GenHealth.ai

GenHealth's current agents interpret documents, learn operational workflows and carry out tasks across websites, fax and telephone. Intake extraction, policy matching, authorization preparation and billing depend on learned models, even when the approved execution path later runs deterministically. Customers demonstrate their workflows and grant the agent its own access, then review test executions before autonomous operation.

The company also offers human billing support, but software automation is available as its own product. Removing the models would remove the interpretation and workflow learning that distinguish the current offer, leaving only predefined task execution and manual services.

Workflow deployment begins with reviewed test executions and a shadow period in which staff assess outputs. Routine work can later run autonomously, with exceptions retained by the team. For authorization, clearly satisfied policy criteria can support approval recommendations, while potential denials must go to a licensed clinical reviewer. Decisions include policy citations and disagreement can inform a later model version.

This is a defined oversight structure, but the numerical acceptance threshold and complete stop or rollback conditions are unspecified. Claims about consistent execution describe the workflow design; the product also acknowledges errors through human review and correction responsibilities.

The current architecture combines language models, document extraction, policy interpretation and an agent that learns customer workflows before executing approved steps. OpenAI is named as an AI API subprocessor, identifying at least one supplier in the model layer. The Guidehealth implementation explains how policies are structured with language processing and human review.

It does not establish exact model versions or an update discipline for today's browser, voice and authorization agents. The older DOOG E predictive model described in general terms is a different application. Its research cannot establish the model configuration or validation of the current operational products.

The trust center names OpenAI for AI API processing, AWS and Vercel for hosting functions, and Auth0 for identity. This identifies a model supplier as well as infrastructure providers, making the chain more specific than a generic reference to third parties. The list does not explain which current workflows use each model, the precise model versions or provider specific retention and training terms.

The BAA binds PHI subcontractors to equivalent obligations but does not replace those technical processing details. Research on a proprietary historical model also does not establish that current browser and voice workflows avoid external model services.

The July 2025 Guidehealth case describes a named utilization management deployment handling 700 to 1,700 cases weekly after a four month implementation. It explains policy ingestion, escalation logic and comparison with human review, reporting more than 90% agreement and roughly one hour less review time for skilled nursing cases. Projected annual savings across an expanded rollout reach about $1.2 million; these are forecasts rather than realized collections.

The report has operational method and a named setting but no independent evaluation or controlled comparison. Piedmont's separate collections result concerns revenue cycle work and does not validate every authorization decision.

The BAA limits PHI use to authorized purposes, permits certain internal analysis and product development uses, and requires return or destruction after termination on written demand, subject to infeasibility exceptions. That destruction provision includes backups, while disclosure accounting records have a separate six year requirement. Security controls include encryption and restricted access.

The current public material does not provide a complete retention schedule for prompts, extracted records, call transcripts or model outputs. Nor does it specify model provider training and retention terms. These contractual safeguards are meaningful without establishing a blanket prohibition on all secondary model related processing.

A complete public BAA identifies GenHealth as a business associate, applies on account creation or acceptance of PHI services and requires subcontractors to accept equivalent obligations. It includes access, amendment, incident reporting and return or destruction provisions. The agreement also states that its PHI terms take precedence over conflicting underlying terms.

However, the linked general terms still describe a synthetic data beta and prohibit patient information through the API, while the current product handles live administrative workflows. The BAA is substantive, but the boundary between beta access and production service terms is not presented consistently across the public contract documents.

GenHealth states that an independent auditor issued a SOC 2 Type II attestation and makes the report available to customers on request. The security policy names Cobalt Labs for annual penetration testing across production web applications, APIs and networks, and describes continuous control monitoring through Vanta. The trust center exposes control categories and a subprocessor list.

These are specific assurance signals, but the confidential report's period, exceptions and detailed scope are not available in the public account. HIPAA compliance is a separate assertion. The listed controls do not by themselves show that every current AI workflow falls within the same assessment boundary.

The present commercial focus is healthcare administration, including policy matching, authorization recommendations, eligibility and reimbursement. Its authorization workflow distinguishes approval recommendations from adverse determinations that require licensed clinical review, with source clauses available for inspection. No FDA clearance is attached to this operational offer.

The general terms disclaim medical advice and retain language about an earlier predictive patient simulation product, which does not define the current agents' clinical scope. The available product description supports administrative decision assistance rather than an independently cleared diagnostic or treatment function. Coverage decisions still require the stated professional oversight and applicable customer policy.

The authorization design includes medical director oversight, continuous agreement monitoring and policy citations, with alignment claimed to NCQA utilization management standards and URAC processes. A demonstration panel gives an agreement statistic, but does not identify the evaluated cohort, model release or sampling method. The Guidehealth report adds a real implementation account without subgroup fairness results.

These controls describe a governance approach rather than an independently audited AI framework. Performance across patient demographics, clinical complexity and payer populations remains unspecified, as do release approval and rollback procedures. Security attestation does not establish the fairness or appropriateness of authorization recommendations.

Authorization decisions include policy citations, and the full service billing offer includes specialists who review and correct AI mistakes. Those mechanisms provide traceability and a practical review route inside the service. The general terms nevertheless disclaim accuracy warranties and any promise to correct defects, with liability limited by the contract.

The BAA provides indemnity for breaches of its PHI obligations, which is distinct from reimbursement loss caused by an incorrect output. No general output guarantee or defined customer remedy reconciles these positions. The public account supports review and correction work without a clear allocation of liability for a harmful recommendation.

GenHealth names applications including Epic, Cerner, Brightree, NikoHealth and WellSky, and describes working through customer created accounts to read records and complete administrative actions. The DME implementation plan specifically uses existing platform and fax access, while the authorization offer also describes FHIR based interfaces. These are named integration paths with declared operational use.

They do not establish a verified bidirectional marketplace integration for each EHR in the catalog. A long application list includes possible workflows as well as concrete implementation examples, so support depth varies. Version compatibility, writeback safeguards and recovery after interface changes are not specified uniformly.

The security policy identifies AWS infrastructure services for encryption keys, secrets and production access. The trust center also lists Vercel for the web application frontend and Auth0 for identity. Customers access a hosted service whose agents operate inside their existing applications; granting an account in an EHR does not mean the model runs in that EHR's environment. Public region commitments, tenant isolation details and a complete cross border processing map are not supplied.

Customer hosted or on premises alternatives are also unspecified. The available architecture identifies several providers without resolving residency for clinical inputs, transcripts, outputs and backups.

Workflow automation is aligned to processing volume, with scope defined around the tasks being automated. A free sandbox lets users explore intake, eligibility and authorization flows before a production engagement. The cost calculator includes a configurable AI cost per order, but its example amounts are scenario inputs rather than a binding price list. Production rates, minimum commitments and a complete package schedule are not given.

Full service revenue cycle management adds human billers and therefore represents a different commercial scope from software alone. Savings percentages and projected administrative savings describe benefits, not the fee payable for either offering.

The current offer serves providers, durable medical equipment suppliers, revenue cycle teams and health plans. Named examples include Piedmont Medical Solutions for collections and Guidehealth for utilization management. The Guidehealth report provides the clearest operational detail for skilled nursing authorization review, with broader behavioral health and substance use applications described as extensions rather than established results.

Intake, eligibility, resupply and billing cover a wider administrative range than that case study alone. The product can operate across many specialties and applications, but equivalent accuracy and benefit are not demonstrated for every workflow, care setting or payer policy.