Inovalon

The clearest example in this index of a company whose scarce asset is data rather than inference.

The registry is the business. More than 160 primary sources, coverage across all fifty states, tens of billions of medical, pharmacy and laboratory events, and a federal designation permitting access to complete Medicare fee for service data for defined purposes. That position took two decades and a great deal of contracting to assemble, and it cannot be replicated by a competitor with better models. Analytics sit on top of it and are valuable because of what they run on.

Inference does real work within that frame. Predictive analytics underpin star rating products, and an artificial intelligence assisted record review capability introduced in 2024 reads clinical documentation to support the risk adjustment process, which is a genuine language task performed at volume. Across more than 100 solutions there are certainly others.

The judgement is nonetheless straightforward. Remove the models and a company holding one of the largest longitudinal healthcare datasets in the country, with connectivity into electronic health record systems and exchanges nationally, still has a formidable business. Remove the data and the models have nothing distinctive to run on.

Graded C, consistent with the other platform records in this lane. The pattern is now consistent enough across the category to be a finding in itself: in value based care intelligence the differentiating asset is almost always the data, the content or the contract knowledge, and the inference is a layer.

Ask which solutions depend on inference rather than aggregation and reporting, and what performance the record review models achieve.

Advisory throughout, with the human role clearly located in the one product where automation reaches furthest.

Nothing described here acts on a patient. Quality measurement computes and reports, analytics surface findings to plan and provider staff, revenue cycle and workforce products support administrative processes, and life sciences data supports research. Outputs land in front of people who decide what to do with them, and the decisions taken are organisational rather than clinical.

The record review capability is the one to examine and it is positioned correctly. Software that reads clinical documentation to support risk adjustment is described as enhancing the efficiency of a review process, which places it as an aid to a reviewer rather than a replacement for one. That distinction carries weight in this particular application, because a diagnosis code submitted for payment must be supportable by documentation and a human attestation sits behind the submission. Keeping a person in that loop is both good design and, in practice, a regulatory necessity.

What is not described is the quality of the review rather than its existence. Whether a reviewer sees the evidence the model relied on, whether disagreements are captured, and what proportion of suggestions are accepted are not addressed in material located. A reviewer who cannot see why a condition was proposed is approving rather than reviewing, and in a payment context that difference is the whole point.

Graded B for a consistently advisory posture with the reviewer's actual visibility unstated.

Ask what evidence a reviewer sees alongside each suggestion and whether overrides are recorded.

The rules based half of this platform is externally validated to a standard nothing else in this lane matches, and the machine learning half is undocumented.

The validated half deserves genuine credit. Quality measure logic has been certified annually by the body that governs quality measurement for twenty six consecutive years, and the digital quality measure engine holds separate validation from the same body. Measure certification is algorithmic examination: an external party checks that the software produces the correct result from defined inputs against a published specification. That is a stronger form of transparency than a vendor describing its own methods, and it is renewed rather than granted once. For the products where correctness is defined by a specification, this record is exemplary.

The unvalidated half is everything driven by inference. A dedicated pass located no model card, no accuracy or calibration figure, no validation methodology, no retraining cadence and no drift monitoring account for the predictive analytics behind star rating products or for the artificial intelligence assisted record review introduced in 2024. The base model behind the review capability is not named.

The distinction between the two halves is not published either, which matters across a portfolio of more than 100 solutions. A buyer cannot tell which products compute a specified result and which produce a model output, and those warrant entirely different scrutiny.

Architecture is described at a reasonable level, with a platform layer, connectivity, primary source data and analytics named as components, and one product publicly identified as running on a named cloud database platform.

Graded C. Ask which solutions are model driven, what accuracy the record review achieves, and what base model it uses.

For a company whose principal asset is assembled data, the data supply chain is the supply chain, and it is disclosed only in aggregate.

The registry is described as informed by more than 160 primary sources spanning all fifty states. That count is a scale claim rather than a disclosure. None of the 160 is identified, no category breakdown between health plans, providers, laboratories, pharmacies and clearinghouses is published, and the terms under which data flows from any of them are not described. A buyer therefore cannot assess what the dataset over represents or under represents, which is the question that determines whether an analysis built on it is sound. The one source identified precisely is the federal Medicare fee for service data accessed under Qualified Entity designation, which is genuine and covers one component.

Infrastructure disclosure is partial and better than most. One product line was publicly described in February 2026 as scaling on a named cloud database platform, which identifies a dependency for that product. Nothing covers the remainder of a portfolio exceeding 100 solutions.

The model layer is closed. The base model behind the artificial intelligence assisted record review is not named, so a buyer cannot determine whether an external provider processes clinical documentation, what it retains, or what happens if a version is deprecated.

No sub processor register was located, and none of the acquired businesses now inside the portfolio has a published component inventory.

