Laudio

What Laudio sells first is integration. The platform replaces a frontline leader's fragmented view across human resources, time and attendance, scheduling, email, EHR admission and discharge feeds and the learning management system with one hub, and that consolidation would be valuable with no model in it at all. AI sits on top as a recommendation layer, surfacing which leader action to take with which team member and generating burnout and turnover risk flags.

This is the moat is the integration variant of the dataset precedent: the durable asset is the connective work across systems no single vendor owns. Graded C. The grade describes the mechanism and not the quality of the product, which is well regarded by the systems running it.

Autonomy is low by construction and that is the right design here. Laudio recommends and a human leader acts; nothing published suggests the system contacts, disciplines or evaluates an employee on its own. What is missing is the layer beneath that reassurance. Nothing states how burnout and turnover risk flags are generated, what threshold raises one, whether the leader is shown the reasoning, or whether an employee is ever told a system flagged them.

A nudge architecture is still an architecture that decides who gets attention and who does not. Publishing the basis of the flags and whether leaders see the contributing factors would move this to A.

The language is consistently at the level of AI powered recommendations and AI synthesized views, with no disclosure of model family, feature inputs, or how recommendations are ranked. The most consequential opacity is in Performance Insights, which maps real time signals across recognition, work patterns and peer input into performance categories used to prepare reviews.

That is a scoring function applied to named employees, and nothing published describes how the mapping works or how it was validated. Naming the inputs and the weighting logic behind the performance categories would move this to B.

The combination held here is unusual and worth stating precisely, because it is not the ordinary workforce profile. The platform ingests admission, discharge and transfer data from the record system to drive patient rounding, so it holds patient movement data, and it holds it alongside a behavioural record on hundreds of thousands of named employees covering attendance, overtime, recognition, peer input and certifications.

Two sensitive datasets about two different populations sit in one system, and each would ordinarily be governed by a different regime and reviewed by a different function inside a hospital. A stated compliance posture and real controls cover the patient side. Nothing enumerates the chain: no model or model family, no hosting arrangement and no sub processor list was located, and no retention position was found for either dataset. The employee side is the one with no external floor.

Patient movement data sits under health privacy law whatever the vendor publishes, while the employee behavioural record and the risk assessments derived from it sit under employment and state privacy law, where the protections are weaker and the subject is an employee of the customer rather than a party to anything. Ask for a sub processor list, retention for both datasets separately, whether either informs model development, and which internal function at the hospital reviewed the employee side.

Better substantiated than most of this category. Multiple named health systems report quantified outcomes on a single consistent metric: UNC Health reports a 20 percent reduction in nurse turnover and 5.4 million dollars in annual savings, North Mississippi Health Services a 3 percent improvement in RN retention and 1.5 million dollars saved in nine months, and Nebraska Medicine a 47 percent reduction in first year nurse turnover in nine months.

Scale is stated at more than 150 sites and over 300,000 frontline staff. What holds this at B is that all of it is customer reported through the vendor with no control group, no adjustment for concurrent retention initiatives, and no independent or peer reviewed evaluation. Turnover fell during a period when most systems were running several retention programs at once, and nothing published isolates the platform's contribution.

Unusually for a workforce vendor, this axis genuinely applies. Laudio ingests EHR admission, discharge and transfer data to drive patient rounding, so it holds patient movement data alongside employee records, and it states HIPAA compliance directly. The sharper stewardship question is on the employee side.

The platform holds attendance patterns, overtime, recognition history, peer input, licensure and certification data on 300,000 named frontline staff and derives burnout and turnover risk from it. Nothing published states retention periods for that derived risk data, whether an employee can see or contest a flag, or whether flags persist into a personnel record. Graded B for a stated HIPAA posture and real controls; those three employee side disclosures are what would take it to A.

HIPAA compliance is stated explicitly on the vendor site and is genuinely required here rather than decorative, because the patient rounding module consumes EHR admission and discharge data. No BAA template, execution process or scope description was located publicly. Given that the security posture is otherwise well documented, the likely explanation is that BAA terms sit inside the sales process rather than that they are absent. Publishing the BAA scope, specifically which data classes it covers and whether employee data sits inside or outside it, would move this to A.

The strongest attestation posture located in this category so far. Laudio publishes SOC 2 Type 2, TX-RAMP and HIPAA compliance on its product pages and maintains a public security page. TX-RAMP is worth calling out specifically because it is a Texas state authorization program with an assessment process rather than a self declaration, and almost no vendor in this category holds anything comparable.

Against the pattern the index has documented elsewhere, where workforce and security vendors publish nothing at all, this is a clear outlier in the right direction. Adding HITRUST or ISO 27001 would be incremental rather than corrective.

Laudio is not a medical device and makes no clinical claim, so no FDA pathway applies and the missing clearance is not the reason for this grade.

