GeneDx

AI performs variant interpretation and classification over the GeneDx Infinity dataset, which is where diagnostic yield in rare disease actually comes from: the same sequencing data interpreted against a larger reference of prior cases produces more answers. Held back from A for the reason applied consistently to GRAIL, Freenome, and Caris: the product is a sequencing assay plus an interpretive layer, and the wet lab remains load bearing. The dataset, rather than the model, is the durable asset here.

A real external control governs the output, and the role of the automated component within it is not described.

The control is the clinical laboratory itself. A genetic test report is issued under a regulated quality system and signed out by a qualified laboratory director, and that requirement is imposed and inspected by someone other than the company. The company also describes its approach as combining its data and advanced artificial intelligence with human expertise, which places interpretation specialists in the path rather than presenting the model as the answer.

What is not published is where the line falls. Variant interpretation involves filtering millions of positions down to a handful worth human attention, and that filtering is the consequential step: a variant excluded before a human looks is not reviewed, and its exclusion leaves no trace in the report. Nothing states what the automated stage decides, what a scientist sees, whether excluded candidates can be re examined, or what confidence information accompanies a prioritised list.

The reanalysis question belongs here too. Interpretation improves as knowledge accumulates, so a negative or uncertain result is provisional in a way most diagnostic results are not. Whether reanalysis is automatic, periodic, requested by the clinician, or triggered when the dataset reclassifies a variant is an oversight design question with direct clinical consequence for families waiting on an answer.

Ask what the automated stage filters and on what basis, what a reviewer sees, and how and when cases are reanalysed.

The data asset is described in unusual quantitative detail. The technology that acts on it is not described at all.

On the asset, the company publishes real numbers: over 2.5 million tests, close to a million exomes and genomes, more than 7 million phenotypic data points, and parental data in more than sixty percent of cases. Those are checkable magnitudes rather than adjectives, and they are the most concrete disclosure on this record.

On the technology, nothing. No model or method is named, no architecture described, no account of how candidate variants are prioritised, no evaluation, no versioning, and no statement of how an interpretation pipeline change is validated or communicated. The strongest technical description located is that the company combines its dataset with advanced artificial intelligence and human expertise, which names a category.

Versioning deserves particular attention in this domain and its absence is more consequential than usual. Interpretation is not a fixed function. As the reference dataset grows and classifications change, the same input sequence can produce a different report, and a family's result can move from uncertain to diagnostic or the reverse. A laboratory relying on this needs to know which pipeline version produced a given report, so that a result issued years earlier can be understood in the terms that produced it.

Ask which components are automated and how, how pipeline versions are recorded against issued reports, and what evidence exists for the automated stage's performance.

Unusually candid disclosure, and one question that candour cannot resolve. The privacy policy states plainly that the company collects de identified patient data, that it collaborates with researchers and drug developers, that resulting discoveries may have commercial value and may be owned by the company or its collaborators, and that de identified variant data may in some instances be collated and transmitted to a third party for commercial purposes.

Very few companies write that sentence, and writing it lets a family understand the arrangement before consenting rather than discovering it afterwards. Real consent architecture sits alongside: an opt out of research contact, a separate research consent required for research release, and participation in an external variant matchmaking platform made an explicit opt in with a stated yes or no. The scale is published too, drawn from millions of tests with parental data in most cases, and the company states that every test makes the dataset stronger, so clinical testing feeds the commercial asset by design.

The question candour cannot resolve is whether de identification means much here. In rare disease genomics the combination of an unusual phenotype and an unusual variant is frequently unique to one person in the world, so the uniqueness that makes the data valuable for discovery is exactly what makes re identification tractable: the value and the risk are the same property. Parental data compounds it, since relatives are in the dataset having consented to a child's test. Ask which method is applied and who assessed re identification risk for rare phenotypes.

Among the deepest evidence positions in the index, and it is external rather than self reported. Peer reviewed publications include a benchmarking study in the American Journal of Human Genetics and SeqFirst data in the American Journal of Medical Genetics showing rapid genome sequencing as a first tier test in pediatric and cardiac intensive care significantly increases diagnostic rates and halves time to diagnosis.

The American Academy of Pediatrics updated guidance in June 2025 to recommend exome and genome sequencing as first tier tests for children with global developmental delay or intellectual disability, which is guideline level validation of the modality. Graded on the existence and venue of the evidence; this index does not re verify the underlying studies.

