Imprivata Patient Privacy Intelligence
Imprivata Patient Privacy Intelligence (PPI) is Imprivata's patient privacy monitoring product, formed by merging the former FairWarning and Maize Analytics products; Imprivata's wider business is identity and access management for healthcare. PPI watches access to protected health information across the record system and other applications, using behavioral baselines, anomaly detection and machine learning for risk scoring, and explanation-based auditing that ties an access to a reason, such as an encounter or appointment, and surfaces what it cannot explain. The datasheet says it can review 99 percent of the access log and present the remaining 1 percent. It keeps searchable audit trails for three years, offers more than 100 reports and an investigations portal, integrates with Imprivata's access management products, and can be run by Imprivata's managed privacy service. It runs on the Imprivata Access Intelligence Platform, alongside Imprivata Drug Diversion Intelligence.
Imprivata publishes a business associate agreement that covers every customer, a Responsible AI Transparency Report describing how its models are built and evaluated, and ONC health IT certification for Access Intelligence; it states SOC 2 Type 2, ISO 27001 and ISO 27701 certification for PPI. Named customers include Tampa General Hospital and Memorial Healthcare System. Pricing is per unique user ID for each monitored data source, with no rate published.
Where PPI is hosted, which record systems it connects to, and its alert precision are not published. Ask for these before comparing it with other privacy monitoring products.
Capability Axes
Imprivata Patient Privacy Intelligence, often shortened to Imprivata PPI, is a patient privacy monitoring product that detects inappropriate access to electronic medical records. It was formed by merging two established products in the category, FairWarning and Maize Analytics, and is indexed under the product scoping rule: Imprivata's wider identity and access management business would not qualify on AI centrality, while this product's AI is identifiable and gradeable. Its method inverts how privacy auditing is normally done. Conventional tools hunt the access log for suspicious behavior; this one first tries to explain each access against a legitimate clinical or operational reason such as an appointment, an encounter, a diagnosis code or a departmental relationship, then flags only the residue it cannot account for. The AI Health Index grades it B on AI Centrality, B on Clinical and Operational Evidence, B on Model and Technology Transparency and B on AI Governance and Bias Disclosure. Verified as of Sep 30, 2026.
An AI Health Index grade measures what a buyer can verify from public sources on the date shown. It is not a rating of how good the product is. A vendor can build an excellent system and grade low on an axis because it publishes nothing an outsider can check. How grades read
The models drive the detection module of a wider audit platform. Imprivata says Patient Privacy Intelligence (PPI) monitors access to protected health information "using behavioral analytics, anomaly detection, and machine learning", with AI-driven risk scoring and explanation-based auditing that matches accesses to a reason and surfaces the rest; the product's datasheet says it can "review 99% of the access log, presenting you with the 1%".
Imprivata's Responsible AI Transparency Report (January 2025) describes models trained on historical data with cross-validation and explanation features across its portfolio. Around the models sit complete searchable audit trails with three years of archived storage, more than 100 reports, an investigations portal, identity integration with Imprivata's access management products and a managed privacy service, which carry value without them. PPI merges the former FairWarning and Maize Analytics products.
Human decision is stated as the rule; the threshold for clearing an access automatically is not. Imprivata's Responsible AI Transparency Report says its models "are not intended to replace human decision-making", that products require "the customer to configure their risk tolerance and ultimately make any decisions regarding the anomalies identified", that "The AI requires human oversight and feedback to take action", and that users can see the factors behind a risk score.
The system does act on the bulk of the log: the datasheet says PPI can review 99 percent of the access log and present the remaining 1 percent, so accesses the system explains are cleared without a person looking at them. Nothing published says how an explained access is sampled or checked, or what happens when an inappropriate access is explained away.
The approach and the development method are described; the models are not identified. Imprivata's Responsible AI Transparency Report (January 2025) names the data the models use (record diagnoses, medications, encounters and appointments; employee title, department and care team; access logs; patient age, location and orders), and describes the method: anonymization and standardization, feature engineering, algorithm selection per application, training on historical data with cross-validation and tuning, and evaluation on separate validation sets for accuracy, precision, recall, F1 and ROC area, with explanation features that show the factors behind a prediction.
The PPI page adds behavioral baselines, workflow variance and frequency signals, and explanation-based auditing. No model, version or release record for PPI's models is published, and the figures those metrics produce are not given.
