MDaudit

Audit workflow and analytics are the core of the platform: scheduling audits, routing findings, tracking coder and provider performance, managing payer audits and monitoring billing risk.

Learned models run inside several modules. eValuator's engine learns from encounter and audit data to group cases and surface rule candidates, Auditor Assist reads records and coded claims to assess coding integrity, and SmartScan.ai extracts data from payer letters. Denials Predictor runs on payer rules rather than a learned model. The workflow and analytics work without any of these, and the models speed up and widen the review around them.

Auditors stay in charge of each finding. Auditor Assist proposes an assessment of coding integrity, the auditor makes the decision, and the tool learns from those decisions over time. In Coder Workflow, coders can contest an auditor's finding through a review and rebuttal process, and corrective action plans follow from audit results.

SmartScan.ai takes thumbs up or thumbs down feedback on each extraction, and a letter it cannot fully read is routed to MDaudit's team for review. In eValuator, coding specialists write and refine the rules the engine applies.

What sets the point at which a case is escalated, and how confidence is shown to the auditor, is not described.

Two modules come with an account of how they learn. SmartScan.ai is trained on each customer's payer letters during implementation and improves as more letters arrive. eValuator's engine finds trends in encounter and audit data and groups encounters by clinical and financial similarity, and specialists then write the rules it runs. Denials Predictor is described as a proprietary payer rules engine built on a nationwide payer base, with rule groups that show why a charge is likely to be denied.

MDaudit calls its approach augmented intelligence that keeps staff in control. No model, model family or language model provider is named for any module, including AI Assist, which answers questions in plain language, and no versioning or update practice is described.

Four subprocessors appear on the trust center: Amazon Web Services as the cloud provider, Okta for identity, Vanta for continuous compliance monitoring and HITRUST MyCSF.

No model provider is on the list or on the AI pages, although AI Assist answers questions in plain language. MDaudit says customer data is not shared with third party vendors, which suggests its models run inside its own AWS environment, but the model layer itself is not identified.

Cooper University Health Care is named on an eValuator case study reporting $3.2 million in impact and a 15.9 times annual return across 8,690 audited cases. MDaudit also cites $243.9 million in combined eValuator client impact in 2025, more than $375 million retained through Payer Audit Workflow in 2025, about $40 million retained through SmartScan.ai over twelve months, and $31 million in added revenue for one unnamed customer.

Named customers include University of Chicago Medicine, Rutgers Health, Temple Health, US Oncology and UMass Memorial. The figures are MDaudit's own, and only the $31 million says how it was checked, against 835 remittance data. Auditor Assist, the newest piece, has no performance result behind it yet.

Customer data is not shared with third party vendors or with other customers, according to MDaudit, and SmartScan.ai runs in MDaudit's private infrastructure on AWS, trained on each customer's own payer letters.

How long records, claims and audit data are kept is not stated, and nothing addresses de identified data. Guardrails against wrong outputs, and how a safety event is handled, are not described.

Health systems send MDaudit PHI from their records and claims, and the company says it protects that data under HIPAA Privacy Rule guidelines, with a business associate agreement in place with AWS, its cloud provider.

Its trust center lists a 2025 HIPAA Type 1 report and a HIPAA compliance data sheet, released on request. The business associate agreement MDaudit signs with its own customers is not public, so its terms and its reach to subcontractors cannot be read in advance.

MDaudit holds HITRUST r2 certification and a HITRUST ai1 certification for AI security. Its trust center lists certification letters with scope and the full r2 and ai1 assessment reports, alongside SOC 2, TX-RAMP Level 2 and CORL Cleared. The site also describes a Cloud Security Alliance STAR Level 1 listing as a certification; Level 1 is a self assessment.

It runs two penetration tests a year and lists separate test reports for the MDaudit, eValuator and RevID applications, plus an external network test.

The documents are released through an access request rather than downloaded directly, and the portal does not show report dates for the r2 certification or the SOC 2 work.

Audit findings, predicted denials and reconciled charges are the work product, reviewed by compliance and coding staff before anything changes a claim. Nothing in MDaudit's materials touches diagnosis or treatment, and no device status is claimed.

The rules that govern this kind of product are payer and billing compliance rules, which is the market MDaudit sells into.

A HITRUST ai1 certification covers MDaudit's AI security program, assessed on top of its HITRUST r2 core. The trust center also offers an AI solutions brochure, an AI security FAQ and a training and governance guide for AI Assist, which gives a customer's review committee material to work from.

No evaluation of coding accuracy across specialties, payers or facility types is available, so how Auditor Assist or eValuator perform on different kinds of encounters cannot be checked.

Every finding passes through an auditor or a coding team before it changes a claim. SmartScan.ai reports that it fully extracted all data elements from 81 percent of payer letters and partly from another 12 percent, without saying how many letters were measured.

Nothing stands behind the output itself. No accuracy commitment, remediation obligation or indemnity is offered for an audit finding or a predicted denial, and MDaudit's customer terms are not public.

Claims, remittances, audit data and medical records are the inputs, and eValuator reviews encounters between coding and billing, which requires feeds from a hospital's record and billing systems. On the payer side, Payer Audit Management sends records to review contractors through esMD and receives additional documentation requests and review results through eMDR.

No record system or encoder is named on the product pages. The trust center lists a FHIR technical workshop and data flow diagrams for MDaudit and eValuator, released on request.

The platform runs as a single cloud service on AWS, with SmartScan.ai in MDaudit's private AWS infrastructure. Its TX-RAMP Level 2 certification is the one required for cloud services sold to Texas state agencies.

No AWS region, residency option or tenant isolation model is stated on the public pages, though network and data flow diagrams are listed in the trust center.

Pricing comes through a demo and a quote, module by module, across billing compliance, revenue integrity and coding. The buyers are compliance, revenue integrity and coding leaders at larger organizations, and nothing is sold self serve.

SmartScan.ai is included in the External Audit Workflow module at no extra fee. No module or platform price is listed, and implementation costs are not stated.

MDaudit sells to health systems and integrated networks, physician networks, regional hospitals and ambulatory surgery centers, and its audits cover physicians, hospitals and coders.

Named customers include University of Chicago Medicine, Rutgers Health, Acclaim Physician Group, Temple Health, US Oncology and UMass Memorial, and Cooper University Health Care is named on an eValuator case study.

eValuator's results are given for inpatient and outpatient encounters, and its page does not say whether it reviews professional claims.