Infinitus Systems

The agent is the product and there is no plausible non-AI version. Automating a payer phone call requires speech recognition, IVR navigation, real-time dialogue with a human agent, and structured extraction from an unstructured conversation. The knowledge graph of payer-specific rules is a substantive proprietary asset rather than a scripted decision tree, since it encodes which questions each individual insurer requires. Critically there is no offshore call centre underneath, which is exactly what separates this from the outsourced verification services it displaces.

Genuinely autonomous on the task, with a disclosed human boundary. The agent independently dials, navigates IVR, holds, converses and extracts structured data, but anything AMBIGUOUS routes to a human reviewer before the result is finalised. That is a clearly stated escalation rule rather than a vague human-in-the-loop assurance, and it places the human at the point of uncertainty rather than as a blanket review of everything.

The company describes safety-first AI with robust human and technology guardrails and a healthcare-specific guardrail architecture launched April 2025. The Lens conversation-review engine, covering both AI-led and human-led interactions, adds a retrospective audit layer, which is the natural complement to real-time escalation.

The architecture is described more concretely than most: a knowledge graph of payer-specific rules driving question selection, a patented architecture that routes tasks to the most performant available model rather than committing to one, and named components including the Eva agent and FastTrack copilot. Model-agnostic routing is an honest design disclosure.

Graded B rather than A because no accuracy figures with stated methodology were located, and the frequently cited 50 percent ROI and cost-per-claim improvements are vendor or directory figures without disclosed measurement basis.

The exposure here is distinctive and the company has built controls aimed at it rather than at data at rest alone. Recognised attestations are held, and the guardrail architecture is healthcare specific by design, with an ambiguity escalation rule and a review engine both addressing the failure mode that matters: the agent discloses patient identifiers to payer representatives over the telephone in order to complete verification, so the risk is not only what is stored but what the agent says aloud and to whom.

Most vendors in this index secure a database; this one has had to think about a spoken disclosure to a third party call centre, which is a control problem with no encryption analogue, and building escalation and review around it is the right response. Held below the top grade because the lifecycle is unaddressed: no published retention policy for call recordings or transcripts, and no statement on whether call data trains models.

Both matter more here than usual, since a verification call produces a recording at the payer's end as well, which this vendor does not control. Note for the roster: a second vendor record exists in this index under a different slug for what appears to be the same company, and the two carry different material. That should be reconciled rather than left as two entries. Ask for recording retention on both sides and the training position.

Not a clinical product, so this reads as operational evidence, and it is all vendor generated. Millions of calls handled, 44 percent of the Fortune 50, 125,000 providers and a typical 50 percent ROI are scale and outcome claims with no independent audit, named customer result or disclosed methodology.

Third party directories note limited public user reviews because enterprise customers rarely post to G2 or Capterra, so independent corroboration is genuinely scarce rather than merely absent. Same standard applied to Candid Health and QuantHealth: specific numbers without methodology remain vendor claims.

HIPAA and SOC 2 attestations held, and the guardrail architecture is healthcare-specific by design with the company stating conversations stay fully compliant. The PHI surface here is distinctive and worth naming: the agent discloses patient identifiers to payer representatives over the phone in order to complete verification, so the risk is not only data at rest but what the agent says aloud and to whom. The ambiguity-escalation rule and the Lens review engine both address that. Graded B rather than A because no published retention policy for call recordings or transcripts was located, and no statement on whether call data trains models.

HIPAA attestation reported by independent third party review alongside SOC 2. Graded B rather than A because no BAA terms or execution process were located in published form.

SOC 2 Type II, with the type stated by the company itself rather than left ambiguous, which is the distinction that carries the assurance weight and which many vendors in this index blur.

What lifts this above a bare claim is the scope disclosure. The company enumerates the control areas the audit covered: governance and policies, employee background checking, risk management, asset management, access control, data encryption at rest and in transmission, firewall rules, penetration testing, intrusion detection, performance monitoring, logging and vendor management. Very few vendors in this index publish what was actually examined rather than only the certificate, and it lets a buyer see that penetration testing and vendor management were in scope without having to ask.

Held at B rather than A because this is a single framework. No ISO 27001 or HITRUST certification is claimed, and there is no trust centre or self serve route to the report, so obtaining it still requires a request. The vendors graded A here hold a second independent framework alongside SOC 2. This note replaces an earlier one recording that the report type could not be determined; the company states it plainly.

No FDA clearance applies and none is expected. The voice agents automate payer phone work, benefit verification and prior authorisation follow up, and none of that diagnoses or treats.

