MarianaAI

Describes itself as a research lab building specialized healthcare AI models, with the CARE platform as the delivery vehicle for them. Nothing in the product exists without the models, and the breadth of functions built on one model stack supports the claim rather than diluting it.

Autonomy is advertised rather than uncovered. The autonomous coding module is marketed with the statement that it works with absolutely no human in the loop, generating ICD-10, CPT and HCPCS codes within seconds of the encounter and before the next appointment.

MarianaAI publishes no threshold, no abstention behavior and no escalation path, and an accuracy figure of above 93 percent with no method, while removing the reviewer entirely from a function that produces claims submitted to payers. The ambient documentation module does describe a review of generated notes before they sync to the record, but that step covers that module alone, not the platform as it is contracted.

Claims are superlative rather than specific, and several are constructed so they cannot be tested. The vendor states an ambition to build the world's most accurate and precise AI for healthcare, advertises up to 100 percent code capture, and describes its security as military grade. Up to 100 percent is satisfied by any figure at all, and military grade is not a defined standard. Neither the documentation nor the coding model has a published model card, accuracy methodology, reference standard, error rate or evaluation protocol.

Nothing establishes who else sits between a patient record and an answer. No model or model family, foundation model provider, hosting arrangement or subprocessor is named. The privacy policy says only that third party companies are engaged for maintenance, database management, web analytics and general improvement of the services, and the terms disclaim responsibility for third party software incorporated into the service without identifying any.

What the vendor does publish is the training half of the question, and it runs toward use rather than exclusion. The company describes its AI as continuously learning from patient data and clinician feedback. Its terms state that it retains title to recordings, transcripts, notes and the data they contain, and may use that information to improve its services and other offerings, subject to its business associate agreement, disclosing it only in aggregate or de identified form. A buyer therefore knows patient content feeds model development and does not know which model, whose model, or where it runs.

The reach makes that harder to accept: the product analyses longitudinal patient history, so the content involved is not limited to a single encounter.

Every published figure is vendor generated, and several conflict with each other. Published claims include 10x return on investment within the first month in one place and within two weeks in another, savings of $500,000 and 104 days per physician per year, two extra days a week returned to clinicians, revenue up 15 to 20 percent, and a 98 percent conversion rate against competitors.

None carries a denominator, cohort, time period or methodology, and no peer reviewed publication, controlled evaluation or independent assessment is published. That the ROI claims contradict each other says something about candor in itself.

The vendor publishes no retention period for recordings or transcripts, no de identification method for development use, and no protective training commitment. What is published runs the other way. The company describes its AI as continuously learning from patient data and clinician feedback, and its terms state that it retains title to recordings, transcripts, notes and the data they contain, with the right to use them to improve its services and other offerings, subject to its business associate agreement, disclosing them only in aggregate or de identified form. The privacy policy leaves retention at the company's discretion, including after a customer stops using the service.

That is a stated position rather than a general assurance, and it is a permission, not a safeguard. The reach adds weight: the product analyzes longitudinal patient history, in the vendor's phrasing sometimes from birth. No safety engineering is published: no guardrails, hallucination mitigation or handling of a safety event.

Business associate status is stated in the privacy policy, and the agreement itself is not published. The policy says that when MarianaAI receives protected health information it may do so as a business associate of its provider customers, under an agreement that limits use and disclosure to what the provider could do and requires safeguards, and that the business associate agreement controls where it conflicts with the policy. The terms and conditions, last updated May 2023, attach that agreement as Exhibit A, but the exhibit is not on the page.

The marketing framing adds nothing to the compliance position: the company calls itself the only healthcare AI solution of its kind to provide not only HIPAA compliance but true military grade security, which is not a verifiable claim.

A recognized attestation is named in the vendor's own material, and every question about it is still open. The privacy policy states that the company maintains SOC 2 compliance and lists security, availability, processing integrity, confidentiality and privacy. There is no examination type, no report date, no named auditor, no scope statement and no trust center or request route through which a counterparty could obtain the report.

The type omission is the substantive one. A Type 1 examination tests whether controls were designed appropriately on a single date; a Type 2 tests whether they operated effectively across a period, which is most of the value of the attestation.

The list of criteria raises its own question. Security is the only mandatory criterion in this framework and an organization elects the others. A claim spanning all five is either an unusually broad examination or a recitation of the framework's own definitions rather than a description of an actual report's scope.

Military grade security, used prominently on the product pages, is a marketing phrase rather than a certification, audit or standard.

The device question is settled, and the regulatory exposure that actually matters is wide open.

This is not a regulated medical device, and none is claimed. Documentation, coding and administrative automation do not make a diagnostic or treatment claim about an identified patient, so no device pathway attaches.

