Medallion

The agents do defined parts of the credentialing work and the company says plainly which parts. The AI page lists where automation delivers value today: extracting provider data from documents and applications, auto populating profiles and submitting enrollment applications, monitoring payer systems and following up, retrieving status updates from payers, and reading and responding to credentialing communications. The change log adds an outreach agent that contacts stalled providers by phone, text and email, and profile auto fill from national provider registries and CAQH.

Around that sits a staffed verification operation, which is what the company actually sells: an NCQA certified credentials verification organization with specialists who take exceptions and review every critical stage before work moves forward. The company's own framing is that AI does not absorb liability, stand behind audits or replace governance.

So the model is the engine of a core module, the document extraction and enrollment work, inside a service whose other value, expert verification, accreditation and payer relationships, stands without it.

What the system may do, what it may not do and what sends a case to a person are all published, and the routing is structural rather than discretionary.

The AI page names the tasks the agents perform: extracting provider data, auto populating and submitting enrollment applications, monitoring payer systems, retrieving status and reading and responding to credentialing communications. The same page states what the automation does not do, framed as the company's philosophy: it does not absorb liability, does not stand behind audits and does not replace governance. The home page then gives the two routes to a person. When an agent flags an exception, a credentialing specialist steps in so the application does not stall, and experts review every critical stage before work moves forward, from primary source verification to committee ready files. Experts are also described as continuously training and configuring the agents, which makes review a feedback loop as well as a gate.

For work where an error means an improperly credentialed clinician treating patients, a review gate that every file passes at defined stages is the right design, and it does not depend on the agent knowing when it is unsure.

Where the stage boundaries fall in practice, and what the agents complete between them without review, is not published.

Everything here is described by what it does, and nothing by what it is. The company describes an agent workforce doing named tasks, a proprietary payer clearinghouse for enrollment submission, direct integration with primary source databases, profile auto fill from the national provider registry, CAQH and uploaded documents, and expert review and configuration of the agents. The compliance page adds that the models undergo rigorous evaluation, ongoing monitoring and third party reviews for accuracy, reliability and transparency.

Below that, nothing is named or measured in public. No model or model provider, no architecture, no description of what the evaluation measures or who the third party reviewers are, no versioning or change practice, and no exception rate, which is the figure that tells a buyer how much of the work the agents complete unaided. The company publishes an average file accuracy of 99.9 percent and a one day average file readiness figure, both aggregates with no method or definition behind them.

The visible chain stops short of any model provider. What is visible: an agent layer doing extraction, submission, monitoring and communications; a proprietary payer clearinghouse that the company operates for enrollment submission; direct connections to the national primary sources for verification and monitoring; profile auto fill from the national provider registry and CAQH; and a staffed review operation. The privacy policy says information is shared with agents, vendors and other service providers in connection with their work for the company, and names Google Analytics for the website, without naming any service provider that handles provider files.

What is missing is every party underneath. No model or model provider behind the agents, no hosting or cloud provider, no document processing or telephony supplier for the outreach agent that calls, texts and emails providers, and no subprocessor register. Identity documents and licensure files pass through whichever of those exist.

The acquisition of Andros adds its own chain for a period, since Andros customers are to move onto the platform over time and each business brought its own suppliers.

Named customers and headline figures, with no period, baseline or method behind any of them.

The customer stories are real and specific about who: Headspace, which credentials therapists and psychiatrists across all fifty states, is cited for 60 percent less time spent credentialing and a score of 95 percent on credentialing audits; WellBe Senior Medical cites a six day turnaround; CareBridge and Family Care Center are named with quotations about scale and ease. The company reports more than 300 healthcare organizations as customers.

The platform figures on the home and why pages are aggregates: 99.9 percent average file accuracy, one day average credentialing file readiness, an estimated 66 percent reduction in administrative costs, enrollment estimated twice as fast, and credentialing 3.5 times faster than legacy verification organizations on average. None states the denominator, the period, the comparison group or what counts as an accurate file, and the customer figures carry no dates. Nor is an exception rate given beside the one day readiness figure.

NCQA certification for credentialing is an external inspection of documentation, verification and quality oversight, and it is the strongest independent signal on the record; it certifies the process rather than measuring the outcomes above.

General assurances, a permissive clause, and a data set that is mostly provider identity rather than patient data.

The scoping point first, because it is the company's own and it is accurate: what flows through a credentialing platform is provider and customer data. It is still highly sensitive, covering national provider identifiers, controlled substance registrations, licenses, board certifications, malpractice and sanctions history and commonly social security numbers, and it is governed mainly by state breach law, consumer protection law and payer contract terms rather than health privacy law.

