MedAware

The model is the product. MedAware exists because rule based interaction checking could not catch the error that motivated its founding, a wrong drug picked from an electronic prescribing list for a child, and the engine works by outlier detection over longitudinal patient data rather than by evaluating predefined rules. The models are learned from that data, and a prescription is flagged by how far it sits from the patterns they learn.

The published mechanism spans statistical outlier detection through deep learning with neural networks, with different algorithms applied to different error types, and the company compares the approach to fraud detection in financial services. David Bates of Brigham and Women's Hospital states the distinction in the vendor's own marketing, saying that because it is not rule based the system represents a paradigm shift. Remove the machine learning and no product remains.

Output is an alert to a prescriber or a pharmacist and the system never acts on a medication itself, so a licensed human stands between every model output and every patient. Two published numbers make the oversight picture legible: an alert burden of roughly 1.6 percent of medical orders, and a prescriber behavior change rate the company puts above 40 percent.

Alert burden matters more here than sensitivity, because the defining failure of medication decision support is the alert that fires so often it is dismissed, and a vendor willing to publish that denominator is answering the question the category actually turns on. The company also describes a standing human layer, with its own data analysts and clinical teams reviewing and refining the tools and combining the algorithms with statistical and clinical review. The threshold at which an alert fires is not published, the size and scope of that review layer is not described, and there is no escalation path for an alert nobody acts on.

The model family is named at a high level, unsupervised outlier detection with algorithms ranging from statistical methods to deep learning with neural networks. The limit is documented by an outside group rather than inferred. A Kyushu University Hospital group, writing in PLOS One in 2021 on unsupervised detection of overdose and underdose prescriptions, notes that the published Sheba evaluation of MedAware gives no information about the machine learning process, probably for commercial reasons.

Published material names no features, no training population, no alerting threshold, no calibration and no drift monitoring concept, which is a conspicuous gap for a system whose entire premise is that normal prescribing patterns shift over time and that anomaly is defined against them. There is no model description detailed enough for a third party to characterize where the system degrades.

MedAware's models are its own. The company describes its own engine of machine learning and outlier detection algorithms, built by a founding team of physicians and machine learning specialists, and names no outside model provider, so no third party model sits between a patient record and an alert.

Everything around the model is unstated: no hosting provider, no subprocessor list, no processing location, and no retention or training terms, for a platform that ingests longitudinal and real time prescriptions, laboratory results and demographics and runs continuously. Two questions follow from the method.

An outlier model learns what normal prescribing looks like from a population, and nothing says whose data the models learn from or whether a customer's own data joins that pool across institutions. And the company is based in Israel and serves United States health systems, which makes the unstated processing location matter.

Peer reviewed studies by hospital investigators at four sites, two of them prospective with the alerts firing live. At Sheba Medical Center, Segal and colleagues (JAMIA, 2019) ran the system on top of the hospital's existing decision support in a 38 bed internal medicine department for 16 months: 315 alerts on 282 of 78,017 prescriptions (0.4 percent), 89 percent judged accurate, and 135 alerts (43 percent) followed by a changed or stopped order.

At Wolfson Medical Center, a 600 bed hospital with no prior decision support, Naor and colleagues (Journal of Medical Systems, 2022) first tested models carried over from another center on 226,804 historical orders (2,731 alerts, 69 percent clinically relevant), then ran the system live: 399 alerts (1.6 percent of orders), 72 percent clinically relevant, 41 percent followed by a changed order; one author reports personal fees from MedAware.

At Brigham and Women's and Massachusetts General, Rozenblum and colleagues (Joint Commission Journal on Quality and Patient Safety, 2020) generated alerts retrospectively across 747,985 outpatients and reviewed a random 300: 79.7 percent clinically valid, 68.2 percent not flagged by the existing system, and an extrapolated $1.3 million in avoided direct costs.

An earlier Harvard Medical School group (JAMIA, 2017) found about 75 percent of alerts valid in a 300 chart sample; that study states it was funded by MedAware, with the company taking no part in chart review or analysis. The opioid use disorder algorithm was validated against two expert opinions on more than 649,000 outpatient records at above 93 percent accuracy.

No study is controlled, and harm and cost avoided are extrapolated rather than measured while the vendor markets outcome improvement. David Bates, an author in this literature, is also quoted in MedAware's marketing.

The platform ingests longitudinal and real time patient data including prescriptions, laboratory results and demographics, runs continuously rather than only at the point of ordering, and in at least one deployment operates natively inside the customer's Epic pharmacy workflow. That is a broad and persistent view of the record.

Published material describes what the system does with the data clinically without describing what happens to the data operationally: MedAware publishes no retention period, no de identification practice, no minimum necessary scoping and no statement of whether customer data contributes to model development across institutions.

That last question is not only about privacy, because an outlier detection method compares a prescription against patterns learned from a population, so what the population consists of shapes what the system flags. An Israeli company processing United States protected health information also raises a cross border handling question that nothing published addresses. Nothing is published on safety engineering either: how a wrong or missed alert is detected, reported and corrected.

No HIPAA status is stated anywhere MedAware publishes: no compliance claim, no business associate statement, no agreement and no HIPAA page on its site, blog or news archive. The site's cookie notice refers to a privacy policy, and a website policy does not reach the product unless it states a status.

MedAware serves United States health systems directly (Ballad Health) and physician practices through the athenahealth Marketplace; those deployments show that contracting took place, not what its terms are. One name collision to avoid: MedAware Solutions of St Louis (medawaresolutions.com) is an unrelated company, and its HIPAA language does not describe this vendor.