A short chain at the model layer: the models are Imprivata's own. The Responsible AI Transparency Report describes Imprivata developing, training and evaluating its models on customer healthcare data it anonymizes and standardizes first, with no outside model provider named or described. The business associate agreement requires any agent or subcontractor that receives protected health information to implement safeguards. The hosting of PPI and the Access Intelligence Platform is not described; a data processing addendum is listed on the legal page, and no subprocessor list appears on the product or trust pages.
Published research on the method, short of an evaluation of the product sold. The explanation-based approach PPI inherits from Maize Analytics comes from Daniel Fabbri and Kristen LeFevre's "Explanation-Based Auditing" (Proceedings of the VLDB Endowment, volume 5, 2012), which explained over 94 percent of accesses in a University of Michigan Health System access log; Fabbri founded Maize. That paper evaluated a research system on one log, not PPI, and Imprivata's pages do not cite it.
The current datasheet says PPI can review 99 percent of the access log and present 1 percent, without method. Named customers include Tampa General Hospital, Memorial Healthcare System and a Mid-Atlantic health system, whose quotes carry no figures; the Memorial CISO's "risks have been decreased to near zero" describes the customer's outcome. No independent evaluation of PPI's alert precision or of how often it misses inappropriate access is published.
Retention, de-identification and return are stated; training use is not. PPI keeps complete searchable audit trails with three years of archived storage. Imprivata's business associate agreement has it return or destroy protected health information at the end of the services on the covered entity's request, or extend the agreement's protections where that is not feasible.
The Responsible AI Transparency Report says data is "cleaned, anonymized, and standardized before being fed into the model" and that encryption and anonymization protect patient privacy, and that models are trained on historical data, without saying whether one customer's data trains models used for others. Nothing is published on guardrails, how an erroneous alert that harms an employee is handled as a safety event, or other safety engineering.
The full agreement is published, and business associate status is stated. Imprivata's legal page carries a Business Associate Agreement between the customer as covered entity and Imprivata, Inc. as business associate, which takes effect when the covered entity installs any Imprivata software and so applies to every customer rather than to a tier.
It requires Imprivata to ensure that any agent, including a subcontractor, to whom it provides protected health information agrees to implement reasonable and appropriate safeguards, to report security incidents, and to return or destroy protected health information at the end of the services. PPI ingests record access logs, encounters, diagnoses and employee data, and the product page positions its audit trails for HIPAA compliance. Whether a given PPI contract incorporates this published agreement is not stated.
Recognized certifications are named for the product, without the reports. The PPI page says the product "is SOC 2 Type 2, ISO 27001, and ISO 27701 certified"; Imprivata's trust and security page lists ISO/IEC 27001:2022, ISO/IEC 27701:2019, Cyber Essentials and Cyber Essentials Plus and SOC 2 attestation, and the Responsible AI Transparency Report says Imprivata products hold SOC 2 Type 1 and Type 2 reports from an external auditor. No report, certificate, date or auditor is published and no portal releases them. The platform PPI runs on, Imprivata Access Intelligence, is also ONC certified, which tests its security features.
No device claim, and a credential under the health IT regime. PPI is privacy monitoring software for covered entities, with no FDA clearance and none claimed. It runs on the Imprivata Access Intelligence Platform, which is certified under the ONC Health IT Certification Program: Access Intelligence version 26, certification 15.02.05.1485.ACCS.09.09.0.260326, 26 March 2026, for criteria 170.315(b)(10), (d)(1), (d)(3), (d)(5), (d)(12), (d)(13), (g)(4) and (g)(5), with real world testing plans and results for 2025 posted. The Responsible AI Transparency Report names HIPAA, GDPR and the EU AI Act as the regimes the portfolio complies with.
A published framework with named process, and no subgroup results. Imprivata's Responsible AI Transparency Report (January 2025) covers the products' AI: data sources, development and evaluation steps, the metrics monitored (accuracy, precision, recall, F1, ROC area), explanation features, stated limitations (data quality, interpretability, clinical context), a commitment to identify and mitigate bias related to gender, ethnicity, socioeconomic status and other factors using fairness-aware machine learning and bias correction, and accountability and configurability principles.
It is written for healthcare professionals, regulators and other stakeholders and applies across the portfolio, PPI included. No results are published for PPI, and nothing shows how false alerts fall by role, department, shift or employee group, which is where a model that scores people is most likely to be unfair.
Explanations let a privacy team examine an alert; nothing stands behind the output. PPI shows the factors behind a risk score and its explanation-based auditing gives context for an access, and investigations are tracked in a portal.
The Responsible AI Transparency Report says the models "are not infallible", that "ultimate responsibility for decisions remains with the consumer of Imprivata products", and that "Any errors or issues are promptly addressed and corrected", which names no remedy, measure or process. No accuracy or false alert rate is published, and no route lets an employee flagged by PPI see or contest the basis.
