InsightRX

The dose comes from a learned component, and it is the product. Nova runs population pharmacokinetic models fitted to published cohorts and performs maximum a posteriori Bayesian estimation of each patient's pharmacokinetic parameters from their measured drug concentrations, then computes the regimen from those estimates.

InsightRX also retrains its models on data aggregated across institutions, a process it holds a 2021 United States patent for, and uses machine learning in FitAssist, which decides for a given patient, model and set of levels whether fitting with flattened priors is likely to improve the prediction. Its machine learning approach to model selection and averaging is published in a peer reviewed pharmacometrics journal. Apollo, the analytics product, is built on the output of the same engine. InsightRX leads with Bayesian forecasting and quantitative pharmacology in its copy and describes the retraining as human assisted artificial intelligence, which matches what the product does.

A pharmacist sits between the model and the patient by design, since the output is a proposed regimen entered into a review workflow rather than an order. Two disclosed design decisions concern what happens when the inputs are bad. Nova flags missing or stale data explicitly in the interface rather than silently computing on it, and pharmacists retain full manual data entry, so a broken feed or a record system outage degrades the workflow rather than blocking patient care.

Predictive safety alerts warn against over and under dosing. No threshold or confidence bound is published at which the software declines to recommend, and no figure shows how often pharmacists accept the proposed regimen unchanged.

The pharmacokinetic models Nova runs are named published models, including Thomson, Goti, Buelga, Carreno and Hughes, so a pharmacist can read the equations and derivation cohorts without the vendor's permission. InsightRX publishes which model it sets as default for which patients and the analysis behind each choice: a modified Thomson model for adults with a BMI under 40 after an analysis of 168,000 treatment courses, and a model developed with the University of Vermont Health Network for a BMI of 40 or more after an analysis of 28,000.

Its machine learning method for model selection and averaging is published in a peer reviewed pharmacometrics journal, and FitAssist, which decides when flattened priors will improve a fit, is described with its reported improvement. Nothing published says how a customer is told when a default changes, or what error rate the deployed configuration achieves.

The model layer is named at the level that matters for this product. The pharmacokinetic models are published models identified by name, so the source papers can be read and the derivation cohorts compared with a customer's own patients, and InsightRX names partner models, including those from the University of Vermont Health Network and from Children's Hospital Los Angeles's BestDose. Ingestion is narrow and standards based.

InsightRX also states how customer data feeds that layer: its patented process aggregates patient data across institutions to retrain and validate models, and product material says guidance improves using data from the InsightRX network, so a customer's patients help improve models offered to other customers. The party list and the terms are missing: no hosting provider or subprocessor list is published, and nothing says whether contribution is opt in or can be declined while keeping the service.

The evidence is real, partly independent, and includes results that do not flatter the vendor. An independent group publishing in Pharmacotherapy in 2018 compared five Bayesian dose optimizing programs in critically ill patients and found InsightRX the most adaptable and best supported, while ranking another program as the least biased, so the independent comparison did not put this vendor first on accuracy.

A separate group in the Netherlands published a prospective validation in intensive care patients reporting bias and imprecision within a clinically acceptable range. Company authored work across 16 health systems (Open Forum Infectious Diseases, 2025), with 27,604 patients before and 23,359 after a change of default model, reported target attainment rising from 46.5 to 51.1 percent and median time to target falling from 47.8 to 28.2 hours, while severe acute kidney injury rose from 1.75 to 2.03 percent.

A pediatric intensive care randomized pilot using Nova is registered. What is missing is independent outcome validation: the outcome work is company authored and the independent comparison ranked another program ahead on accuracy.

Of training use, de identification and retention, InsightRX states a position on the first two. Training use: its security and regulatory page describes a patented process by which patient data is aggregated across institutions and used to continuously retrain and validate its pharmacokinetic models, and its product material says dosing guidance improves as it updates models with data from the InsightRX network.

De identification: its published analyses describe patient data entered into Nova as de identified before analysis. Retention is the gap: no retention schedule is published, nothing says whether all reuse is de identified or whether a customer can opt out of contributing its patients' data while keeping the service, and the models trained on that data are then offered across the network.

Data reaches Nova over SMART on FHIR limited to what the dosing calculation needs, HITRUST CSF r2 certification covers handling controls, and Nova flags missing or stale data rather than computing silently on it. No safety engineering beyond the device standards it conforms to is published: nothing describes how a dosing error reported in the field is investigated or communicated to customers.

InsightRX publishes no HIPAA status: no compliance claim, business associate statement, agreement or HIPAA page. Its security and regulatory page mentions HIPAA only as one of the frameworks HITRUST integrates, in describing its HITRUST CSF r2 certification, and notes generically that clinical dosing software processes protected health information; its privacy policy covers the website and platform users and does not mention HIPAA or patient data.

HITRUST certification is not a statement of HIPAA status, and there is no parent company whose site might carry one. InsightRX will act as a business associate to the hospitals running Nova, yet the agreement is not published, including its breach notification timing, subcontractor terms and data return on termination.

