Imprivata Patient Privacy Intelligence

Graded on the privacy monitoring product per the product-scoping rule, not on Imprivata's identity and access management business, which would not qualify. Within that scope the machine learning does the decisive work: the Explanation-Based Auditing System uses patented ML algorithms, US 8745085B2, to build explanations tailored to each organisation's own data, matching accesses against legitimate clinical and operational reasons drawn from encounters, appointments, ICD-10 codes and departmental relationships, and the system learns over time to improve accuracy.

There is no manual rule set that could substitute; the explanations are organisation-specific and derived. Same AI-necessity logic that earned Protenus an A, since auditing 100,000 to one million accesses per minute is unreachable by human review.

The most thoughtful oversight posture in this sub-lane, and it is stated as guidance to customers rather than as a product claim. The company explicitly told organisations to spend significant time VALIDATING the system's results after implementation, and only after validating the data and building trust in the system should they roll back their own daily manual monitoring.

A vendor instructing customers not to trust it immediately, and to keep parallel manual review running until they have verified it themselves, is the opposite of the usual incentive. The architecture is also inherently conservative: it automates the disposal of EXPLAINABLE accesses and escalates the unexplained residue to a human privacy officer, so automation reduces the reviewer's workload rather than making accusations.

The strongest transparency position of any vendor in the cybersecurity category, and stated as a principle rather than demonstrated incidentally.

The founder said directly that the technology is not a black box, that the community can read the research papers, which had been cited over 50 times, and that the aim is to communicate the inner workings so end users understand the system's strengths and limitations. Third party coverage confirms a principled and transparent implementation approach in which the mechanism is disclosed to clients so compliance officers understand how it works. The underlying method is publicly readable in the original University of Michigan paper and in patent US 8745085B2.

Publishing your limitations alongside your capabilities is the standard this axis should be graded against.

The architecture answered this axis rather than a policy doing it, and one corporate event puts a question mark over whether that still holds. The product ran inside a virtual machine within the customer's own environment specifically so that data does not leave the organisation, which for a system ingesting complete record access logs, encounter records, diagnosis codes and employee directories is the correct design and inverts the exposure most privacy monitoring vendors carry, where the platform aggregating a health system's most sensitive audit data sits in vendor infrastructure.

The method is separately readable in a named academic paper and a granted patent, so the analytical component is not a black box either. Held below the top grade because of the merger rather than because of a disclosure gap. A buyer should confirm the deployment model persisted through the acquisition, since a shift to vendor hosted delivery would materially change this assessment, and nothing located describes the current chain post merger, including whether the acquiring group's infrastructure or personnel now sit anywhere in the path.

That is the parent group question this index applies to any acquired product. Ask whether the in environment deployment is still offered, what the hosted alternative involves, and for a sub processor list under current ownership.

The only vendor in this category with genuine peer reviewed academic validation of its core method. The Explanation-Based Auditing research was developed and published at the University of Michigan by Daniel Fabbri and Kristen LeFevre, evaluated against a real access log from the University of Michigan Health System, and reported explanations for over 94 percent of accesses, with the work cited more than 50 times. Founder Daniel Fabbri held an assistant professorship at Vanderbilt.

Independent recognition followed in production: Maize was ranked Best in KLAS for patient privacy monitoring in 2021, and a joint presentation with Nationwide Children's Hospital documented the transition from manual auditing to automated monitoring. Peer review, third party ranking and a named health system account together exceed anything else in this lane. The caveat is temporal rather than substantive: much of this evidence predates the merger into Imprivata PPI, so buyers should confirm which capabilities carried over.

Resolved architecturally rather than by policy, which is the strongest form. Maize ran inside a virtual machine within the customer's own environment specifically so that data does not leave the organisation, which for a system ingesting complete EMR access logs, encounter records, diagnosis codes and employee directories is the correct design.

That inverts the exposure other privacy monitoring vendors carry, where the platform aggregating a health system's most sensitive audit data sits in vendor infrastructure. Buyers should confirm the deployment model persisted through the merger into Imprivata PPI, since a shift to vendor-hosted delivery would materially change this grade.

HIPAA compliance is the product's purpose, generating complete searchable audit trails and reports demonstrating documented compliance with three years of archived storage, which is the artifact an organisation needs for an Office for Civil Rights inquiry. Graded B rather than A because no BAA terms were located, though the in-customer-environment deployment model reduces what a BAA would need to cover.

Converted from Not Rated, and the prior note anticipates a distinction this index has since had to make twice more.

No attestation scoped to this product was located. No SOC 2 of either type, no HITRUST, no ISO 27001 and no product specific trust material was retrieved.

The corporate parent is a large established healthcare identity and access vendor and may well hold certifications. This index does not read those across, for the same reason it does not credit a cloud provider's attestations to software running on it, and the same reason it declined to credit a parent's certifications to a newly acquired imaging product elsewhere in this pass. A certification covers named systems, locations and processes assessed at a point in time. A product is inside that scope only when it has been brought inside it.