The C reflects an applicable regime the company says nothing about. That regime is employment law rather than hiring law specifically, since this product acts after the hire. Performance Insights produces AI synthesised assessments that feed performance reviews, which places it within the scope of emerging consequential decision frameworks including the Colorado AI Act, and within the reach of collective bargaining agreements at unionised systems, where algorithmic input into performance management is increasingly a negotiated term.

Nothing published addresses either. Buyers with represented staff should treat that as a live labour relations question rather than a procurement footnote, because the objection tends to arrive after deployment.

This is the axis where the product's ambition outruns its disclosure. Laudio generates burnout and turnover risk flags on named employees and synthesizes performance views from recognition, work patterns and peer input. The index has already worked through this failure mode in healthcare cybersecurity, where anomaly detection flags statistical outliers and a clinician whose legitimate pattern differs by specialty, shift, unit or acuity gets flagged for being unusual rather than for doing anything wrong.

The same logic applies to attendance and work pattern signals, which vary systematically with caregiving responsibilities, disability, seniority and shift type. Haystack broke that pattern in the cyber lane by stating plainly that a flag does not imply wrongdoing, rejecting one size fits all monitoring, and letting customers set the weights.

Nothing equivalent was located from Laudio, and the recognition signal carries its own known asymmetry, since peer and manager recognition is not distributed neutrally across race and gender. Adopting the three Haystack disclosures would move this to B.

Two passes located no model family, no feature inputs, no ranking or weighting logic, no validation and no warranty, indemnity or remediation commitment. The most consequential opacity is a scoring function applied to named employees. The performance capability maps real time signals across recognition, work patterns and peer input into performance categories used to prepare reviews, and nothing published describes how that mapping works or how it was validated.

A category assigned to a person and carried into their review is a determination about them, and the person it concerns has no stated route to see the inputs, understand the weighting or contest the result. The derived risk data compounds it.

Attendance patterns, overtime, recognition history, peer input and certification data on hundreds of thousands of named frontline staff produce burnout and turnover risk assessments, and a turnover risk flag has a self fulfilling quality no clinical prediction has: a manager told an employee is likely to leave may reasonably invest less in them, which makes leaving likelier, and nothing in the system distinguishes a prediction that was right from one that caused its own outcome.

Nothing states retention for derived risk data, whether an employee can see or contest a flag, or whether flags persist into a personnel record. Ask for the mapping and its validation, the employee facing disclosure, and retention on derived assessments.

Integration is the core of the product rather than an add on, and the published breadth reflects that: human resources information systems, time and attendance, scheduling, email, EHR admission and discharge data, and the learning management system. Implementation is stated at 12 weeks or less across every department without a costly IT lift, which is a specific and testable claim.

What is not published is which named systems are supported, so a buyer cannot confirm coverage of their own Epic, Workday, UKG or Kronos estate from public materials, and no detail is given on whether exchange is real time or batch. Publishing the supported systems list would move this to A.

No hosting model, tenancy or residency statement was located, and the earlier assessment's treatment of the state cloud authorisation was right: it evidences conformance to a defined security baseline and is not a residency disclosure.

One thing that authorisation does establish is worth using. Certification under that programme requires a documented system security plan with a defined system boundary, so a boundary description exists as an artefact of the certification whether or not it appears on the website. That converts a vague request into a specific one: ask for the boundary description and the hosting environment named in it. This is a publication gap rather than a documentation gap.

The second pass also surfaces a corporate change the record did not carry. The company was acquired in September 2025 and now operates as a brand within a larger learning and healthcare technology group. As with any recent acquisition, hosting and subprocessors are the things most likely to consolidate onto a parent's infrastructure, and that can happen without a product change a customer would notice. Ask whether a migration is planned and whether the current arrangement is fixed by contract.

One question follows from the parent's portfolio and is specific to this lane. That group also operates education, assessment and certification businesses serving the same healthcare workforce, and describes its ambition as supporting people from student to practice. This platform holds employment records, attendance and performance review content for hundreds of thousands of frontline staff. Establish whether those datasets remain separated, since the same individual may appear in both as a trainee and as an employee.

No pricing page, no rate, no unit and no charging basis. Every path resolves to a demo request. Customer testimonials quantify savings in dollars, 5.4 million annually at UNC Health and 1.5 million in nine months at North Mississippi, which frames the purchase against avoided turnover cost without disclosing what the purchase costs. The index applies added scrutiny to savings framed commercial models for that reason. Publishing the charging unit alone, whether per leader, per employee covered or per site, would move this to B.

Coverage is deep within acute care and narrow outside it. The named customer base is large hospital and health system operators including UNC Health, Northwell, Memorial Hermann, MemorialCare, Novant, Boston Medical Center, Nebraska Medicine and El Camino, and the buyer personas addressed are nursing executives, human resources executives and frontline leaders, which is the right triangle for this product.

The reach across the workforce is genuinely broad, since the platform serves any frontline leader rather than nursing alone. No evidence was located of deployment in ambulatory, senior living, home care or behavioral health settings, all of which have the same frontline leader problem and a very different data environment. Buyers outside the acute hospital setting should treat this as unproven rather than unsuitable.