Integration with record and HR systems is claimed with none named. The PPI page says the product "integrates with Imprivata Enterprise Access Management, EHRs, and HR systems to create a single, unified identity for each user", and the Responsible AI Transparency Report lists the record data the models use (diagnoses, medications, encounters, appointments, orders).
The product page, the January 2024 datasheet and Imprivata's integrations page name no record system or HR platform for PPI, and no customer is shown running a named connection. The ONC certification of the Access Intelligence Platform covers export of electronic health information from it, not integration with a record system.
Nothing published says where PPI runs or where its data rests. The product page, the January 2024 datasheet, the Access Intelligence Platform appendix (which includes "unlimited storage for Customer's retained active and archived data") and the ONC disclosures describe storage but not its location, host or tenancy; Imprivata's trust page says only that it protects data across product use "in the cloud and on-premises" for its products generally. The virtual machine deployment inside the customer's environment described for the former Maize Analytics product is not described for PPI.
No price, and the unit of charge is published. The Access Intelligence Platform appendix to Imprivata's Master License and Services Agreement says a base subscription covers one Imprivata data source with unlimited storage and is priced on the number of unique user IDs in that source, with fees rising by the same percentage if the count grows during the term and a 30 day window to dispute the recount.
The PPI page adds that costs can rise if the number of applications monitored, the user base or the data volume grows beyond the contract's initial scope. No rate or tier is published. A managed privacy service is sold alongside.
Coverage is named, with validation behind part of it. PPI is sold to hospital and health system privacy officers, security teams and compliance specialists for proactive and reactive auditing of record access, with an optional managed privacy service. Named customers are Tampa General Hospital and Memorial Healthcare System, with a Mid-Atlantic health system unnamed; the datasheet says organizations in over 45 countries use Imprivata's privacy monitoring. No setting beyond hospitals and health systems, such as clinics or physician groups, is shown running it.
Citable summary
Self contained paragraphs, free to quote with attribution. Grades shown resolve from this record and change when it is regraded.
What Imprivata PPI is, and the method that makes it unusual
The AI Health Index records Imprivata Patient Privacy Intelligence as one of the few products in healthcare where the underlying method is published, peer reviewed and patented rather than described in marketing terms. The approach, inherited from Maize Analytics, is called explanation based auditing. Rather than searching an access log for high risk behavior, it attempts to explain every access by matching it to a legitimate reason, then surfaces only what it cannot explain, which leaves a far smaller pool for human review than trying to spot suspicious patterns directly. The original research came out of the University of Michigan and reported explanations for more than ninety four percent of accesses in a real health system log, and the company reports automatically auditing up to ninety nine percent of record accesses in production. That published lineage is the reason this record grades near the top of the index on method transparency and evidence. Verified as of Sep 30, 2026.
Source: AI Health Index, Sep 30, 2026
How Imprivata PPI grades on the AI Health Index, and where it is thin
The AI Health Index grades Imprivata Patient Privacy Intelligence at the top of the scale on B AI Centrality, B Clinical and Operational Evidence, B Model and Technology Transparency, B AI Governance and Bias Disclosure, B AI Safety and PHI Stewardship, B Autonomy and Oversight Model and D Deployment Model and Data Residency, verified as of Sep 30, 2026. That is one of the strongest disclosure records in this index, and the bias grade is especially rare: almost nothing in healthcare AI earns the top grade on that axis. Where it is thin is commercial: C on Commercial Transparency and B on Security Certifications and Trust Center, so a buyer will establish price and attestations through a sales conversation rather than from published material.
Source: AI Health Index, Sep 30, 2026
Common questions
What is Imprivata PPI?
Imprivata PPI stands for Imprivata Patient Privacy Intelligence, a patient privacy monitoring product that detects inappropriate access to electronic medical records across a health system. It was created by combining two established products in this category, FairWarning and Maize Analytics, following a chain of acquisitions in which Maize Analytics was acquired by SecureLink and SecureLink by Imprivata. Rather than hunting an access log for suspicious behavior, it explains each access against a legitimate clinical or operational reason and flags only what it cannot explain. The AI Health Index indexes it in healthcare cybersecurity with secondary placement in healthcare administrative automation, scoped to the privacy monitoring product rather than to Imprivata's wider identity and access management business, and grades it across fifteen capability axes with the date of last verification published on the record.
How does explanation based auditing work?
