Dyania Health

A medically trained large language model does work that previously required a clinician reading a chart. The company is precise about what the system does and does not do: it answers specific clinical questions to find signals in a patient's history rather than generating summaries, which its CEO states explicitly. Reported throughput is the clearest evidence of centrality, processing structured and unstructured record data in under half a second against 30 minutes to two hours for a human reviewer.

Clinician in the loop is built into the deployed workflow and was preserved even in the published study. The peer reviewed evaluation describes clinical team validation as an essential component of the workflow to ensure safety and accuracy, with the AI pre screening and humans confirming.

The company has also published research on stepwise confidence estimation for failure detection in self evaluating multi step LLM tasks, which is unusually direct engagement with the question of when a model should flag its own uncertainty rather than assert an answer.

Among the most transparent in the index because the company publishes methods rather than claims. Its approach is described as a medically trained LLM based end to end system built on a large annotated medical record dataset developed since 2020, with reported accuracy above 95 percent.

Multiple peer reviewed and preprint publications describe the system, including evaluations for cardiac amyloidosis trial screening and a phase 3 polycythemia vera study, plus methodological work on confidence estimation. An external reviewer can read the methods and assess them independently.

The architecture claim is strong and the service model appears to cut across it, and the two need reconciling in the contract rather than in a reader's head. Credit first: records are stated never to leave the health system's computing environment and processing is local, which for an axis about stewardship is a stronger answer than any policy about handling.

Alongside that, the company describes its in house physicians reviewing true and false positive results before findings are sent to customers. Reviewing a false positive means examining the record that generated it, so vendor personnel do see patient level material, whether by working inside the customer's environment or by receiving output derived from it.

Neither is improper and both are ordinary in this category; what is missing is the description of who at the vendor sees what, under what access controls, with what logging, and whether that review happens inside the health system's boundary or outside it. The second gap is the training corpus and it is the largest undisclosed item here.

The model was built on a large annotated medical record dataset assembled by the company's own physician team, and nothing states whose records those were, under what permission or waiver, whether they were de identified before annotation, or whether any originated with institutions that are now customers. A model trained on medical records carries the provenance of those records with it. The screening surface is also the entire population rather than a consented cohort.

Peer reviewed real world evidence at a major academic health system, which very few vendors in this index can claim. A study with a major academic medical center published in a Heart Failure Society journal evaluated the system pre screening for a Phase III transthyretin amyloid cardiomyopathy trial: in one week it reviewed 1,476 patients and identified 46 potential matches, and 29 of the 30 confirmed matches had not been found through existing methods.

Separately reported results include 35 percent more diverse patients identified than manual review and 97 percent of identified patients missed by prior manual screening. The health system moved to enterprise wide rollout after a year of work in cancer and cardiovascular disease. Figures beyond the published study remain vendor reported.

Converted from Not Rated. The architecture deserves credit and two questions remain open, one of them squarely inside the company's own published description of how it works.

Credit first. Records are stated never to leave the health system's computing environment, and processing is local. For an axis about stewardship of patient data, an architecture that does not move the data is a stronger answer than any policy about handling it.

The first open question is the one the prior assessment identified and it stands. The company's model was trained on a large annotated medical record dataset assembled by its own physician team. Nothing published states whose records those were, under what permission or waiver they were used, whether they were de identified before annotation, or whether any of them originated with institutions that are now customers. A model trained on medical records carries the provenance of those records with it, and this is the single largest undisclosed item on the record.

The second sits in tension with the architecture claim and is worth stating plainly because the company raises it itself. Alongside data never leaving, the company describes its in house physicians reviewing true and false positive results before findings are sent to customers. Reviewing a false positive means examining the record that generated it. So vendor personnel do see patient level material, whether by working inside the customer's environment or by receiving output derived from it. Neither is improper, and both are ordinary in this category. What is missing is the description: who at the vendor can see what, under what access controls, with what logging, and whether that review happens inside the health system's boundary or outside it. A claim that data never leaves and a service model that requires the vendor to inspect patient level results need to be reconciled in the contract.

