Medallion

AI agents do the credentialing work, but the company is unusually candid that they do not do all of it. It describes purpose built AI agents for credentialing overseen by industry experts, paired with a proprietary payer clearinghouse to deliver real time results. It then states plainly that AI is not perfect yet, which is why credentialing expertise is embedded directly into every workflow and specialists step in when automation encounters an exception. That is a hybrid model honestly labeled rather than an autonomy claim, and a buyer should size it as automation plus a services layer.

The oversight design is explicit, structural, and stated without spin. Experts review critical stages across credentialing and enrollment before work moves forward to ensure accuracy, completeness, and readiness for regulatory review, and from primary source verifications through committee ready packets that review is built into the process.

The company also states its experts continuously train and configure the AI agents, which makes human review a feedback mechanism rather than only a gate. For work where an error means an improperly credentialed clinician treating patients, embedding review rather than sampling is the right architecture.

The company describes an AI agent workforce combined with a proprietary payer clearinghouse and direct integration with primary source databases, which explains where the data comes from and how results are produced at a functional level. No model provider, architecture, accuracy measurement, or exception rate is published, and exception rate is the figure that would tell a buyer how much of the work the AI actually completes unaided.

One architectural feature makes the re use question sharper here than the usual enumeration gap, and it follows from the value proposition rather than from an omission. The company markets a solution that reduces redundant recredentialing effort for payers, and reducing redundancy across payers necessarily means verified provider data is shared or re used beyond the customer that originally collected it.

The efficiency is the sharing, so a buyer cannot separate the two: establish what crosses that boundary, which entities can see a given provider's re used record, on what legal basis, and whether the provider is told or able to correct it.

The data is highly sensitive and sits largely outside health privacy law, covering national identifiers, controlled substance registrations, state licences, board certifications, malpractice history, sanctions and exclusion records, and commonly social security numbers, governed instead by state breach notification law, consumer protection law and payer contract terms.

The vendor's own framing is accurate: what flows through a credentialing platform is provider and customer data rather than patient data, so a mid grade here does not carry the meaning it would for a clinical vendor. Published: encryption, strict access management, infrastructure audits and formal incident response, plus an external certification subjecting file handling and quality oversight to inspection. Absent: retention or deletion schedule for verification source documents, any statement on whether provider data trains the agents, and sub processor disclosure.

Operational rather than clinical, appropriately, and backed by an unusual commercial commitment. The company states it stands behind credentialing operations with performance backed guarantees, which transfers some delivery risk to the vendor and is rare in this index. Third party analysis cites credentialing time cut by up to 80 percent with committee ready files in days rather than weeks.

The company reports saving more than 250,000 administrative hours across named customers including several large digital health and primary care organizations. Figures are vendor or third party reported without independent audit.

The company's own framing describes protecting provider and customer data as foundational, not patient data, which is the correct description of what flows through a credentialing platform and means a low grade here does not carry the meaning it would for a clinical vendor. The data is still highly sensitive: national provider identifiers, DEA registrations, state licences, board certifications, malpractice history, sanctions and exclusion records, and commonly Social Security numbers.

It sits largely outside HIPAA, governed instead by state breach notification law, the FTC Act and payer contract terms. What is published: encryption, strict access management, infrastructure audits and formal incident response procedures, plus NCQA certification, which subjects file handling and quality oversight to external inspection.

What is absent and would support a higher grade: no retention or deletion schedule for verification source documents, no statement on whether provider data trains or improves the AI agents, no data classification policy and no subprocessor disclosure. One architectural feature makes the retention and visibility question sharper here.

Medallion markets a solution that reduces redundant recredentialing effort for payers, and reducing redundancy across payers necessarily means verified provider data is shared or re used beyond the customer that originally collected it. Worth establishing what crosses that boundary, which entities can see a given provider's re used record, on what legal basis, and whether the provider is told or able to correct it.

No business associate agreement statement, terms, tier or execution path was located, and no explicit HIPAA assertion was found. That absence is more pointed here than elsewhere in this segment, because this vendor has a dedicated compliance page that addresses NCQA and SOC 2 and does not mention HIPAA at all.

When a company builds a page specifically to answer compliance questions and omits the United States health privacy statute, that reads as a scoping decision rather than an oversight, and it is consistent with the shape of this segment: the core dataset is provider identity data, so HIPAA is genuinely not the primary governing regime for most of it. That is context rather than absolution.

Medallion sells payer enrolment, delegated credentialing and network operations to health plans and large provider groups, and integrates directly with CAQH, so configurations touching data that is unambiguously protected health information are plausible and an agreement is very likely executed in practice even though none is published.

The non HIPAA data carries its own regime, since Social Security numbers, DEA registrations and licensure records concentrate identity theft exposure under state breach law and the FTC Act, which a buyer's compliance team will still need answered. Two questions worth putting directly: whether an agreement is executed as standard and at which tier, and which regulatory regime the vendor treats as governing for provider information falling outside HIPAA. The compliance page was read in full; the privacy policy and terms of service were not opened.

