MarianaAI

Describes itself as a research lab building specialised healthcare AI models, with the CARE platform as the delivery vehicle for them. Nothing in the product exists without the models, and the breadth of functions built on one model stack supports the claim rather than diluting it.

The weakest oversight posture assessed in this category, and it is advertised rather than uncovered. The autonomous coding module is marketed with the statement that it works with absolutely no human in the loop, generating ICD-10, CPT and HCPCS codes within seconds of the encounter and before the next appointment.

Read against this index's own benchmark, that is the inverse of the standard set by Nym Health, which publishes the confidence threshold above which a chart is routed to billing and below which it returns to a human coder, and which was graded A for exactly that disclosure. MarianaAI publishes no threshold, no accuracy rate, no abstention behaviour and no escalation path, while removing the reviewer entirely from a function that produces claims submitted to payers.

In fairness the ambient documentation module appears to follow conventional draft and review, and the grade should not be read as describing that module alone; it describes the platform a buyer actually contracts for.

Claims are superlative rather than specific, and several are constructed so they cannot be tested. The vendor states an ambition to build the world's most accurate and precise AI for healthcare, advertises up to 100 percent code capture, and describes its security as military grade. Up to 100 percent is satisfied by any figure at all, and military grade is not a defined standard. No model card, no accuracy methodology, no reference standard, no error rate and no evaluation protocol were located for either the documentation or the coding model.

Nothing identifies any party in the chain. No model or model family is named, no foundation model provider is disclosed, no hosting or cloud arrangement is published, and no sub processor list was located in two passes. What the vendor does publish is the answer to the other half of this axis, and it is the answer most of this lane commits against: the platform is described as continuously learning from patient data and clinician feedback.

That is an affirmative statement that customer content enters the training corpus on an ongoing basis, which is unusual candour and also the position competitors earn top grades for excluding. Taken with the absence of any enumeration, it leaves a buyer knowing that their patients' data feeds a model and not knowing which model, whose model, or where it runs.

The reach makes that harder rather than easier to accept, since the product analyses longitudinal patient history over long spans, so the content entering the corpus is not limited to a single encounter. Get the training position in the contract rather than from the website, ask whether a customer can decline, and ask for a sub processor list and a data flow showing every party that touches patient content.

Every figure located is vendor generated, and several conflict with each other. Published claims include 10x return on investment within the first month in one place and within two weeks in another, savings of 500,000 US dollars and 104 days per physician per year, two extra days a week returned to clinicians, revenue up 15 to 20 percent, and a 98 percent conversion rate against competitors.

None carries a denominator, cohort, time period or methodology, and no peer reviewed publication, controlled evaluation or independent assessment was located. Internal inconsistency between the ROI claims is itself a candour signal.

The vendor affirmatively states the position that others in this category commit against. Its materials describe the platform as continuously learning from patient data and clinician feedback, which is the opposite of the never used for training commitments that earn an A on this axis elsewhere here. It also analyses longitudinal patient history, in its own phrasing sometimes from birth, which is an unusually deep PHI reach for a documentation product.

Security is described as military grade, which is a marketing phrase rather than a control. No retention schedule, de identification practice or sub processor disclosure was located. Get the training use position in the contract rather than from the website.

HIPAA compliance is claimed directly, which is the same basis on which other vendors in this category are graded B. Worth noting the framing rather than the substance: the claim is presented as being the only healthcare AI solution of its kind to provide not only HIPAA compliance but true military grade security, a superlative that cannot be verified and that adds nothing to the compliance position. BAA terms are not published for inspection.

Converted from Not Rated. A claim does exist, so the prior finding that no attestation was located is superseded, but what exists is a bare assertion and the grade sits where bare assertions belong.

The company's privacy policy states that it maintains SOC 2 compliance and lists security, availability, processing integrity, confidentiality and privacy. That is the whole of it. There is no examination type, no report date, no named auditor, no scope statement identifying which systems were examined, and no trust centre or request route through which a counterparty could obtain the report.

The type omission is the substantive one. A Type 1 examination tests whether controls were designed appropriately on a single date. A Type 2 tests whether they operated effectively across a period. The difference is most of the value of the attestation, and a vendor holding the stronger one normally says so.

The list itself is worth reading carefully. Security is the only mandatory criterion in this framework; an organisation elects the others, and most elect one or two. A claim spanning all five is either an unusually broad examination, which a vendor would ordinarily advertise specifically and loudly, or a recitation of the framework's own definition rather than a description of an actual report's scope. Ask which criteria are in scope and read the report's scope section rather than accepting the list.

For calibration, another vendor assessed in the same pass names its auditor, its examination type, its date and the platform in scope. That is what a stronger grade looks like on this axis, and the distance between the two is entirely in the specifics rather than in whether an attestation exists.

Separately, and retained from the prior assessment because it remains true: military grade security is a marketing phrase, not a certification, an audit or a standard, and a vendor leaning on it while declining to specify its actual attestation is inviting a straightforward diligence question.

Converted from Not Rated. The device question closes cleanly and the regulatory exposure that actually matters is wide open, which is why this sits at C rather than higher.

On the axis as written, this is not a regulated medical device and none is claimed. Documentation, coding and administrative automation do not make a diagnostic or treatment claim about an identified patient, so no device pathway attaches.