What is published: the compliance page describes encryption, strict access management, infrastructure audits and formal incident response. The privacy policy covers both the website and the service and says the company may use information that does not identify a person, including de identified information, without obligation except where the law prohibits it. Nothing states how long verification documents are kept, what is deleted when a provider leaves a customer, or whether provider files train or improve the agents.

The credentialing alliance product makes the reuse question sharper. It is marketed to health plans as cutting redundant recredentialing, and removing redundancy across payers means verified provider data is reused beyond the customer that collected it. Nothing says what crosses that boundary, who can see a reused record and on what basis, or whether the provider is told and can correct it.

Compliance is claimed on the company's own pages and the document behind it is not published. The help center, linked from the site footer, answers the question directly: Medallion is SOC 2 Type II and HIPAA compliant, with security information at its trust center. A company blog post on the federal AI action plan describes HIPAA aligned credentialing automation alongside SOC 2 Type II certified workflows. The privacy policy covers the service as well as the website, and neither it nor the compliance page mentions business associate status; no agreement, template, tier or execution path is published.

So a status is claimed and not supported. The trust center, run on the company's own subdomain, is where a business associate agreement and HIPAA documentation would normally sit, and it may hold both.

The scoping point still matters for how a buyer reads the claim. The core data set is provider identity information, which sits mostly outside the health privacy statute, and the company has not said which parts of its service handle protected health information and which do not. It sells payer enrollment, delegated credentialing and network operations to health plans and large provider groups, so configurations touching protected health information are plausible, and the social security numbers, controlled substance registrations and licensure records it holds carry their own regime under state breach and consumer protection law.

The attestation and its type are named on the company's own pages, and a trust portal exists. The help center, linked from the site footer, states that Medallion is SOC 2 Type II compliant and points to a trust center on the company's own subdomain; a company blog post describes SOC 2 Type II certified workflows; and the compliance page says the report covers security, availability and data protection, describing the controls substantively: encryption, strict access management, infrastructure audits and formal incident response procedures.

The report itself is the open point. The trust center is a hosted portal that loads dynamically, so whether the report can be opened without asking, or only on request under agreement, is unconfirmed, and the audit period is not stated.

The stronger external examination sits beside it: NCQA certification for credentialing means an accreditor has inspected documentation, verification and quality oversight practice, which is a real outside review of file handling, even though it is not a security framework.

Nothing else appears: no ISO 27001 or HITRUST, no penetration testing statement and no vulnerability disclosure policy. The staffed verification operation adds a question a pure software vendor does not face, since human reviewers handle provider social security numbers and licensure files at scale, and nothing says whether the report covers that operation or how reviewer access to provider files is controlled.

No device pathway applies, and the product operates under a specific accreditation regime that does the work a clearance would do elsewhere. The compliance page states that Medallion is NCQA Certified for Credentialing, meeting the standards for documentation, verification and quality oversight, and the company describes generating NCQA compliant credentialing files with workflows aligned to accreditation standards for privileging. Those accreditations are what allow a health plan or health system to rely on delegated credentialing, so they are the credential that matters commercially to its buyers, and the company holds one.

The acquisition of Andros, itself an NCQA certified credentials verification organization, was announced on 15 September 2026, and the company says Andros customers will move onto its platform over time. Which certified entity performs a customer's verification during the transition is not stated.

What is not published is the certification's scope and date, or a position on how agent completed steps are treated under accreditation standards that assume a person performed the verification.

Responsible use of AI is committed to in policy language, with the evaluation it describes left unpublished. The compliance page states that the company's models undergo rigorous evaluation, ongoing monitoring and third party reviews to ensure accuracy, reliability and transparency, and links a page on AI security and safety. The AI page frames the approach as human accountable, with experts reviewing every critical stage and configuring the agents.

That is a real control on error and a stated governance posture. What is missing is anything a buyer can read: no evaluation method, no metrics, no name for the third party reviewers, no monitoring output, and no fairness or subgroup analysis.

The exposure is specific to this work. Verification and enrollment speed depend on how closely a provider's documents and records match the sources, and that varies with license jurisdiction, training pathway, name transliteration and credential type. If agents complete clean files quickly and route the rest to specialists, clinicians from less common backgrounds, international medical graduates among them, are systematically slower to credential and therefore slower to bill, and nothing published says whether turnaround or exception rates are monitored by those groups.

