothing says what AVA may not do, whether an incident can be closed automatically with no person reviewing it, whether the flagged clinician is ever contacted directly, or how an investigator overrides AVA's reassessment. The manager contact happens before any compliance reviewer has looked at the case, and nothing published says how that is configured.

The approach is named: machine learning combined with expert written rules, evaluating data from electronic health records, automated dispensing cabinets and staffing and timekeeping systems in near real time as feeds arrive, over named signals including dosing levels, medication and reconciliation patterns, patient pain scores and off shift or off location activity, with events risk scored for users and drugs and the reason for each flag shown.

The pain score signal looks for the consequence of diversion in the patient record rather than only for the behavior of the diverter. That is enough to form a working picture of how a flag arises. No model family, training population, version or update practice is published, and the claims of fewer false positives carry no number.

The architecture is described: a cloud hosted application that collects data from electronic health records, automated dispensing cabinets and staffing and timekeeping systems and applies machine learning and expert written rules to it, with AVA as a proprietary assistant built into the product and shared with the company's other monitoring software.

The brochures' cost notes mention Microsoft operating system and database licensing, which describes the platform stack rather than any model layer. No model provider, host, framework or third party analytics component is named, no subprocessor list is published, and nothing distinguishes capability built in house from capability licensed.

Deployment evidence is named, dated and attributable. Renown Health in northern Nevada implemented the product in 2024 with its director of accreditation and regulation and its vice president of quality and patient safety both speaking on record, and Peterson Health is named through its director of pharmacy. The published figure is that Renown moved from five risk factors monitored via manual monthly reports to twenty four monitored through the product.

That number measures how much is now watched rather than what the monitoring caught, and an input measure presented alongside customer names can easily be mistaken for a result. No detection rate, accuracy figure, false positive rate or case outcome has been published.

Nothing published addresses whether customer data trains models beyond the tenant, how long behavioral records about named staff are retained, or what happens to them at contract end. The timekeeping feed sharpens this. A model that knows when a clinician was scheduled, when they were present and what they administered is building a continuous record of an identified employee's working life, and the absence of any retention or training statement leaves a hospital unable to tell its own staff how long that record persists or what else it is used for.

No HIPAA statement, business associate status or agreement is published for DetectRx, which reads the electronic health record, dispensing records and staff timekeeping data together. iatricSystems' only privacy document is a privacy policy, last updated February 2026, which covers the company website and states that it does not apply when iatricSystems processes personal data on behalf of a customer, directing those questions to the customer.

That tells a buyer where to ask, but a website notice does not reach the product. Joining clinical records to a named employee's shift pattern produces a dataset neither source system holds on its own, and nothing published says who owns it, how it is governed or what contractual terms attach to it.

No certification, attestation, trust portal or security page is published for this product or for the company. This is a small vendor and the absence is unsurprising, but the consequence is concrete rather than theoretical. The product ingests clinical records, controlled substance transactions and employee timekeeping data and joins them, and there is no third party assurance of any kind covering how that is held. For health systems that require a security attestation from vendors handling protected health information, nothing public answers the question.

The product makes no device claim and is scoped accordingly. DetectRx is positioned as drug diversion detection and investigation software for hospitals, and its regulatory language is about compliance reporting: the January 2026 brochure says it provides the data and reporting needed for compliance and regulatory reporting, and AVA output is described as documentation for HR and regulatory compliance.

No statement of the company's own regulatory position is published, and nothing guides customers on how findings should be handled in reporting to the Drug Enforcement Administration or a state board of pharmacy, which is where diversion investigations often end.

Nothing published describes how the detection model is governed or tested: no validation summary, no false positive or false negative rate, and no review of which staff the scores fall on. The vendor's material makes performance claims without figures: that DetectRx improves detection accuracy and drastically reduces false positives, and that AVA limits false negatives while accounting for false positives. An unquantified claim is not an evaluation.

The signals in use make the distribution question concrete. Off shift and off location activity checked against timekeeping data can fall more readily on float pool and agency staff, night shifts and anyone whose schedule is irregular by the nature of the job, and nothing published says whether who the model flags has been examined.

DetectRx shows why each event was flagged and tracks investigation activity from start to finish, and AVA documents every questionnaire, response and action in the system, material iatricSystems describes as documentation for human resources and regulatory compliance. Those are mechanisms that let a hospital examine and contest a flag before acting on it.

Nothing stands behind the output: no accuracy commitment, no remediation obligation when a flag is wrong, and no route for the clinician whose activity is scored, whose manager may be questioned automatically and whose record may enter an HR file, to see the score or challenge it. The product is explicitly built to produce an evidentiary record about a named employee, which is why the missing route matters.

Three source system classes are named for this product, the electronic health record, automated dispensing cabinets and staffing and timekeeping systems, and reaching into workforce scheduling data extends the input beyond dispensing and administration records.

The January 2026 brochure calls DetectRx EHR agnostic and says it integrates with any EHR. iatricSystems also sells interface engine and EHR integration services, though nothing published says that capability carries across to this product. For DetectRx specifically, no electronic health record or dispensing cabinet vendor is named and no integration method is described.

The January 2026 product brochure lists cloud hosted deployment among DetectRx's key advantages, a single hosted option. The same brochure's small print says additional costs may include server and storage hardware, Microsoft operating system and database licensing, digital certificates and backups, and asks buyers to consult iatricSystems on server requirements, which reads as infrastructure on the hospital's side. The two statements are not reconciled.

No cloud provider, region or residency commitment is stated, and nothing says which parts of the product run in iatricSystems' hosting and which on customer servers. Because the product joins electronic health record, dispensing and staff timekeeping data, where that joined record rests is the open question that matters most.

No price is published. The product brochures do set out what drives the cost beyond the license: server and storage hardware, Microsoft operating system and database licensing, third party licensing such as digital certificates and backups, and third party interface and integration work, with server requirements set by iatricSystems. The DetectRx brochure also states that the product scales to any facility size. That makes the cost structure discoverable before a sales conversation.

What is not published is how the license itself is charged, whether per facility, per bed or per monitored user, or whether AVA is included in it, which matters because the automation is the differentiator rather than an accessory.

The two named customers span a useful range, a large multi site health system in Nevada and a smaller regional organization, which suggests the product scales in both directions without the vendor claiming so. Configuration to Joint Commission standards and Core Measures is stated explicitly, which ties coverage to a recognized accreditation framework rather than to a self defined checklist.

What is absent is any breakdown by care setting: nothing distinguishes inpatient from procedural, anesthesia, retail or ambulatory deployment, no facility count is given for the product, and the three source system classes it reads imply a hospital footprint without the vendor defining one.