It reverses the usual direction of privacy auditing. A conventional tool looks through the access log for behavior that appears risky, which means a reviewer is working from a list of suspicions in a log too large to check exhaustively. Explanation based auditing instead tries to account for every access by matching it to a legitimate reason, such as an appointment, an encounter, a diagnosis code or a departmental relationship between the staff member and the patient's care. What remains unexplained is what a human reviews. The method originated in peer reviewed academic research at the University of Michigan, is patented, and the original paper reported explanations for over ninety four percent of accesses in a real health system log. The AI Health Index grades the product B on Model and Technology Transparency as of Sep 30, 2026 on the strength of that published method, which very few vendors in this index can match.
How does Imprivata PPI compare to Protenus?
They are the two established products in patient privacy monitoring and they approach the same problem from opposite ends, which is the useful distinction rather than a feature comparison. Imprivata Patient Privacy Intelligence explains accesses and reviews the unexplained residue. Protenus, whose privacy product is now sold as PrivacyPro following its acquisition by Bluesight, builds behavioral profiles on both sides of an access event using record system, human resources and dispensing cabinet data, and monitors every access and medication transaction rather than a sample. The AI Health Index does not rank vendors into a single order and grades both on the same fifteen axes so a health system can compare on the line it is buying. On published method the Imprivata product is the stronger record; on breadth across privacy and drug diversion in one platform the Protenus lineage is the wider one.
Does Imprivata publish pricing for Patient Privacy Intelligence?
Not in a form a buyer can act on before a sales conversation. The AI Health Index grades it C on Commercial Transparency as of Sep 30, 2026, which is its weakest axis and sits in sharp contrast to how much it publishes about its method. Privacy monitoring is usually priced against system size or access volume, so the questions to settle are what the unit is, how the price moves as the estate grows or as facilities are acquired, and whether drug diversion monitoring is a separate line.
Does Imprivata Patient Privacy Intelligence pay to be listed on the AI Health Index?
No. The AI Health Index is researched from public sources, no vendor pays for inclusion, for a grade or for placement, and every record carries the date it was last verified. A vendor that publishes more is regraded and the change is logged.
Alternatives to Imprivata Patient Privacy Intelligence
Vendors in the same categories as Imprivata Patient Privacy Intelligence whose graded profiles look most alike, with a line on what each product does.
Similar is not the same, so check that each one does the job you need. No vendor pays for placement.
Asimily sells an exposure management platform for connected devices (medical devices, IoT, OT and IT endpoints), with hospitals and health systems as its founding market and customers in…
Medication and compliance intelligence company whose two surveillance products watch hospital staff for insider risk: ControlCheck, formerly Bluesight for Controlled Substances, for drug…
Censinet sells Censinet RiskOps, a risk management platform built for hospitals and health systems.
ORDR (formerly styled Ordr) sells connected device security for healthcare, manufacturing, finance, government and other sectors, built around turning device intelligence into enforced…
Haystack iS is iatricSystems' patient privacy monitoring software for hospitals and health systems, formerly Security Audit Manager.
Armis sells Armis Centrix, a cyber exposure management platform covering IT, OT, IoT, medical devices, cloud and code.
Ordered by how closely the graded profiles match across the fifteen axes, inside the same categories. See how each axis is graded in the methodology.
Compared With
Each comparison carries a written verdict, the buyer conditions that favor each vendor, and a graded side by side. Pairs that cross a category boundary are grouped separately, and their verdicts state where the boundary sits rather than manufacturing a head to head.
Pricing
Vendor-published figures are labeled as such. Figures labeled “Estimated” are derived from third-party sources and have not been confirmed by the vendor.
| Entry Price | Pricing Basis | BAA Tier | Implementation | Source |
|---|---|---|---|---|
|
Not published
|
Subscription on the Access Intelligence Platform: a base subscription per Imprivata data source, priced on the number of unique user IDs in that source, with unlimited storage; fees rise with the user count. No rate published. | Published Business Associate Agreement, effective for any covered entity that installs Imprivata software. | Not published. Managed privacy services are sold separately. | Vendor Published |
No rate or tier is published. The Access Intelligence Platform appendix to Imprivata's Master License and Services Agreement sets the unit: a base subscription for each Imprivata data source monitored, priced on the number of unique user IDs in that source and including unlimited storage for retained and archived data. If the user count rises during the term, recurring fees rise by the same percentage for the rest of the term, after a 30 day window to dispute the recount. The PPI page adds that costs can grow if more applications are monitored, the user base grows or data volume exceeds the initial scope.
Two things to settle. The rate per user ID and how each additional application beyond the first data source is priced. And, if the managed privacy service is in scope, what analyst time it buys.