Graded D.

Ask for the composition of the source base by category, the sub processor register, and the model behind record review.

The strongest evidence record in this lane, and almost all of it was produced by bodies with no commercial interest in the answer.

The certification history is the substance. The quality product earned its twenty sixth consecutive annual measure certification from the National Committee for Quality Assurance in July 2026, alongside validation of its digital quality measure engine. Twenty six consecutive years is a different category of evidence from a current credential. It means the measure logic has been submitted for external examination every year for a quarter of a century, through repeated changes to the measure specifications, and has passed each time. Nothing else encountered in this category approaches that as a longitudinal demonstration that the software computes what it claims to compute.

Independent customer assessment corroborates it. The same product took the 2026 category award for quality measurement and reporting analytics in a research firm's annual report, which is derived from structured interviews with customers rather than vendor submissions.

Adoption evidence is stated in checkable form. More than 100 health plans use the quality product, described as representing a majority of enrolment in four star and above Medicare Advantage plans. Company material states relationships with all fifteen of the largest health plans, all twenty five of the largest provider systems and twelve of the fifteen largest global pharmaceutical companies, each footnoted to a published ranking so a reader can identify the universe being claimed.

Federal designation as a Qualified Entity adds an assessment by a regulator rather than a market.

What this evidence is not is clinical outcome evidence. No peer reviewed publication and no controlled outcome study was located, and the case rests on certification, validation and adoption rather than on demonstrated patient benefit. Graded A because on the operational half of this axis the record is exceptional and externally verified.

The central stewardship question here is not model training. It is what permits data collected in one relationship to be sold into another.

The company operates two businesses that touch the same data. In the first it processes clinical and claims information as a business associate on behalf of health plans and providers, to compute quality measures, support risk adjustment and run operations. In the second it licenses data and analytics to pharmaceutical and life sciences customers, offering extracts with one, three and five year longitudinal lookback periods drawn from a registry assembled from more than 160 primary sources.

The relationship between those two businesses is the question a buyer should be able to answer from published material and cannot. What contractual permissions allow information contributed by a health plan or a provider to inform a commercial research asset, whether contributing organisations are compensated or merely consenting, what de identification standard is applied and by what method, and whether contributing organisations may decline are all unaddressed in anything located.

Re identification risk is not hypothetical at this scale. Longitudinal records spanning years across medical, pharmacy and laboratory events, linkable across sources, are among the most re identifiable data structures that exist, because a small number of dates and events uniquely distinguish a person. A five year lookback extract is a strong identifier before any name is attached.

One constraint is documented and worth crediting. The federal Qualified Entity designation carries statutory limits on permitted uses of Medicare data, which is genuine external governance over one portion of the estate.

Model training questions remain unanswered in the ordinary way alongside all of this.

Graded D on disclosure. Ask what permissions govern secondary use, what de identification standard is applied, and whether contributing organisations can decline.

A compliance posture with more independent examination behind it than any other record in this lane, and no contractual terms published.

The control evidence is broad. The company states certification under the healthcare assurance framework and the payment card industry data security standard, and says it issues annual and periodic service organisation control reports of both the first and second type at the operating effectiveness level. Holding financial and healthcare assurance credentials simultaneously reflects a business that processes payment card data alongside clinical records, which is unusual and appropriate given the pharmacy and revenue cycle lines.

The federal designation carries statutory obligations rather than voluntary ones. Qualified Entity status under the Centers for Medicare and Medicaid Services programme grants access to Medicare data under defined conditions with defined permitted uses and reporting requirements, so a portion of this company's data handling is governed by rules it cannot negotiate and is examined by a party that can withdraw the access.

What is absent is every term a buyer would negotiate. No template business associate agreement, breach notification window, liability cap position, audit rights statement, subcontractor flow down provision or data return clause was located.

Scale sharpens one point. An organisation holding identified data for hundreds of millions of lives sourced from thousands of upstream organisations is a concentration point of national significance, and nothing published describes how obligations flow back to contributing organisations when something goes wrong.

Ask for the template agreement, the breach notification window, and how obligations flow to contributing data sources.

The broadest credential set in this lane, published in the thinnest possible form.

The credentials themselves are strong and unusually varied. The company states certification under the healthcare assurance framework and the payment card industry data security standard, and says it issues annual and periodic service organisation control reports of both the first and second type at the operating effectiveness level. That combination covers healthcare controls, payment card handling, financial reporting controls and operating effectiveness over time, which is a wider span than any other record in this lane holds, and it fits a business that runs pharmacy and revenue cycle operations alongside analytics. Reports at the operating effectiveness level are what health system and health plan procurement processes actually request.