Retrieval across the vendor's own material surfaced no SOC 2 attestation of either type, no HITRUST certification, no ISO 27001, no trust center, no penetration testing cadence and no vulnerability disclosure policy. The nearest thing to external assurance is commercial rather than published.

Listing in the athenahealth Marketplace and native operation inside an Epic pharmacy workflow both imply that a partner conducted a security review, and Becton Dickinson is an investor, but a partner's private assessment is not something a buyer's security team can read. For a product that sits inside the pharmacy workflow of an acute care health system and holds a continuous view of prescribing data, this is the widest gap in the record and the fastest one to close.

MedAware claims no FDA clearance, which is consistent with a product that alerts a clinician rather than computing a dose or acting on a patient. Advisory medication risk alerting is the territory the Cures Act exclusion for non device clinical decision support was written to cover, so operating without clearance is a legitimate position rather than a deficiency. The gap is that the company states no position anywhere.

Products in this space are currently split between Class II clearance for software that computes a dose and public assertion of the exclusion, with the boundary between them the subject of an active petition to the agency, and nothing published says which reading MedAware applies.

The pointed absence is subgroup performance. MedAware publishes no accuracy by age, sex, race, ethnicity, insurance status or site, no bias assessment, no model governance documentation and no statement of how the system is monitored for degradation after deployment. The absence weighs more because one product scores patients for risk of opioid use disorder, where a score that performs worse for one group shapes who is offered or refused opioid therapy.

The published validation of that algorithm, above 93 percent accuracy on more than 649,000 outpatient records, is a whole population figure, not a breakdown by group. For the prescribing error models, the groups that plausibly change performance are age bands including pediatric patients, renal function and care setting, since what counts as an outlier is learned from the prescribing each group normally receives. None of those comparisons is published.

Two things stand behind the output. A licensed person acts on every alert: the system alerts a prescriber or pharmacist and never changes a medication itself. And the rate at which alerts are wrong is published with its method and denominator, in studies MedAware itself announced.

In Sheba Medical Center's prospective study (Segal and colleagues, JAMIA, 2019), the system ran live in a 38 bed internal medicine department for 16 months and staff assessed every alert: 315 alerts fired on 282 of 78,017 prescriptions (0.4 percent), about 280 of the 315 (89 percent) were judged accurate and about 252 (80 percent) clinically useful, and 135 (43 percent) were followed by a changed or stopped order. Sheba and MedAware announced those results together in August 2019.

In a retrospective study by Rozenblum and colleagues at Brigham and Women's and Massachusetts General (Joint Commission Journal on Quality and Patient Safety, 2020), clinicians reviewed a random 300 of 10,668 alerts on outpatient records and judged 239 (79.7 percent) clinically valid; MedAware announced it in December 2019. A buyer can hold a deployment to those figures. What is missing is anything that makes the vendor answerable: no warranty, indemnity or remediation commitment.

The failure that matters most is also unmeasured, since a missed dangerous prescription raises no alert and no miss rate is published. The models learn what normal prescribing looks like, and normal prescribing shifts with formularies and guidelines, yet the company describes neither how drift is monitored nor what the alert threshold is.

Integration is named and confirmed by customers rather than asserted. At Ballad Health the acute care pharmacy team began operating MedAware natively inside an Epic pharmacy workflow in October 2024, following a partnership announced in July 2023 and confirmed on the health system's own newsroom.

The platform is listed in the athenahealth Marketplace and integrated with athenaOne, a partnership with Allscripts dates to 2018, and a collaboration with Baxter extends the same safety layer toward infusion devices. Delivery is through vendor agnostic APIs designed to sit inside multiple partner ecosystems.

No FHIR conformance statement or public API documentation is published, the Allscripts relationship is eight years old with no current confirmation, and the named live footprint is small relative to the breadth the vendor agnostic framing implies.

MedAware publishes where the product appears to a clinician, not where it runs. It describes an engine delivered through vendor agnostic APIs into partner systems, with named deployments inside an Epic pharmacy workflow at Ballad Health and inside athenaOne through the athenahealth Marketplace.

Nothing states whether processing happens in the customer's environment or on MedAware's infrastructure, which cloud or region hosts it, whether an on premise option exists, or where patient data rests. With headquarters in Israel and customers in the United States, processing location is a live question for a health system privacy office, and one that tends to surface late in procurement. The named deployments show the integration runs in production, but they do not establish a hosting model.

Pricing is entirely undisclosed. MedAware publishes no price, no unit, no pricing mechanism, no contract shape and no implementation fee guidance. It sells directly to health systems and to physician practices through the athenahealth Marketplace, but nothing says what drives the cost on either route.

The same vendor participates in a peer reviewed cost analysis and publicizes an extrapolated $1.3 million in avoided direct healthcare costs from that work, so the return is public while the cost of obtaining it is not.

Coverage spans several settings rather than one. Inpatient acute care is confirmed by the Ballad Health pharmacy deployment, ambulatory care by the athenahealth Marketplace listing and by the Brigham and Women's and Massachusetts General outpatient datasets that produced the evidence base, and the company publishes material aimed at deprescribing in post acute and long term care.

Because the method is outlier detection over prescribing data rather than a condition specific model, specialty coverage follows the data rather than a defined indication list, so coverage does not depend on rules authored drug class by drug class. The named live customer base is small, the geographic footprint is limited to the United States and Israel, and pediatric performance is not separately addressed even though the founding case that motivated the company was a child.