K Health

Two businesses share one platform. PatientGPT and Dynamic Intake are AI products in the plain sense: a conversation layer that answers patients from their own record, gathers a clinical history and routes them to care, none of which would exist without the models behind it. The same clinical engine writes the intake summaries and recommendations that K's physicians and partner clinicians see before a visit.

Around that sits a staffed service, 24/7 virtual primary and specialty care delivered by K's own board certified physicians for health systems such as Hartford HealthCare and Novant Health, which a buyer pays for as care rather than software. Remove the models and the clinician network still delivers visits, so the AI is the engine of K's core modules rather than the whole of what it sells.

The rules belong to the health system. Its Policy Document decides where each patient goes, its clinical protocols decide when the AI hands a conversation over, and the handoff carries the whole thread to a nurse. An automated Supervisor and Judge scores conversations against the policy and returns a pass or fail, the clause involved and a plain language reason, giving the health system an audit record of the care delivered against the care intended.

In the clinical engine studied at Cedars-Sinai, the AI declined to recommend in about one visit in five when it was not confident enough. The defaults are what stay out of view: escalation thresholds are each customer's to set, the safety figures K says it reports per thousand conversations do not appear on the product pages, and nothing says how much of a conversation runs with no person involved.

K describes how its clinical engine was built more than what runs it. The co founders say it was trained on de identified clinical notes, billions of data points from patient records, with day to day provider care used as continuing reinforcement, and K's earlier peer reviewed work includes a causal deep neural network for first line hypertension treatment.

PatientGPT's parts are named by function: the Policy Document, an Orchestration Layer that coordinates each patient intent across navigation, intake, visits and physicians, and Dynamic Intake. Missing are the language models in the patient conversation, whether built in house or licensed, their versions, and any schedule that tells a health system when the model behind its branded assistant changed.

No party in PatientGPT's chain is named beyond K and the health system. The clinical engine is K's own build, trained on de identified notes from its care, but whether the patient conversation runs on licensed language models, and from whom, is not stated, and neither are the hosting provider or the subprocessors that touch conversation data.

The consumer privacy policy lists categories of service providers and advertising partners for K's app, which do not describe enterprise deployments. A health system learns the chain only through its own vendor review, and patients using a branded assistant have no way to see which companies handle what they type.

Peer reviewed work backs the clinical engine rather than the patient conversation. In a 2025 Annals of Internal Medicine study by investigators from Cedars-Sinai, Tel Aviv University and K Health, experienced primary care physicians rated K's AI recommendations against treating physicians' final decisions in 461 virtual urgent care visits at Cedars-Sinai Connect between June 12 and July 14, 2024, covering adults with respiratory, urinary, vaginal, eye and dental complaints. The two agreed in about two thirds of visits; in the rest the AI's recommendation was rated better nearly twice as often, and potentially harmful recommendations came from the AI in 2.8 percent of cases against 4.6 percent for physicians.

The design was retrospective and single site. A 2023 Mayo Clinic Proceedings paper on diagnostic accuracy in virtual primary care and a 2023 peer reviewed causal model for first line hypertension treatment add to the base. No published study measures PatientGPT's own conversations with patients, the product K now leads with.

Nothing addresses how PatientGPT treats a health system's patient data: whether conversations or records retrieved from the EMR train K's models, how long they are kept, or whether they are de identified first.

The only stated terms are the consumer privacy policy's, and they cut the other way. Aggregated or de identified personal information may be used and disclosed for any purpose not prohibited by law, including training K's AI models, and K describes its data as a growing repository of health experiences and clinical decisions. Retention runs while an account is active and beyond as legal needs require. The co founders' own account of the clinical engine, trained on de identified clinical notes and refined continuously on day to day care, confirms that patient data feeds the models. Safety engineering for the patient channel is limited to the Supervisor and Judge and a red teaming study.

K operates as a HIPAA covered entity for its own care. A joint notice of privacy practices covers the organized health care arrangement of K Health, its affiliated medical practices and its pharmacy, in effect since April 2021 and updated February 16, 2026.

The enterprise product has no stated position of its own. PatientGPT runs inside each health system's environment and record, a role that would ordinarily make K a business associate, yet the product FAQ says only that K works with partners to address security, privacy and compliance requirements during implementation. No business associate agreement, tier or subcontractor term is available. The consumer privacy policy, which allows advertising uses, governs K's own app rather than deployments under a health system's brand.

Security is handled by invitation rather than attestation. There is no SOC 2, HITRUST or ISO 27001 claim and no trust center for the enterprise product, and the PatientGPT FAQ answers the security question by inviting a health system's security and compliance teams to review K's architecture and controls during evaluation. The consumer privacy policy mentions fraud and attack detection without describing controls.