That caution is more pointed here than usual because of the lineage. This product is the combination of two previously separate companies' offerings, one of which passed through two acquisitions before arriving. Each transition is a point at which systems, hosting and processes may or may not have been folded into the acquirer's certified estate, and nothing public traces that path.

The deployment architecture is a genuine mitigation and belongs here: the software runs in a virtual machine inside the customer environment, so the data does not leave. That reduces what an external attestation would need to cover, though it does not eliminate the question.

Ask for product scoped evidence naming this system, not corporate level assurance.

Converted from Not Rated. The prior scoping was correct and this product's relationship to the regime is direct.

No device pathway applies. Privacy auditing sits outside software as a medical device. What governs is the health privacy and security rules, breach notification obligations and readiness for federal civil rights enforcement audits, and the product exists to serve exactly those duties.

What lifts this above a bare scoping note is the approach, which changes what compliance can realistically mean. Conventional auditing hunts for suspicious behaviour in the access log and, because manual review cannot scale, examines a small sample. The explanation based method inverts it: each access is first matched against a legitimate clinical or operational reason such as an appointment, an encounter, a diagnosis code or a departmental relationship, and only the residue that cannot be accounted for is surfaced. The peer reviewed origin paper reported explanations for over 94 percent of accesses in a real health system log, and the company reports automatically auditing up to 99 percent of record accesses in production.

That matters regulatorily rather than merely technically. An obligation to monitor access is discharged very differently by sampling a fraction than by accounting for nearly all of it, and this is one of the few products in the index where the method demonstrably changes the compliance posture rather than the workload.

Ask what happens to the unexplained residue, who reviews it, and what standard applies before an employee is investigated.

The best governance position among the four workforce-surveillance vendors indexed, above Haystack at B and Protenus and Bluesight at C, and it follows from the architecture rather than from stated policy. Because the system works by EXPLAINING accesses rather than by detecting anomalous behaviour, it does not build behavioural profiles of individual clinicians and does not flag people for being statistically unusual.

That structurally avoids the central failure mode of anomaly detection in this domain, where a clinician whose legitimate practice differs from a peer group is flagged for being different rather than for wrongdoing. What surfaces is an access the system could not tie to a legitimate reason, which is a claim about evidence rather than about the person.

The transparency commitment to publish limitations and the instruction to customers to validate results before trusting the system both reinforce this. Graded A on design and disclosure; no formal fairness audit or published false positive rate was located, which is why buyers should still ask.

The route into this band is published method combined with an explicit commitment to publishing limitations, which is unusual enough to state as the reason for the grade. The underlying technique is publicly readable in the original academic paper and in a granted patent, and the founder stated directly that the technology is not a black box, that the community can read the research, and that the aim is to communicate the inner workings so end users understand the system's strengths and limitations.

That last clause is the part that matters. Most vendors that publish do so to demonstrate capability; committing to publish limitations is a different undertaking, and it is the standard this axis should be graded against because a buyer needs to know where a system fails more than they need to know that it works. Third party coverage confirms that the mechanism is disclosed to clients so compliance officers understand how it works, which is the right audience for it.

Held below the top grade because no accuracy or precision figure with methodology was located and no warranty, indemnity or remediation commitment exists. The affected party is also a named clinician, since a flag initiates an investigation into inappropriate record access, and nothing describes what an investigated employee is entitled to see about why they were flagged. Ask for precision at the operating threshold, and for the employee facing disclosure.

The data model is the notable part: the system ingests access logs alongside patient-hospital encounters, appointment records, ICD-10 codes and employee department listings, because explanation requires knowing the clinical and organisational context that would make an access legitimate. That is a richer and more purposeful ingestion set than a pure access log feed.

Imprivata also cites improved identity integration as a benefit of the merger, which is coherent given the parent's identity management business. Graded B rather than A because no named EHR integration list was located for the merged product, where Haystack enumerates more than 180 vendor connections.

Virtual machine deployment inside the customer environment, explicitly so no data leaves the organisation, which is the strongest data residency position available and matches the reasoning that earned Circle CVI and Mendel credit elsewhere in this index. Scales elastically with allocated resources from small private practice to international health system, auditing 100,000 to one million accesses per minute, with multiple instances able to share a workload. Buyers should verify this model survived the merger into Imprivata PPI, since the grade rests on it.

No pricing published and no pricing basis disclosed for Patient Privacy Intelligence. The merger adds a further question buyers must resolve: whether the product is licensed standalone or bundled with Imprivata's broader identity and access management platform, since a privacy monitoring purchase that pulls in a wider suite is a materially different commitment. Nothing on that is public.

Scales across organisation sizes from small private practice to international health system, and supports both proactive auditing to uncover risk before harm and reactive auditing to investigate incidents and complaints, which are genuinely different workflows serving privacy, compliance and investigations functions.

Graded B rather than A because coverage is one risk domain, patient privacy, without the diversion surveillance Protenus and Bluesight provide or the device security breadth elsewhere in this category.