Hyro

Conversational agents are the entire product, and the company has built for healthcare exclusively since 2018 rather than adapting a general platform, which shows in the architecture.

Agents act autonomously on scheduling, registration, routing, and prescription refills, with the stated design principle that contextual transfer to a live human enhances rather than replaces staff, and full interaction capture in a dashboard for review. Held back from A because the transfer trigger criteria are not published: knowing that escalation exists matters less than knowing when it fires, particularly for prescription related requests.

The clearest architectural disclosure among the voice agent vendors in this index. The company describes a specific hybrid: large language models combined with a proprietary conversational engine, small language models tuned for healthcare, and purpose built knowledge graphs.

That composition is a substantive engineering claim rather than a capability boast, and it explains the control argument, since a knowledge graph constrains what an agent can assert in a way an unconstrained model does not. Buyers can interrogate a stated architecture; they cannot interrogate a black box.

The architecture narrows the paths structurally, which is real, and no party in the chain is named, which in this segment is the gap that matters most. On the credit side, personally identifiable and protected health information are redacted from conversations, and the model may only draw on data sources the customer has defined and approved, so the routes by which patient data can reach an output are constrained by design rather than by policy alone, and per response source traceability means an inappropriate disclosure can be traced to where it came from.

That is a better structural position than most voice vendors hold. On the gap, no sub processors are disclosed, and this is the segment where that omission bites hardest: a single patient call typically traverses a telephony provider, a speech recognition provider and a speech synthesis provider before reaching the model, so a health system that has diligenced the vendor has diligenced one party out of four.

A peer in this same segment publishes exactly that list, which establishes the disclosure is possible. No retention period for call recordings or transcripts is published, nothing states whether patient conversations inform model development, and residency options are mentioned only by third parties. Ask for the sub processor list, retention on audio as distinct from transcripts, the training position and residency in contract.

Adoption is substantial and independently corroborated: more than 45 to 50 US health systems, over 30 million patients engaged, and named clients including Intermountain, Baptist Health, and Hackensack Meridian. Bon Secours Mercy Health invested as a long standing client, which is a stronger signal than a logo since an existing customer put capital behind the relationship. Selection to Fierce Healthcare's 2026 Fierce 15 is third party recognition.

Held back from A because the operative metric, up to 85 percent resolution of routine interactions, is vendor stated without a definition of routine or a published measurement method, and containment definitions vary widely across this category.

The design does real work here. Personally identifiable and protected health information are redacted from conversations, and because the model may only draw on data sources the customer has defined and approved, the paths by which patient data can reach an output are narrowed by architecture rather than by policy alone. Explainability compounds this: each response can be traced to the sources that produced it, so an inappropriate disclosure can be diagnosed rather than guessed at.

Held below the top of the band because the lifecycle questions are unanswered. No retention period is published for call recordings or transcripts, nothing states whether patient conversations inform model development, and no sub processors are disclosed, which matters in voice because a single call typically traverses telephony, speech recognition and synthesis providers before reaching the model. Data residency options are mentioned only by third parties. Worth securing retention, training use and residency in contract.

HIPAA compliance is asserted consistently across the company's materials and, more usefully, is backed by a stated technical control rather than left as a claim: personally identifiable and protected health information are redacted from conversations. Knowledge sources are described as HIPAA compliant, and the platform performs identified patient actions through Epic including record identification and updating, which is a meaningful test of the posture rather than a peripheral one.

Held below the top of the band because the contractual half is absent from the company's own publishing. No business associate agreement is named or described, no HIPAA documentation or attestation is offered, and the accompanying SOC II claim omits its type. Third party reviews report that business associate agreements are executed with all healthcare customers, which is encouraging but is not a vendor statement. Worth confirming BAA availability and terms directly, along with which sub processors in the voice path are covered.

Thin relative to the rest of the company's disclosure. The only certification claim on its own materials is a single line stating SOC II compliance, with no type specified, alongside stated GDPR and CCPA compliance. There is no trust center, no security page, no certificate, no penetration testing statement and no sub processor list; the footer carries a privacy policy, terms, a cookie policy and an end user licence agreement.

Omitting the SOC 2 type is the most common disclosure failure this index encounters, and it matters because a Type I report tests whether controls were designed appropriately at a point in time while a Type II tests whether they operated effectively over a period. Third party review sites report a Type II alongside encryption at rest and in transit, role based access control, audit trails and single sign on, but a review site is not a vendor claim and cannot carry the grade. Worth asking for the report itself and confirming the type.

Patient access and administrative automation rather than a diagnostic product, so no FDA clearance applies and none is claimed. Against the frameworks that would govern it, some real engagement exists: HIPAA, GDPR and CCPA are named, compliance is framed as adapting to evolving regulation rather than as a fixed state, and one capability addresses coverage loss under the Affordable Care Act and Medicaid, which is a genuine regulatory workflow rather than a generic feature.