The company's security and regulatory page names HITRUST CSF certification at the risk based two year (r2) level, and conformance to the medical device software standards that speak to how dosing code is built: ISO 13485 for quality management, IEC 62304 for software lifecycle, ISO 14971 for risk management, IEC 62366-1 for usability engineering and IEC 82304-1 for health software product safety, along with 21 CFR Part 11 compliance for electronic records in clinical trial use.

The page says each is independently audited or publicly verifiable. Two limits: the device standards are stated as conformance rather than certification to a named body, and no HITRUST date, SOC 2 report, trust center, penetration testing cadence or vulnerability disclosure program is published, and neither is the HITRUST letter or its scope.

The company states that it is not considered to be a medical device in the United States and that Nova has not been submitted to the FDA for review or clearance, a position published on its security and regulatory page and in the footer of its product pages. In Europe the same page states that Nova is self certified as a Class I medical device under the EU Medical Device Directive, carrying a CE mark valid in the European Union and the United Kingdom, received in November 2020.

Two questions remain for a buyer. Self certification at Class I involves no notified body review, and the Medical Device Directive has been superseded by the Medical Device Regulation, whose classification rules for software informing treatment decisions are stricter, so the product's current European status is not shown.

And a 2021 company announcement described the milestone as clearing requirements with the European Medicines Agency and United Kingdom authorities, which overstates it, since the European Medicines Agency does not regulate medical devices and no regulator assessed the product.

InsightRX publishes results compared across the patient groups that most change a vancomycin model's performance, and acted on the difference. Its analysis of 168,000 treatment courses across 117 hospital systems in adults with a BMI under 40, with methods published on its own site, found a modified Thomson model more accurate with lower error than three alternatives, and InsightRX made it the default for that group.

A separate analysis of more than 28,000 courses in patients with a BMI of 40 or more found existing models underperforming, and InsightRX built a new model with the University of Vermont Health Network that it now recommends as the default above that threshold. It also published a harm signal with the benefit: the default switch raised target attainment from 46.5 to 51.1 percent while severe acute kidney injury rose from 1.75 to 2.03 percent, a number needed to treat of 358.

The strata left unreported are age, sex and race and ethnicity, which matter because population pharmacokinetic models are derived from cohorts whose composition determines whose physiology the priors describe.

Two disclosures do real work here. The models are named published pharmacokinetic models and the machine learning method used for model selection is published in a peer reviewed pharmacometrics journal, so the basis of a dose can be checked.

And InsightRX publishes what happens when its defaults change, with the figures: after switching adults with a BMI under 40 from the Goti to the Thomson model across 16 health systems, AUC target attainment rose from 46.5 to 51.1 percent and median time to target fell from 47.8 to 28.2 hours, while severe acute kidney injury rose from 1.75 to 2.03 percent, a number needed to treat of 358 (company authored, Open Forum Infectious Diseases, 2025). No warranty, indemnity or remediation commitment attaches to a dose recommendation, and nothing says how a customer is told when a default model changes.

Integration is certified rather than asserted, on two major marketplaces and by a published standard. The applications are certified in the Epic Showroom with automatic patient data import, certified in the Oracle Cloud Marketplace for Oracle Health, and available for direct integration with MEDITECH Expanse, and the mechanism is SMART on FHIR rather than a proprietary interface, with InsightRX's implementation team validating data flow before go live.

A second distribution path runs through Premier: Nova's precision vancomycin dosing is integrated into Premier's clinical surveillance platform, so it reaches clinicians inside that product as well as directly. Named deployments include Sentara Healthcare and Mount Nittany Medical Center in the United States and Amsterdam University Medical Centers, Máxima Medical Center and University Hospital Würzburg in Europe.

Nova is described consistently as a cloud based platform integrating into hospital systems, and it operates on both sides of the Atlantic, with a CE mark covering Austria, Belgium, France, Germany, the Netherlands and the United Kingdom and named European academic hospital deployments. Stated GDPR compliance implies a European data handling position.

What is absent is the specificity a privacy office needs: there is no named hosting provider, no cloud region, no data residency commitment, no statement of whether European patient data remains in Europe, and no on premise or private cloud option. For a vendor operating clinically in six European countries, the residency question is a concrete one.

Pricing is undisclosed across the provider pages, the platform pages and the press record. No price, unit, pricing basis, contract shape or implementation fee guidance is published, and the company does not indicate whether the commercial unit is the institution, the bed, the drug module or the dosing calculation, which for a product sold as a library of more than a hundred drug modules is a material difference.

Support and onboarding are described in detail, including hands on implementation, live training, ongoing clinical pharmacist guidance and around the clock technical support, so the service wrapper is well specified while its cost is not.

Breadth holds up on three dimensions. The library covers more than a hundred drugs and therapeutic areas spanning infectious disease, oncology and transplant. Age coverage extends to pediatrics, with a registered randomized pilot in a pediatric intensive care unit dosing vancomycin and amikacin. Geographic coverage spans the United States and six European countries with named academic hospital users.

The claimed library and the visible one differ: vancomycin accounts for almost all of the published evidence and most of the customer commentary, so oncology and transplant dosing modules carry a far thinner public track record than the headline count implies.