Droxi

The model is the whole product. Droxi reads each inbound inbox item against the patient's full record, classifies clinical significance, assembles refill context, summarises documents and decides what a human needs to see. Nothing underneath it is a workflow tool, a data asset or a network that would retain value if the AI were removed.

The strongest oversight architecture in this category so far, sitting next to a claim that overstates it. On the credit side, Droxi does two things almost nothing else here does. It publishes the SCOPE of its own autonomy, stating that 38 percent of routine work is handled automatically, which tells a buyer how much of the inbox is being disposed of without a person. And it provides SOURCE TRACEABILITY at point level: every lab recommendation is traceable to the source data, and every summary point links directly to the source text in the original document. That is the sentence level provenance property this index treats as the benchmark, applied to inbox items rather than to a note. Rules are configurable, so the practice sets the auto close policy. Against that, a bylined trade article states that the control a physician gives up is none, and that every output is a draft, a summary or a suggestion. That does not describe the shipped behaviour. Droxi auto closes normal results including those slightly outside reference ranges where it judges them clinically insignificant, and sends the patient a message about it. The physician's control is exercised when the policy is configured, not when the item is disposed of, and those are different things a buyer needs to hold apart. Held at B: no false negative rate, no audit or sampling disclosure, and the claim of zero autonomy in the marketing is not reconcilable with the auto close and auto send behaviour in the product.

No model is named, no model card exists, and there is no statement of whether foundation models are first party or licensed, nor any published methodology for how clinical insignificance is determined. The source traceability the product offers is real but it is an auditability property, credited on the autonomy axis, not a disclosure of how the system works.

Better attributed than most of this market, still entirely vendor assembled. Droxi names the organisations and the individual clinicians behind its claims, including a chief medical officer, a practice manager and nurse practitioners across Blue Ridge Health, Valley Health, Salience Health and Primary Care Partners of South Bend, and it links to reviews hosted on the athenahealth Marketplace, which a buyer can read without going through Droxi. The customer set spans federally qualified and rural health centres, paediatrics and a Canadian health authority, so the deployments are not concentrated in one favourable setting. What is missing is method. The 51.9 percent reduction in after hours inbox work is the most specific claim on the site and no denominator, baseline period, cohort size or measurement approach is given for it, and there is no peer reviewed study, no controlled comparison and no third party evaluation. Graded B for attribution and breadth, held below A for the absence of any stated methodology.

One real architectural commitment, and several unanswered questions around it. Droxi states that data is processed in real time inside the customer's EHR and is therefore not stored separately, which if accurate removes the vendor side data store that is the largest exposure surface in this category. That is a more substantive answer than the silence most of this market offers. Not yet established: whether customer clinical data is used to train or improve models, what retention applies to anything that is held transiently, and where processing physically occurs, which is a live question for a company headquartered in Israel serving customers in the United States and British Columbia. Cross border processing and data residency are not addressed anywhere located. Held at B rather than A pending those answers.

HIPAA compliance is asserted in the site FAQ. No business associate agreement is published, no terms are described, and nothing states whether one is included or separately negotiated. Middle rung of this index's HIPAA ladder, where most of the market sits.

The only security claim located is that Droxi is HIPAA compliant with enterprise grade security. Enterprise grade is a marketing adjective, not an attestation, and it joins this index's watchlist of unverifiable security formulations alongside SOC 2 aligned, bank level encryption and military grade security. No SOC 2 of either type, no HITRUST, no ISO 27001, no penetration test summary, no trust centre and no report request path was found. The no separate storage architecture is a genuine security relevant design choice and is credited on the PHI axis, but architecture is not an audit. For a vendor selling into United States health systems this is the first thing a security review will ask for, and its absence from public materials is itself the finding.

No clearance, no submission and no published regulatory analysis. Logged as an observation with an ask rather than as a finding, and it is sharper here than for most of this category: the product decides that a result outside the reference range is clinically insignificant, closes it, and sends the patient a message, all without a clinician seeing it. Whether that sits inside the software functions excluded from device regulation under the 21st Century Cures Act depends on whether the clinician can independently review the basis for the determination, which the source traceability feature arguably supports but which nobody has stated as a regulatory position. Ask Droxi for the documented analysis rather than assuming either answer.

No fairness, subgroup or performance variation disclosure, which matters more here than in most categories because auto closed results are never read by a clinician, so any systematic miss concentrates on patients nobody looks at twice. Separately, and worth a buyer's attention: the same platform sells Droxi Unlock, which identifies Medicare patients eligible for Advanced Primary Care Management, handles their enrolment and documentation, and is marketed on recurring revenue of up to 116 US dollars per patient per month. That is programme enrolment revenue rather than coding intensity, so it does not belong on this index's coding gradient, but it does mean the vendor reading the chart and the vendor enrolling the patient into a billable programme are the same vendor, with no boundary between them. That is the tight loop shape this index has flagged elsewhere: the integration is valuable and it removes a checkpoint. No independent party is positioned to question an enrolment determination.

Runs natively inside the EHR with no separate login and no parallel application, and is listed on the athenahealth Marketplace with public customer reviews, which is evidence of a working production integration rather than an asserted one. athenahealth is the only EHR named anywhere in public materials. A genuine plus within that scope: refill intake is multi channel, consolidating requests arriving as fax, portal message or electronic prescription into one queue, which is more than a single API surface. Buyers on any other EHR should confirm availability before evaluating anything else.

Delivered inside the customer's EHR workflow, with the company stating that processing happens in real time and data is not stored separately. Beyond that nothing is disclosed: no hosting provider, no region, no tenancy model, no residency commitment and no on premise or single tenant option. The gap is more consequential than usual given the company is headquartered outside the jurisdictions of its named customers.

No price is published at any tier. Every commercial path routes through a booked call, and no pricing basis is stated, so a buyer cannot tell whether the product is priced per provider, per seat, per item processed or per practice. Worth naming the asymmetry: the site does publish a specific dollar figure, up to 116 US dollars per patient per month, but that is the revenue the PRACTICE can capture from the Advanced Primary Care Management programme through Droxi Unlock, not what Droxi charges. Publishing the customer's upside while gating your own price is a choice, and a buyer modelling return on investment has only one side of the equation.

Explicitly scoped to primary care and to three inbox item types: labs, refills and clinical documents. Within that scope the setting coverage is genuinely varied and better evidenced than most of this category. Named customers include federally qualified and rural health organisations, a paediatric practice, a combined psychiatry and primary care group, and a Canadian regional health authority, so the product is not proven only in well resourced suburban practices. Not claimed anywhere: inpatient, emergency, specialty inboxes, or the general patient portal message and staff message traffic that makes up the rest of a clinical inbox.