Unusually candid disclosure, and one question that candour cannot resolve.

What is disclosed. The company states plainly in its privacy policy that it collects de identified patient data, that it collaborates with researchers and drug developers, that resulting discoveries may have commercial value and may be owned by the company or its collaborators, and that de identified variant data may in some instances be collated and transmitted to a third party for commercial purposes. Very few companies write that sentence. It also offers an opt out of research contact, requires a separate research consent for research release, and makes participation in an external variant matchmaking platform an explicit opt in with a stated yes or no.

The scale of what accumulates is also published: a dataset drawn from over 2.5 million tests, close to a million exomes and genomes, more than 7 million phenotypic data points, and parental data in over sixty percent of cases. The company states that every test makes the dataset stronger, so clinical testing feeds the commercial asset by design.

The question candour cannot resolve is whether de identification means much here. In rare disease genomics the combination of an unusual phenotype and an unusual variant is frequently unique to one person in the world. That uniqueness is exactly what makes the data valuable for discovery and exactly what makes re identification tractable. The value and the risk are the same property. Parental data compounds it, since relatives are in the dataset having consented to a child's test.

Ask which de identification method is applied, who assessed re identification risk for rare phenotypes, and what a family receives if a discovery becomes a product.

The most complete disclosure on this axis in the index, and it is complete because the company publishes the instruments rather than describing them.

As a clinical laboratory receiving specimens on a physician's order and returning results, this company is a health care provider transmitting health information electronically, which makes it a covered entity in its own right rather than a business associate of anyone. Obligations attach directly and are enforceable against it by the regulator rather than flowing through a customer contract.

What distinguishes this record from others in the same position is that it publishes what a covered entity is required to provide and what most never post. A notice of privacy practices is published in full, naming both the health privacy rule and the act that extended obligations to business associates. A patient facing informed consent form is published, explaining the test, the meaning of a variant of uncertain significance, and the handling of relative samples in trio testing. A separate authorisation form for release of patient data is published, and it states that release for research purposes requires a distinct research consent rather than the same signature.

That last separation matters more than it appears. Consent to be tested and consent for data to be used in research are different decisions, and collapsing them is the most common failure in this sector. This company keeps them apart on paper.

A counterparty should still confirm the terms governing the ordering institution's own relationship, since a laboratory being a covered entity does not resolve what flows back to the ordering provider's systems.

No SOC 2, HITRUST, ISO 27001 or equivalent information security attestation and no trust centre were located.

The distinction this index applies throughout the diagnostics lane applies here. The company operates accredited clinical laboratories, and laboratory accreditation is demanding and real. It examines analytical validity, proficiency testing, personnel qualification and specimen handling. It examines no part of information security, and the estate at issue is not only the laboratory: it is a genomic dataset drawn from millions of tests, a provider portal, a patient portal, and the pipelines connecting them.

A route exists that was not exhausted in this pass and is recorded rather than relied upon. The company is listed on a United States exchange, so its annual report must describe its processes for assessing and managing cybersecurity risk, board oversight and accountable management. That item was not retrieved here, and nothing in this row rests on it. It should be read before anyone treats this grade as settled.

The holdings make the gap consequential in a specific way. Genomic sequence cannot be reissued. A compromised payment card is replaced; a compromised genome is compromised permanently, and it discloses information about the patient's parents, siblings and children, most of whom were never asked.

Ask what independent security examination exists and what it covers, how the dataset is protected and segregated from operational systems, and who inside the company can access identified sequence.

ExomeDx and GenomeDx hold FDA Breakthrough Device designation, and the company consistently describes it as designation rather than clearance or approval, which is the correct distinction and one that is frequently blurred elsewhere. Held back from A because the current regulatory pathway for the tests as marketed, and the timeline for any submission, were not disclosed in the retrieved materials.

No governance framework, model documentation or performance disclosure was located, and this domain has a specific, well characterised inequity that nothing on the record addresses.

Variant interpretation works by comparing a patient's sequence against reference population databases and curated evidence about what particular changes mean. Those references are predominantly derived from people of European ancestry. The consequence is documented across clinical genetics: patients of non European ancestry receive a variant of uncertain significance far more often, because their variation is less likely to have been observed and classified before. The test runs identically, the laboratory performs correctly, and the family gets an inconclusive answer rather than a diagnosis.