What is missing is any mapping to a recognised framework. Nothing connects the platform to HIPAA Security Rule safeguards as a structure, to health sector cybersecurity performance goals, or to recognised practice standards. Two capabilities also deserve a scope question rather than an assumption: prescription refill handling and intent based routing both sit near boundaries where administrative automation can become clinical. Worth asking what the agent is explicitly prohibited from assessing and how clinical escalation is triggered.

One of the more substantive governance positions in this category, and unusually it is architectural rather than declarative. A dedicated responsible AI resource sets out three named pillars. Explainability is the strongest: because responses are drawn from a controlled knowledge graph rather than open generation, each conversation can be unpacked to identify which knowledge sources produced a given answer, which allows the root cause of a wrong output to be found and the underlying data corrected.

Control follows from the same design, with the customer defining and restricting which sources the model may draw on. Quantitative claims are published where most competitors publish none: a 96 percent accuracy rate, ten times fewer hallucinations, and 78 percent more resolutions. Held below the top of the band because none of those figures carries a methodology, baseline, sample size or measurement period, and ten times fewer than what is not stated.

There is no AI management system certification, and no performance breakdown by language or accent despite multilingual and community health positioning. Worth asking for the measurement behind each figure.

Two design properties give a reviewer something to work with. The architecture is stated as a composition rather than a black box, combining large language models with a proprietary conversational engine, small language models tuned for healthcare and purpose built knowledge graphs, and that composition supports the control argument directly: a knowledge graph constrains what an agent can assert, because an answer must correspond to something in the graph rather than to whatever the model finds plausible.

Alongside it, each response can be traced to the sources that produced it, so a wrong or inappropriate answer can be diagnosed rather than guessed at, and a health system can determine whether the fault was the source, the retrieval or the generation. Buyers can interrogate a stated architecture; they cannot interrogate a black box. Held at C because nothing is measured.

No accuracy figure, containment rate, task completion rate, escalation rate or evaluation methodology was located, and no warranty, indemnity or remediation commitment. Containment matters most for a patient facing line, because a system that handles a call badly rather than handing it to a person produces a patient who did not get what they rang for and does not appear in any failure count. Ask for containment and escalation rates, what triggers a handoff to a human, and the accuracy of intent recognition on clinical topics.

Integration is the stated differentiator and the claim is specific: direct API connections into leading EHRs including Epic and into CRMs, allowing agents to complete tasks such as booking an appointment or refilling a prescription rather than only answering questions. The company also cites multi modal data ingestion across websites, call centers, SMS, and apps. Completing the transaction rather than routing it is what separates this tier from IVR replacement.

A vendor hosted cloud service that layers over existing systems rather than replacing them, and speed of deployment is the stated advantage, with go live described in days rather than months. Beyond that the published detail is absent. No hosting provider is named, no cloud region is specified, no tenant isolation model is described, and there is no customer hosted option.

United States only storage and processing is reported as available by third party reviews but is not stated in the company's own materials, which is the sort of commitment a buyer should not take second hand. The gap carries extra weight in voice, because the call path crosses telephony and speech providers before reaching the model and each of those is a location where audio exists. Worth establishing where calls are processed, where recordings and transcripts are stored, how long they persist, and whether a region can be fixed contractually.

The same shape seen across this category: return is published, price is not. No pricing, pricing metric or contract structure appears anywhere, and third party reviews describe enterprise level pricing set by organisation size, call volume and implementation scope, which a buyer cannot model without a rate. What the company does offer is more than most.

A public return on investment calculator lets a prospective buyer estimate time and cost savings before contact, and a published benchmark report sets out call centre performance standards against which a deployment can be measured. Outcome claims are specific and attributed, including call containment above 85 percent, a customer reporting roughly one million dollars in automation savings, and another reporting 47 percent more appointments booked online.

That is a genuine attempt at commercial argument. It stops short because the calculator models benefit without a cost input reflecting actual pricing, so the return side is visible and the investment side is not. Worth establishing the pricing metric early.

Coverage is organised by institution type rather than by clinical specialty, which is a genuine strategic difference from competitors in this category and worth understanding before comparing. Named solutions exist for health systems, federally qualified health centres with multilingual support, children's hospitals, and payers, with the payer side covering member and agent experience rather than only patient access.

Deployment spans voice, chat, SMS, web and mobile applications from a single agent, and the company reports use across more than forty five health systems. Held below the top of the band because no specialty specific capability is described. Competitors enumerate the scheduling protocols, provider rules and intake logic that differ between orthopaedics, oncology or women's health; here the differentiation is by organisation and channel instead. For a system whose hardest calls are specialty scheduling, that distinction matters. Worth asking how specialty specific scheduling rules are configured and who maintains them.