The surface is also broad. The system is described as continuously reading dynamically changing records to screen entire health system populations daily, which means the whole patient population is in scope rather than a consented cohort.

Converted from Not Rated. There is now a compliance claim to assess, and assessing it is what keeps this at C rather than moving it up.

The architectural half is genuinely strong and is credited on the deployment axis: the software installs behind the health system firewall and patient records are stated never to leave the health system's computing environment. Where nothing is disclosed to a vendor, the business associate framework is not engaged in the ordinary way, and that is a real answer for the data at rest question.

The compliance claim built on top of it is not well constructed, and a buyer should read it carefully rather than take the comfort. The company states that its architecture ensures compliance with the data privacy and security regulations a modern health system must adhere to, naming HIPAA, HITRUST and GDPR. HITRUST is not a regulation. It is a voluntary certification framework that an organisation elects to be assessed against, and no health system is required to adhere to it. Listing it alongside two statutes as something the architecture ensures compliance with is a category error, and it is the kind that indicates a marketing sentence rather than a considered compliance position. Elsewhere the same claim is phrased as exceeding HIPAA and GDPR, which is not a meaningful statement about either: an entity complies or it does not.

What is absent is the posture itself. No business associate agreement availability statement, no characterisation of whether the company considers itself a business associate, and no identification of which entity would sign. The question is live regardless of where records sit, because the company states that its own physicians review true and false positive results before findings are released to the customer, and reviewing a false positive means looking at the record that produced it.

A second instrument applies to the prescreening use and is not addressed either. Screening records to identify trial candidates happens before consent exists, so institutional review board approval and an authorisation or waiver govern, not a business associate agreement.

Converted from Not Rated. No SOC 2, HITRUST or ISO 27001 attestation was located and there is no trust centre.

One thing needs saying precisely, because it is the kind of wording a buyer can easily misread in the vendor's favour. The company's materials name HITRUST, but not as something it holds. HITRUST appears in a sentence stating that the company's architecture ensures compliance with the data privacy and security regulations a modern health system must adhere to, listed alongside HIPAA and GDPR. That is not a claim to be HITRUST certified, and it should not be read as one. It is also a category error, since HITRUST is a voluntary certification framework rather than a regulation anyone is required to adhere to. The practical effect is that the strongest healthcare security certification appears on this vendor's pages without the vendor claiming to hold it, which is a reader trap worth flagging on the record.

What the company does have is architecture rather than assurance, and its architecture is better than most: a closed installation inside the customer's own environment with no data transfer. That legitimately shifts what a security review should ask about. It does not substitute for an attestation, and it does not cover the vendor's own corporate environment, its development practices, its supply chain, or the access its staff hold to deployed instances during the maintenance it says it performs.

Ask three things. Whether any attestation exists and what it is scoped to. What the software transmits outbound from the closed environment and on what schedule. And what access the vendor's engineering and clinical staff hold to a deployed instance, with what logging and what customer visibility over it.

Converted from Not Rated. A scoping determination rather than an absence finding, and it closes.

The platform automates chart review and abstraction, answering specific clinical questions from structured and unstructured records, and is applied to trial prescreening, observational studies, registry reporting and quality measurement. In each of those the system identifies candidates and extracts information already documented in the record, for confirmation by a person. It does not diagnose, does not direct treatment and makes no recommendation about the care of an identified patient, so it sits outside device regulation and no pathway is claimed.

The prior assessment reached this reading and its framing is retained: the governing regime for the trial applications is human subjects research oversight, and the peer reviewed study of the platform reflects that framing in its emphasis on clinical team validation of what the system surfaced.