That makes it a governance question rather than a technical one, and it is directly measurable. A laboratory of this scale knows its diagnostic yield and its uncertain variant rate, and it could report both by ancestry group. Nothing located does.

The company's own asset is relevant to the remedy as well as the problem. It describes its dataset as the largest of its kind, and a dataset is the mechanism by which uncertain variants become classified ones. Whether that resolution is happening evenly across populations, or whether it compounds an existing advantage, is the question a health system serving a diverse population should ask before assuming equal benefit.

Ask for diagnostic yield and uncertain variant rates broken down by ancestry, what is being done to close any gap, and how reclassification over time is communicated to families who received an inconclusive result.

The data asset is described in unusual quantitative detail and the technology acting on it is not described at all. On the asset the company publishes real magnitudes covering millions of tests, close to a million exomes and genomes, millions of phenotypic data points and parental data in most cases, which are checkable numbers rather than adjectives.

On the technology there is nothing: no model or method named, no architecture, no account of how candidate variants are prioritised, no evaluation, no versioning, and no statement of how a pipeline change is validated or communicated. Versioning deserves particular attention here and its absence is more consequential than usual, because interpretation is not a fixed function.

As the reference dataset grows and classifications change, the same input sequence can produce a different report, and a family's result can move from uncertain to diagnostic or the reverse. A clinician relying on this needs to know which pipeline version produced a given report, so that a result issued years earlier can be understood in the terms that produced it rather than compared against today's output as though the two were commensurable.

Without that, a reinterpretation looks like a contradiction rather than an update. No warranty, indemnity or remediation commitment attaches. Ask which components are automated and how, how pipeline versions are recorded against issued reports, what triggers reinterpretation, and what evidence exists for the automated stage's performance.

Inbound integration is described specifically, which is the direction that matters most for this product.

The company states that its interpretation approach pulls in electronic health record data, health information exchange data, literature and genomic evidence to build a full picture of a case. That is a substantive claim and the right one, because genomic interpretation is phenotype driven: the same variant means different things depending on the patient's clinical features, and the quality of a rare disease diagnosis depends heavily on how completely the phenotype is captured. A laboratory that can draw structured clinical information from the record and an exchange rather than relying on whatever the ordering clinician typed onto a requisition form is doing something materially better than the category norm.

A provider portal exists for ordering and results, and a patient portal carried over from a predecessor organisation gives patients access to their records and consent preferences.

Held at B rather than A because no interoperability standard, named record platform integration or interface documentation was located, and because the return path is less clear than the inbound one. A genomic report is a long, structured document that behaves badly in most record systems, and whether results arrive as discrete coded findings a system can act on later, or as a document a clinician must read, determines whether a reclassified variant can ever be surfaced against that patient again.

Ask what standards are supported in each direction, and how results are represented in the ordering system.

No hosting location, region, tenancy, retention schedule or subprocessor list was located.

The physical side is clear enough by inference, since testing is performed in the company's own accredited laboratories, and specimens are shipped rather than transmitted. The computational side, which is where the durable exposure sits, is undescribed.

Three questions follow from what this company holds rather than from a generic checklist.

Retention of raw sequence is the first. A genome is expensive to produce and permanently informative, so the incentive is to keep it, and reanalysis as knowledge improves depends on keeping it. How long raw data, aligned sequence and derived variant calls are held, and whether a family can request destruction, are questions the published consent and authorisation forms should be read against.

The second is separation. The clinical pipeline that produces a patient's report and the research dataset that supports discovery and commercial collaboration are different uses of the same underlying material, and how they are separated technically determines what a collaborator can reach.

The third concerns residual specimens. Blood and tissue remain after sequencing, and their storage, use and destruction are governed separately from the data.

Ask for the retention schedule across specimen, raw sequence and derived data, the separation between clinical and research environments, and the subprocessor register.

Test prices are not published, but the commercially decisive information for a health system is, in unusual detail: Medicaid coverage for exome or genome sequencing in the pediatric outpatient setting across 38 states, and for rapid genome sequencing in the NICU across 17. For a reimbursement funded diagnostic, coverage breadth by state determines whether the test is orderable for a given patient far more than list price does. That disclosure is more useful than a rate card would be.

Clearly bounded and specifically enumerated across the care continuum: rare disease diagnosis in pediatric outpatient settings, NICU and PICU via ultraRapid sequencing, prenatal via GenomeDx Prenatal, and newborn screening through the BEACONS initiative. Each product states its intended population rather than claiming general applicability.