The exposure that matters for this product answers to a different regulator entirely. Autonomous risk adjustment coding and evaluation and management coding sit under the False Claims Act and the authority of the inspector general, not the device regulator. The failure mode is not patient harm from a wrong prediction but a pattern of upcoded claims submitted to a federal payer, and the remedy is enforcement rather than recall.

What sharpens this beyond the ordinary is that the company's own marketing describes the configuration that creates the exposure. It sells on simultaneously optimising risk adjustment scores and diagnosis and procedure capture to lift revenue by a stated double digit percentage, on capturing up to 100 percent of codes, and on performing the coding with, in its own words, absolutely no human in the loop. Each element is defensible alone. Together they describe a system tuned to maximise reimbursement, operating without a human attestation step, in the exact area where enforcement activity concentrates.

The liability does not sit where a buyer might assume. Responsibility for a claim attaches to the entity that submits it, which is the provider organisation, not the software vendor. Buying a tool does not transfer that responsibility.

Three things to establish before deployment. What audit trail supports each generated code and whether it links to specific documented clinical evidence. Whether a human attestation step can be enabled, and whether disabling it is the default. And what contractual indemnity, if any, the vendor offers against a payment integrity finding arising from its output.

Graded on incentive structure and disclosure, not on any allegation of wrongdoing, and the grade rests entirely on the vendor's own published positioning. CARE stands for Comprehensive Automation and Revenue Enhancement. The platform is marketed on simultaneously optimising RAF scores and ICD-10 and CPT capture to raise value based and fee for service revenue by 15 to 20 percent, on capturing up to 100 percent of codes, and on mining longitudinal history from birth to optimise risk adjustment.

RAF optimisation in Medicare Advantage is among the most actively litigated areas in United States healthcare compliance, and this index has already graded down Charta Health, Candid Health and Solventum for materially milder versions of the same incentive gradient.

What separates this record is that the revenue optimisation is combined with advertised full autonomy and zero published governance: no bias statement, no audit trail description, no compliance framework, no threshold, no human review. A buyer's compliance function should treat the revenue lift claim as the thing to audit, because it is the mechanism by which the product is sold.

Two passes located no terms, no warranty or indemnity language, no remediation commitment and no accuracy measurement for either the documentation or the coding model. The published claims are built so they cannot fail, which is the specific finding here and a test worth applying across this index. Code capture is advertised as up to 100 percent, and an up to figure is satisfied by any result at all including zero, so it commits the vendor to nothing while reading as a ceiling.

Security is described as military grade, which is not a defined standard and cannot be audited against anything. The stated ambition to build the most accurate artificial intelligence in healthcare is an aspiration rather than a representation. Together these are claims shaped to survive any outcome, which is the opposite of the falsifiable disclosure this axis rewards. The exposure sits with the buyer and it is concrete.

The product proposes codes, so its output shapes what is billed, and coding errors carry consequences under federal false claims enforcement that land on the organisation submitting the claim rather than on the vendor whose model produced it.

A separate exposure follows from the product's own description of analysing longitudinal patient history, in the vendor's phrasing sometimes from birth, which is an unusually deep reach for a documentation product and widens what a single error can touch. Ask for a coding accuracy figure with a defined denominator, and for what the vendor commits to when a proposed code is wrong.

Breadth is asserted at more than 50 EHR integrations naming Epic, Cerner, Meditech and others, with access from inside the record, from Chrome, Edge and Safari and from iOS and Android applications, and distribution through the Microsoft AppSource and AWS marketplaces. Deployment is claimed to reach pilot in under three days and organisation wide in under a month. Graded B on the same basis as other asserted breadth claims in this index: no integration architecture, certification or named production reference was verified in this pass.

Converted from Not Rated after a second search. The delivery model is confirmed and the residency question remains entirely unanswered.

The product is cloud delivered and is distributed through the major cloud marketplaces. That distribution is now verified against a first party marketplace seller profile rather than resting on the vendor's own claim, which matters because marketplace listing requires the seller to be onboarded and transacted through the provider's own process.

Nothing beyond that was located. No hosting region, no residency option, no statement of whether tenancy is shared or dedicated, no subprocessor list, and no position on where the underlying language models are served from, which for this product is a separate question from where the application runs.

The gap carries more weight here than it would for a narrower tool. This platform is described as spanning more than twenty modules across ambient documentation, coding, charting, order management, inbox triage and coverage checking, integrating with a claimed fifty or more record systems. A product with that reach into the chart is moving a great deal of identifiable clinical content, and a buyer cannot assess exposure without knowing where it goes and who else touches it.

One practical route worth using. Cloud marketplace listings frequently carry deployment method and region availability metadata that a vendor's own site omits. Check the listing as well as asking the vendor, and reconcile the two.

No published rate card. Notably, the commercial materials substitute return on investment claims for price entirely, quoting multiples and dollar savings per physician rather than what the product costs. A buyer cannot compare a 10x ROI assertion against a competitor's published per provider monthly rate, which is the practical effect of pricing communicated this way.

Broad in claim across all specialties and care settings, spanning practices, hospitals and accountable care organisations, with listed reach into acute, ambulatory, behavioral health, home health and population health systems. Multilingual encounter capture is claimed. Held at B rather than A because nothing is enumerated: no specialty count, no language list and no setting specific validation, so breadth is asserted at the level of a category claim rather than documented.