Two things follow that a buyer should not skip because this axis reads as clear. First, the absence of device regulation is not an absence of regulation. Screening records to identify trial candidates occurs before consent exists, so the operative instruments are institutional review board approval and an authorisation or waiver, and the question is under whose authority the screening runs and who holds the approval. Second, abstraction for registry reporting and quality measurement carries its own accuracy obligations to the receiving programme, which are contractual and programmatic rather than regulatory, and which no device framework would cover.

Better engagement than almost any vendor in the index, and it is measured rather than asserted. The published research explicitly frames improved equity of trial enrollment as an outcome alongside speed and accuracy, and the company reports identifying 35 percent more diverse patients than manual chart review, with its CEO stating the goal includes surfacing eligible patients from historically underrepresented groups who would otherwise be missed.

Separate published work on stepwise confidence estimation for failure detection addresses the model reliability side. Short of an A only because there is no standing governance program or ongoing monitoring commitment published.

Multiple peer reviewed and preprint publications describe this system, including evaluations in two named disease contexts, and one of them is unusual enough to name separately: methodological work on confidence estimation. Publishing how a system estimates its own confidence is rarer than publishing accuracy, and it is more useful, because a screening tool that returns a stream of candidates is only manageable if the reviewer can tell which ones deserve attention.

A confidence method that has been described in the literature can be examined for whether it is calibrated rather than merely ordinal, which is the distinction that decides whether a threshold means anything. The approach itself is described concretely as a medically trained end to end system built on a large annotated medical record dataset developed over several years, with a reported accuracy figure.

An external reviewer can read the methods and assess them independently, which is the standard this axis applies. Held below the top grade because nothing attaches commercially: no warranty, indemnity or remediation commitment was located, and no error characteristic is published for the deployed configuration as distinct from the published evaluations, which covered specific conditions rather than the general screening claim. Ask for recall by condition on your own population, whether the confidence estimate is calibrated, and what a low confidence result is expected to trigger.

The system was embedded within a major academic health system's EMR and screened data across 25 hospitals and 250 outpatient centers spanning three states, continuously re reading dynamically changing records to catch patients who become eligible over time. Running daily against a live record set at that footprint is a substantially harder integration than a batch extract, and the company states it handles deployment and ongoing maintenance itself as a one time implementation.

Converted from Not Rated after a second search that reached the company's own pages. The prior note recorded that no hosting, tenancy or residency terms were located. They are published, and they are unusually definite.

The company states that it installs its software behind the health system firewall in a closed off environment, that processing happens locally, and that patient records never leave the health system's computing environment. That is not a residency commitment about which region a vendor's cloud sits in. It is a statement that there is no transfer at all, which is the strongest position available on this axis and removes most of what the question is normally asking.

Held at B rather than A because a closed system still has edges, and none of them is described. The company also states that it performs the deployment and all ongoing maintenance, and that its own physicians review true and false positive results before findings are sent to the customer. Both imply vendor personnel reaching into the environment or into its output. Nothing published describes what remote access support staff hold, what is logged about that access, what telemetry or model updates flow outbound, or how model improvements derived from one customer's environment are handled.

The company operates from New Jersey and Athens. Where the data sits is now answered; where the people sit, and what they can reach, is not. Ask for the support access model, the audit trail over it, and the outbound network profile of the installed system.

No pricing is published, but the company frames the economic comparison unusually concretely: it states health systems with roughly 500,000 patients spend more than 5 million dollars annually on staff performing manual chart abstraction, and positions savings of up to 50 percent of that cost. Naming the baseline spend and a percentage against it gives a buyer a modelable frame even without a rate, which is more than most vendors offer. Deployment is described as a one time implementation with the company handling ongoing maintenance.

Described as disease agnostic with demonstrated depth in cardiology and oncology, extending to autoimmune conditions, and applied across clinical trial pre screening, observational studies, registry population and reporting, therapeutic gap identification, and quality measurement. Buyers span health systems, physicians, pharmaceutical sponsors, and researchers. The published evidence concentrates in cardiology, specifically rare disease trial screening, so breadth beyond that should be read as platform capability rather than demonstrated performance.