The exposure that matters for this product answers to a different regulator entirely. Autonomous risk adjustment coding and evaluation and management coding sit under the False Claims Act and the authority of the inspector general, not the device regulator. The failure mode is not patient harm from a wrong prediction but a pattern of upcoded claims submitted to a federal payer, and the remedy is enforcement rather than recall.

What sharpens this beyond the ordinary is that the company's own marketing describes the configuration that creates the exposure. It sells on simultaneously optimizing risk adjustment scores and diagnosis and procedure capture to lift revenue by a stated double digit percentage, on capturing up to 100 percent of codes, and on performing the coding with, in its own words, absolutely no human in the loop. Each element is defensible alone. Together they describe a system tuned to maximize reimbursement, operating without a human attestation step, in the exact area where enforcement activity concentrates.

The liability does not sit with the vendor. Responsibility for a claim attaches to the entity that submits it, which is the provider organization, not the software vendor. Buying a tool does not transfer that responsibility.

The published material does not show what audit trail supports each generated code, or whether each code links to specific documented clinical evidence. It does not say whether a human attestation step can be enabled, or whether disabling it is the default. Nor does it describe any contractual indemnity the vendor offers against a payment integrity finding arising from its output.

The concern here is incentive structure and disclosure, not any allegation of wrongdoing, and it rests entirely on the vendor's own published positioning. CARE stands for Comprehensive Automation and Revenue Enhancement. The platform is marketed on simultaneously optimizing RAF scores and ICD-10 and CPT capture to raise value based and fee for service revenue by 15 to 20 percent, on capturing up to 100 percent of codes, and on mining longitudinal history from birth to optimize risk adjustment.

RAF optimization in Medicare Advantage is among the most actively litigated areas in United States healthcare compliance. Here the revenue optimization is combined with advertised full autonomy and zero published governance: no bias statement, no audit trail description, no compliance framework, no threshold, no human review of codes. The revenue lift claim matters most, because it is the mechanism by which the product is sold.

The coding module is marketed as working with absolutely no human in the loop and as capturing every up coding opportunity, and that is where the exposure starts. The documentation module does publish a review step: the product page describes stopping the recording, reviewing the generated notes, and then syncing them to the record. That review before commit is the main safeguard, and it does not reach the codes.

Nothing stands behind the output. The terms provide the service as is and disclaim any warranty that results will be accurate, cap liability at fees paid, make fees non refundable with no cancellation, and require the customer to indemnify the company. The accuracy figure published, above 93 percent, carries no method, denominator or reference standard, and code capture is advertised as up to 100 percent, a figure any result satisfies.

Coding errors carry consequences under federal false claims enforcement that land on the organization submitting the claim, not on the vendor whose model produced the code.

Breadth is asserted at more than 50 EHR integrations naming Epic, Cerner, Meditech and others, with access from inside the record, from Chrome, Edge and Safari and from iOS and Android applications, and distribution through the Microsoft AppSource and AWS marketplaces. Deployment is claimed to reach pilot in under three days and organization wide in under a month. No integration architecture, certification or named production reference is published to verify the breadth claim.

The delivery model is confirmed and the residency position is stated only in general terms.

The product is cloud delivered and is distributed through the major cloud marketplaces under a first party marketplace seller profile, which matters because marketplace listing requires the seller to be onboarded and transacted through the provider's own process.

The privacy policy states that data is stored in the United States or in the practice's home country, and in other locations on customer request. It does not name a hosting provider or region, say whether tenancy is shared or dedicated, publish a subprocessor list, or say where the underlying language models are served from, which for this product is a separate question from where the application runs.

The gap carries more weight here than it would for a narrower tool. This platform is described as spanning more than twenty modules across ambient documentation, coding, charting, order management, inbox triage and coverage checking, integrating with a claimed fifty or more record systems, so it moves a great deal of identifiable clinical content.

Cloud marketplace listings frequently carry deployment method and region availability metadata that a vendor's own site omits, so the listings are a second source on this question alongside the vendor's own statements.

No published rate card. Notably, the commercial materials substitute return on investment claims for price entirely, quoting multiples and dollar savings per physician rather than what the product costs. A buyer cannot compare a 10x ROI assertion against a competitor's published per provider monthly rate, which is the practical effect of pricing communicated this way.

Broad in claim across all specialties and care settings, spanning practices, hospitals and accountable care organizations, with listed reach into acute, ambulatory, behavioral health, home health and population health systems. Multilingual encounter capture is claimed. Nothing is enumerated: no specialty count, no language list and no setting specific validation, so breadth is asserted at the level of a category claim rather than documented.