The company publishes a falsifiable commitment attached to the output and backs it with contract. The why page says outcomes are backed by contractual performance, with defined service levels, turnaround times and 99.9 percent accuracy, and says the service guarantees faster turnaround; the home page states that turnaround times are guaranteed and reports 99.9 percent average file accuracy. A customer can hold the company to a turnaround and an accuracy level on the files it produces.

What is not published is the terms of the commitment. Nothing states how file accuracy is defined or measured, over what period, what counts as an error, or what the customer receives when a level is missed: a service credit, a fee refund, rework at the company's cost, or something else. Without the remedy a buyer cannot tell whether the guarantee answers for a wrongly verified file or only for a late one.

The consequence side is personal. Credentialing decides whether a clinician can practice and bill, so a wrongly failed verification delays someone's ability to work, and a wrongly passed one puts a clinician in front of patients on a file that should not have cleared. Nothing published describes what route a provider has when a verification about them is wrong.

Integration is with credentialing infrastructure rather than the clinical record, which is the correct surface for this product, and the systems are named. The company integrates directly with primary sources for verification and ongoing monitoring, including the state medical boards' federation, the national practitioner data bank, federal exclusion and entity databases and the national provider registry, and it auto fills provider profiles from the registry, CAQH and uploaded documents. Enrollment submission runs through the company's own payer clearinghouse, and agents monitor payer systems and retrieve application status.

Continuous monitoring against those sources, with alerts on license and sanction changes, is a materially harder integration than periodic manual checks, and it is what makes the one day file readiness claim plausible at all.

These are read connections to named sources and a submission path the company operates itself, not documented bidirectional integrations a customer can verify, and no customer facing interface documentation is published. Roster and provider data management products imply connections to customer systems of record, which are not named.

A hosted platform wrapped around a staffed verification operation, with nothing published about where either runs. The service is software plus people: agents doing extraction, submission and follow up, and credentialing specialists reviewing critical stages and handling exceptions inside an NCQA certified verification organization. The privacy policy covers the website and the service together and names Google Analytics for the site; it states no hosting provider, region or residency position for provider data.

Nothing specific is published: no cloud or hosting provider, no region, no residency commitment, no tenancy or segregation model between customers, and no continuity or recovery position. The service element raises a question a pure software vendor does not face: human reviewers handle social security numbers and licensure files at scale, so where those reviewers work, how they are screened and what they can see is part of the deployment answer.

The acquisition of Andros adds a transitional one. The company says Andros customers will gain access to Medallion over time, so for a period two platforms and two verification operations hold provider data, and which one holds a given customer's files, and when they move, is not stated.

The pricing page says what drives the price and gives none. The engagement is described as an investment model built around the customer's operational goals, scope and performance commitments, shaped by provider volume, delegation structure, payer complexity and integration requirements, and designed jointly after an assessment. That tells a buyer the product is sold as a managed engagement rather than self serve software, and which variables will move the quote.

The page's reference to performance commitments connects to what the why page publishes: outcomes backed by contractual performance with defined service levels, guaranteed turnaround times and a 99.9 percent accuracy figure. Whether any fee is at risk when those levels are missed, or whether the commitment is a service level with credits, is not stated, and that decides what the guarantee is worth.

No figure, unit of charge, implementation fee or term appears. The candidates diverge sharply for this product: per provider credentialed, per enrollment, per payer application, per monitored provider, or a platform fee, with delegated credentialing and cross state licensing likely priced differently again.

Broad on every dimension of this function, with validation concentrated in part of it.

Functional coverage runs the whole provider lifecycle: provider data management, credentialing through a certified verification organization, payer enrollment, roster management, delegated credentialing, payer contract management, privileging, cross state licensing and ongoing monitoring, plus a credentialing alliance product sold to health plans. Buyer pages name provider groups, payers, health systems, revenue cycle organizations and digital health companies, and the company reports more than 300 healthcare organizations as customers. Licensing and verification work is described as national.

The named deployments sit at one end of that span. Headspace, a behavioral health company credentialing therapists and psychiatrists in all fifty states, WellBe Senior Medical, CareBridge and Family Care Center are the customer stories: digital health, home based and senior care, and provider groups. No health system or health plan customer is named, although both have their own buyer pages and the alliance product is sold to plans.

Coverage is named everywhere and supported for the provider group and digital health end. The Andros acquisition, which the company says brings more than a million providers across nearly 400 organizations and health plans onto its platform, will extend the plan and health system side when those customers move.