The disclosure is where this falls short of the top grade, and the contrast within this lane is instructive. Health Catalyst publishes which certification covers which named product, with framework versions and explicit coverage periods, so a buyer evaluating one application can confirm that application is in scope. Here the entire security posture appears as a short paragraph on a company values page. No certification dates, no framework versions, no scope statement, no indication of which of more than 100 solutions are covered, and no trust centre or portal where current attestations could be retrieved without asking.

Scope is the material gap given the portfolio. A credential covering the core platform tells a buyer of an acquired pharmacy or provider product very little, and nothing published resolves it.

Graded B on the strength of the credentials, held below the top by disclosure that requires a buyer to ask for everything.

Ask which solutions are in scope for each credential, the certification dates, and whether a trust portal exists.

Correctly outside device regulation, and more affirmatively regulated than any other record in this lane.

Quality measurement, risk analytics, revenue cycle operations, workforce management and research data licensing are administrative, financial and analytical functions rather than diagnosis or treatment, so no clearance is required and none is claimed.

What distinguishes this record is the regulatory weight the company does carry, which is affirmative rather than merely absent. Qualified Entity designation under the Centers for Medicare and Medicaid Services is a federal status granted under defined conditions, permitting access to Medicare data for specified purposes and carrying reporting obligations, and it can be withdrawn. Measure certification from the body that governs quality measurement has been renewed annually for twenty six consecutive years, and the digital quality measure engine holds separate validation from the same body. State quality programmes add further regulated reporting.

That combination means a substantial portion of what this company does is examined by parties with authority over it, on a recurring schedule, in programmes where the output determines payment. Most vendors in this category are unregulated in every direction. This one is unregulated as a device and closely governed everywhere else.

Graded B rather than higher because the newest capability sits outside that framework. An artificial intelligence assisted review that proposes diagnosis codes for risk adjustment operates in an area of sustained federal enforcement attention across the Medicare Advantage industry generally, and nothing located describes how the tool is constrained to documentation supported findings.

Ask what constrains record review output to documented conditions and what audit trail supports each suggestion.

The largest data asset in this lane, the most consequential application of it, and no published examination of either for bias.

A dedicated pass located no published bias testing, no subgroup performance figures, no fairness review process, no model documentation and no statement of what any model takes as its target variable.

Three exposures are specific to this business. The first concerns quality measurement, where measure results determine star ratings and payment. If underlying data capture is systematically less complete for some populations, measure performance reflects documentation quality rather than care quality, and plans serving those populations are scored down for a data artefact. At the scale described, where the products serve plans covering a majority of enrolment in higher rated Medicare Advantage plans, small systematic effects move very large sums.

The second concerns risk adjustment. Models that read documentation to surface conditions will perform according to how thoroughly conditions were documented in the first place, and documentation thoroughness varies by setting, by language and by how much time a clinician had. A model that captures more where records are richer directs more revenue toward organisations already better resourced.

The third concerns the research data business. Datasets assembled from insured populations under represent the uninsured and under represent people with intermittent coverage, and analyses built on them inherit that shape. Where such data informs trial design or treatment effectiveness research, the omission propagates into clinical evidence rather than staying in an operational report.

Graded D. A data asset of this consequence carries a correspondingly high obligation to describe its own limitations, and nothing located does.

Ask what subgroup analysis has been performed on measure and risk models, and what population coverage limitations are documented for the registry.

Recourse is undefined at every point, and the exposures this platform creates are larger in absolute terms than anything else in this lane.

A dedicated pass located no indemnification position, no warranty covering model or analytic output, no accuracy guarantee, no service credit regime and no described route to dispute an output.

The scale is what distinguishes this record. A quality measurement error moves a star rating, and a star rating moves bonus payments across an entire Medicare Advantage plan membership. The products are stated to serve more than 100 health plans representing a majority of enrolment in higher rated plans, so a systematic defect in measure computation would not be one customer's problem but a market event.

Risk adjustment carries a different and sharper exposure. Diagnosis codes submitted for payment must be supportable by documentation, and submissions that are not supportable expose the submitting plan to recovery, penalty and enforcement action. That liability lands on the plan, which made the submission, rather than on the vendor whose software proposed the code. Medicare Advantage risk adjustment has been the subject of sustained federal enforcement attention across the industry, so this is a live commercial risk rather than a theoretical one, and nothing published describes how responsibility is allocated between a plan and a vendor whose tool surfaced a condition that documentation did not support.

A third exposure sits in the research business, where a licensed dataset with an undisclosed limitation could inform a study conclusion, with no described remedy for a customer who relied on it.

Graded D. Ask for the indemnification position on quality submissions and on record review output, and what warranty attaches to licensed data.

Connectivity at national scale, corroborated by a federal designation and by twenty six years of standards work.