The governing regime is postmarketing drug safety, and this is one of the few vendors in the index that names its own regulatory surface rather than leaving a buyer to infer it. A large share of its customers are pharmaceutical manufacturers running patient support and direct to patient programmes, and its agents now conduct side effect check ins, symptom management and adherence outreach directly with patients. A manufacturer that receives an adverse event report is required to forward it to the FDA, so an autonomous agent speaking to patients on a manufacturer's behalf becomes an intake channel for a mandatory reporting duty. Infinitus built a dedicated component for this, SAGE, which uses natural language processing with a human in the loop, and publishes the specific failure mode it had to solve: broad language models over detect, reading unrelated phrases as safety signals. Its Lens product, announced May 2026, scores AI led and human led conversations on the same criteria and flags protocol deviations and unreported adverse events.

Held at B rather than A on two gaps. No detection performance figure is published for adverse event capture, so a buyer cannot tell what share of reportable events the system catches, and under capture is the failure that matters here. And the outbound patient calls reach the Telephone Consumer Protection Act, where the FCC ruled in February 2024 that AI generated voices are artificial voices requiring prior express consent and identification of the entity responsible for the call. Payer calls are business to business and sit outside that consumer framework. Patient calls do not. Nothing published states where that consent comes from.

No governance framework, subgroup analysis or bias evaluation located. The guardrail architecture addresses compliance and accuracy rather than equity. Two exposures worth naming that are specific to this product class: the agent must be understood by human payer representatives across regional accents and call quality, and separately, an unresolved disclosure question is whether payer representatives are told they are speaking with an AI agent, which located materials do not address. That is a transparency issue with regulatory implications in several states, not merely an ethical preference.

The architecture is described more concretely than most in this segment. A knowledge graph of payer specific rules drives question selection, a patented architecture routes each task to the most performant available model rather than committing to one, and individual components are named.

Model agnostic routing is an honest design disclosure and a useful one, because it tells a buyer that no single model's characteristics describe the system, that performance may shift as the routing changes, and that the vendor has taken on the job of deciding which model handles what, which is a real engineering responsibility rather than a procurement convenience.

A rules knowledge graph driving question selection is equally informative, since it means the agent's line of questioning derives from something inspectable rather than from a model's judgement about what to ask. Held below the top grade because nothing is measured with a stated method.

No accuracy figures with disclosed methodology were located, and the frequently cited return and cost per claim improvements are vendor or directory figures without a measurement basis, so a reader cannot tell what was compared against what. No warranty, indemnity or remediation commitment attaches.

Ask which models serve which task types today, how routing changes are notified, the rate at which returned benefit data is later found wrong, and what the agent does when a payer representative gives an ambiguous answer.

Strong and deliberately built as infrastructure. Call outcomes are converted into structured data written back into downstream provider, payer, hub, specialty pharmacy and manufacturer workflows, which is the whole point since an unstructured phone result has no operational value. Salesforce integration spans Health Cloud, Life Sciences Cloud, Agentforce and MuleSoft-connected workflows.

The company also launched a healthcare-focused MCP server in September 2025 for AI agent interoperability, which is an unusually forward interoperability move, and Infinitus Studio provides a no-code builder so customers can compose their own agents. Same infrastructure-to-build-on posture that earned CertifyOS and Candid Health an A.

No hosting provider, region, tenancy model or data residency commitment was located, and no subprocessor list is published.

What can be established indirectly is that a reviewed infrastructure exists. The company's SOC 2 Type II announcement enumerates the audited control areas and they include data encryption at rest and in transmission, firewall rules, intrusion detection, performance monitoring, logging and vendor management. That confirms infrastructure and third party controls were examined. It does not say where any of it runs, and an audit scope is not a residency disclosure.

One deployment question is specific to this product and should be asked directly. The platform generates and retains call audio and transcripts of conversations with payer representatives, and separately with patients on the direct to patient side. Telephony introduces infrastructure the vendor may not own, since carriage and recording frequently sit with a third party provider. Establish where call audio is processed and stored, who the telephony subprocessor is, and whether recordings can be confined to a stated region, because that is the part of the estate least likely to be covered by assumptions about the application tier.

No pricing published. Third party directories state pricing is custom, enterprise-focused, and scoped to deployment size, call volume and workflows automated. The enterprise orientation carries acknowledged access consequences, with independent review noting longer sales cycles and higher contract minimums that make the platform less accessible to mid-market practices and smaller billing companies. So the buyer profile is narrower than the problem it solves, which affects many organisations too small to purchase it.

Unusually broad across both workflow types and customer classes. Call types span benefit verification, prior authorization follow-up, claim status, EOB retrieval, appeals, formulary exception follow-up, provider directory verification and missing documentation collection. Customer classes span providers, payers, pharmaceutical manufacturers, biotech, specialty pharmacies and digital health, and 2026 expansion added health plan member services.

The platform materials now cover access, affordability, adherence, patient, provider and payer workflows. Serving both sides of the payer-provider phone call is a wider footprint than any other RCM vendor in this index.