For a platform embedded in patient portals at several large health systems, with retrieval from their EMRs, nothing independent is open to read before a security review begins. Health system partners presumably run their own vendor assessments, an inference rather than anything stated, and none of their findings are public.

PatientGPT is marketed to triage, with no regulatory position on its pages. The product demo has it tell a parent that a four year old's 102.5 degree fever warrants a same day visit and then book the slot, the use case list names appointment scheduling and triage, and health system partners describe it answering patients' health questions from their own records and helping them find the right level of care.

The routing rules come from each health system's Policy Document and clinical protocols, which places the decisions inside the customer's governance without addressing device status. K's consumer terms cover its symptom checker and affiliated medical practices, and nothing states an intended purpose, an exclusion or a regulatory pathway for the enterprise AI. The peer reviewed studies concern recommendations shown to physicians, a different use from guidance delivered straight to patients.

Governance runs through the Supervisor and Judge, an automated evaluator that checks each conversation against the health system's Policy Document and records the clause and reason behind every pass or fail. K has also released work on structured red teaming of its multi agent platform under high risk conditions, and says it reports safety normalized per thousand conversations so results compare across sites and over time. The physician rated Cedars-Sinai study adds outside clinical review of the engine's recommendations.

Performance by patient group is the gap. No results are split by demographics, language or clinical condition, the per thousand safety figures are not on the product pages, and the red teaming paper is not marked as peer reviewed.

An error rate for the clinical engine exists in peer reviewed form. In the 2025 Annals of Internal Medicine study of 461 virtual urgent care visits at Cedars-Sinai Connect, physician reviewers judged 2.8 percent of the AI's recommendations potentially harmful, against 4.6 percent of the treating physicians' decisions, and the AI held back a recommendation in about 20 percent of visits. K cites the study across its site, and its release gives percentages without the underlying counts.

On the patient side, the Supervisor and Judge leaves a clause by clause record of each conversation that a health system can audit, and nurses receive the full thread on handoff. No warranty, indemnity or remediation commitment attaches to PatientGPT's answers, and no error rate is published for its conversations with patients.

PatientGPT reads the chart and writes back. Answers draw on EMR retrieval behind the conversation, intake summaries go ahead to the clinician, and a conversation can resolve into a visit written back to the EMR. Atlantic Health runs it inside MyChart, the Epic patient portal, and Hartford HealthCare's leaders describe patients holding a real time conversation with their own medical record through it, both live deployments.

K says each integration depends on the health system's technical environment and implementation plan. No interface specification, marketplace listing or list of supported record systems is offered, so Epic is the only record system tied to a named live site, and how deep the write back goes beyond scheduling and intake is not spelled out.

PatientGPT is delivered as a hosted service that a health system embeds under its own brand across website, voice line, patient portal, outreach and clinic, with the record and the conversation thread following the patient from one channel to the next.

Where it runs, which cloud and region hold conversation data, and how one health system's data is kept apart from another's are not stated. K offers to walk a health system's security and compliance teams through its architecture and controls during evaluation, which puts every residency and isolation answer behind that review rather than in front of it. Partner deployments named so far are all in the United States.

No price is given for any part of the platform. PatientGPT is sold to health systems as an enterprise deployment under their own brand, and the way in is a request for sandbox access, where clinical, digital and compliance teams can try hard cases and change a rule before talking terms.

The partnerships announced with Hartford HealthCare, Atlantic Health, Novant Health and UVA Health pair the AI with K's staffed virtual care, so a health system may be buying software, clinicians or both. Nothing says how either is charged, whether per patient, per conversation, per visit or by license, or what implementation costs. The sandbox is the only way to see the product before a sales conversation, and it shows the software rather than the commercial model.

Health systems are the buyer, and the named deployments are large ones: Hartford HealthCare, Atlantic Health in New Jersey, Penn Medicine for intake, Northwell Health, Novant Health in the Carolinas, UVA Health across Virginia, Cedars-Sinai and Hackensack Meridian Health.

Use cases run from care navigation, scheduling and triage, and nurse line and in basket replies, to chronic condition support for diabetes and hypertension, weight management, care gap outreach for overdue screenings, medication adherence and everyday patient questions. Demos cover a child's fever, lung cancer screening at Novant and endocrinology at Hartford HealthCare.

The studies behind it cover adult virtual urgent care complaints at Cedars-Sinai and virtual primary care diagnosis in earlier work. Nothing published covers pediatric use, specialty conversations or language coverage.