The intake position is exceptional. More than 160 primary sources feed the registry, spanning all fifty states and covering medical, pharmacy and laboratory events, with connectivity described into electronic health record systems and health information exchanges nationally and access to data in real time rather than in batch. Sources at that number are not integrations built one at a time for one customer, they are a standing national collection apparatus.

The federal designation is the corroboration that matters most. Qualified Entity status permits access to complete Medicare fee for service data for defined purposes, which is granted to organisations that can demonstrate they can receive, protect and correctly use data at that scale. It is an assessment of data handling capability by the party with the most at stake.

Standards depth is separately demonstrated. Computing certified quality measures requires structured clinical data in specified formats with defined value sets, and passing that examination annually for twenty six consecutive years, plus validation of a digital measure engine, evidences data fidelity that no integration count could establish. Fidelity and volume are different achievements and this record has both.

Breadth of consumption follows: one platform serves payer, provider, pharmacy and life sciences use cases from the same substrate, reached through a single sign on portal across more than 100 solutions.

What is not described is the return path. Whether findings write back into clinical systems, and how patient identity is resolved across 160 sources, are not addressed in material located.

Graded A. Ask how identity is resolved across sources and whether integrations are bidirectional.

Cloud delivery is established and one infrastructure dependency is publicly identified, with the questions a security review asks left open.

What is known is real. The company describes itself as a provider of cloud based platforms, solutions are reached through a single sign on portal, and in February 2026 it publicly described scaling its specialty and infusion pharmacy product on a named cloud database platform. That last item identifies at least one infrastructure dependency by name, which is more than most records in this lane offer.

The open questions are the significant ones. Whether customer data occupies a dedicated tenancy or a shared environment with logical separation is not stated, and the question has unusual weight here because the same organisation operates a data licensing business, so the boundary between a customer's operational data and the company's own data asset is precisely the boundary a buyer needs described. Geographic residency is not addressed and no region selection is described.

Continuity is absent from the public record. No recovery objective, availability commitment or failover description was located, for infrastructure carrying quality reporting that determines payment, revenue cycle transactions and pharmacy operations. Pharmacy operations in particular are time critical in a way analytics are not, since a system unavailable for a day is a day of dispensing and billing that did not happen.

The portfolio raises a final question. More than 100 solutions assembled partly through acquisition may sit across several architectures, and nothing describes whether a customer buying from two lines is buying one deployment or two.

Ask whether tenancy is dedicated, how operational data is separated from the data asset, and what availability commitment each product line carries.

Cost is absent from every published surface. A dedicated pass located no pricing page, no unit of charge, no range, no tiering, no implementation fee position and no minimum commitment.

Scale makes the omission harder to defend rather than easier. More than 50,000 licensed customers across more than 100 solutions means this company has executed an enormous number of commercial agreements, so the pricing structures are well established internally and simply are not published. A vendor with ten customers can claim every deal is bespoke. One with fifty thousand cannot.

The unit question is genuinely complex here and that is the reason a buyer needs guidance rather than an excuse for withholding it. A quality product serving health plans plausibly charges per member per month or per measure programme. A record review capability plausibly charges per chart reviewed or per condition captured. Provider revenue cycle products plausibly charge per transaction or per claim. Data licensing to life sciences plausibly charges per extract, per cohort or by subscription with lookback period as a variable, and company material indicates that extracts are offered with one, three and five year longitudinal lookback windows, which is a pricing dimension stated without a price.

Buyers here are among the most sophisticated in healthcare, so the asymmetry is less damaging than it would be for a small provider group. It remains an asymmetry.

Ask for the unit of charge per product line, how data extracts price by lookback period and cohort size, and the contract term.

The widest coverage encountered in this index, across buyer type, care setting and geography, and it is substantiated rather than asserted.

Four distinct markets are served from one platform: health plans, provider organisations, pharmacy operations and life sciences. Those are not variations on a customer, they are four different businesses with different regulators, buying processes and success measures. A quality product for a health plan and an operations product for a specialty infusion pharmacy have almost nothing in common except the data underneath them.

Setting coverage follows from the data rather than from product design. The registry draws on more than 160 primary sources spanning all fifty states and covering medical, pharmacy and laboratory events, so ambulatory, inpatient, pharmacy and laboratory activity are represented as a matter of course. Federal designation permitting access to complete Medicare fee for service data extends that to a national denominator rather than a sample.

Product breadth is stated at more than 100 solutions reached through a single portal, and the customer figures span the largest health plans, the largest provider systems, major specialty pharmacy operators and most of the largest global pharmaceutical companies.

The qualification worth recording is that breadth of this kind is a coverage claim about data and reach, not a claim that any individual solution is the deepest available in its niche. A specialist competitor in workforce management or infusion pharmacy operations may well be better at that one thing.

Graded A on breadth, with depth per solution a question for a buyer evaluating any single product.