A dedicated compliance page exists, which is more than several competitors offer, and it states that Medallion is SOC 2 compliant without specifying the type. The type is the substantive question: Type 1 tests control design at a point in time, while Type 2 tests whether controls operated effectively across a period. Third party sources describe Medallion as SOC 2 Type 2 compliant, and that is not treated as vendor disclosure here.

Specifying the type on the company's own compliance page would change this assessment immediately. What is genuinely credited: the controls are described substantively rather than gestured at, covering encryption, strict access management, infrastructure audits and formal incident response procedures, and the SOC 2 scope is characterised as security, availability and data protection.

The stronger external examination sits on the regulatory axis and is worth reading across: NCQA certification for credentialing means an accreditor has inspected documentation, verification and quality oversight practice, which is a real third party review of exactly the file handling this axis cares about.

Held at this level on the unspecified type plus three absences: no public trust centre, so certificates and audit dates cannot be checked; no penetration testing statement; and no ISO 27001 or HITRUST located.

No FDA pathway applies, but this vendor operates under a real and specific accreditation regime that functions as its equivalent. The company describes an NCQA certified credentials verification organization and states it generates NCQA compliant credentialing files in real time, with workflows aligned to both NCQA and Joint Commission standards for privileging. Those accreditations are what allow a health plan or health system to rely on delegated credentialing, so they are the credential that matters commercially, and the company holds them.

No formal governance framework was located, but the stated design of expert review at critical stages before work advances, plus specialists handling automation exceptions, is a functioning control on AI error even though it is not framed as governance.

No bias analysis was located, and the relevant question is whether verification performance varies by provider type, state licensing board, or credential pathway, since uneven automation could slow credentialing for clinicians from less common backgrounds.

Two passes located no model provider, architecture, accuracy measurement, validation methodology or warranty, indemnity or remediation commitment. The specific missing figure is worth naming because it is the right one for a product of this shape and it is not a general accuracy number.

The company sells an agent workforce, and the measure that tells a buyer whether that claim holds is the exception rate: how much of the work the agents complete unaided, and how much falls through to a person. A product marketed as replacing manual effort with automation is making a quantitative claim by implication, and the exception rate is that claim made explicit.

Without it a buyer cannot distinguish a system that handles most cases end to end from one that handles the easy ones and routes the rest, and the two have completely different economics and completely different staffing consequences. The consequence side is also personal rather than institutional.

Credentialing decides whether a clinician can practise and bill, so an error delays or blocks someone's ability to work, and a wrongly failed verification is not absorbed by a workflow the way a wrong suggestion is. Ask for the exception rate, what the agents decide unaided versus route to a human, the error rate on completed verifications, and what recourse a provider has when a verification fails wrongly.

Integration is with credentialing infrastructure rather than the clinical record, which is the correct surface. The company integrates directly with primary sources including the federation of state medical boards, the national practitioner data bank, federal exclusion and entity databases, and the national provider registry to verify and monitor credentials automatically, and operates its own payer clearinghouse for enrollment submission. Continuous monitoring against those sources with real time alerts on credential and sanction changes is a materially harder integration than periodic manual checks. No EHR integration applies.

The model is a hybrid of software and staffed service rather than pure software: the platform is wrapped around an NCQA certified credentials verification operation, described as AI agents purpose built for credentialing and overseen by industry experts, with credentialing specialists reviewing critical stages. Direct integration with CAQH is named, which is the sector's central provider data utility and a meaningful interoperability anchor in this segment.

The distinctive and genuinely creditable feature is commercial rather than technical, and almost nothing in this index offers it: Medallion publishes performance backed guarantees, including one day credentialing file delivery and a stated near 100 percent accuracy guarantee. A contractual service level commitment is a different and stronger thing than a marketing metric, because it transfers risk to the vendor and is enforceable.

It is also the only accuracy figure found anywhere in this segment, though the phrase near 100 percent is imprecise and the denominator, the definition of an error and the remedy on breach are all unpublished. Held at this level on the absences this axis exists to catch, which are common across this segment: no data residency statement of any kind, no region and no residency commitment, no hosting provider or cloud named, and no implementation timeline or support model.

The services component raises a further question worth asking, since a staffed verification operation means human reviewers handling provider Social Security numbers and licensure files at scale, making personnel screening, access control and staffing location live issues a pure software vendor does not face.

No published rates, but two disclosures give a buyer more than most vendors here provide. The company states it offers performance backed guarantees on credentialing operations, which is a commercial term rather than a marketing claim and shifts delivery risk. Third party review notes the absence of a strong self service option for organizations wanting to manage their own enrollments, which implies the model is oriented toward managed service rather than software licensing. Neither structure nor price is published.

Broad on every dimension that matters for this function. Provider type coverage spans all major categories including physicians, nurses, nurse practitioners, physician assistants, and licensed clinical social workers. Geographic coverage spans all United States states and territories for licensing.

Functional coverage runs the full lifecycle: licensing, primary source verification, credentialing, payer enrollment for both commercial and public programs, delegated credentialing, privileging, and continuous monitoring. Buyer types span health systems, digital health companies, payers, and provider groups.