ModMed

This is an EHR and practice management company adding an AI layer, not an AI native platform, and the distinction matters for a buyer. The core purchase is EMA or gGastro, a specialty specific cloud EHR with practice management, revenue cycle, analytics, and patient engagement.

The AI is real and shipping, notably ModMed Scribe for ambient documentation and a set of assistants for scheduling, eligibility, prior authorization, and denial appeals, but a practice selects ModMed for the EHR and inherits the AI. Removing the AI leaves a substantial product; removing the EHR leaves nothing.

The review gate is stated explicitly and consistently, which is the right posture for documentation and coding. Scribe translates conversation into suggested visit notes, prescriptions, lab orders, and suggested ICD-10 codes, with the company stating the provider remains in control to review and approve them after. The company frames the broader assistant set as handling repetitive lower value tasks while keeping the practice fully in control of decision making. The assistants that execute multistep prior authorization and denial appeal workflows are the ones where autonomy is highest and published oversight detail is thinnest.

One unusually specific disclosure, and otherwise little. The company states Scribe was trained on real de identified clinical data sampled from over 750 million patient encounters and developed with on staff specialty physicians, which is a concrete and checkable provenance claim about training data that most scribe vendors do not make.

No model architecture, foundation model provider, or accuracy benchmark is published, and the note that results may vary based on practice size and product usage is the only performance qualifier offered.

One disclosure carries this record and it is about the corpus rather than the chain. The company states the scribe was trained on real de identified clinical data sampled from more than 750 million patient encounters and developed alongside on staff specialty physicians.

That is a concrete provenance claim most vendors in this lane do not make, and for a record system vendor it also answers, by implication, a question competitors dodge: the training corpus is derived from the installed base, meaning customer encounters do feed the model with de identification as the mitigation. Stating that plainly is worth crediting even though the vendor frames it as a strength rather than as a disclosure. Everything else is missing.

No foundation model provider, model class, version or update policy is named, no hosting or cloud arrangement is published for this capability, and no sub processor list was located. So a buyer knows what the model learned from and nothing about who is involved in running it. Ask for the sub processor list, and ask specifically whether a customer can decline to have its own encounters included in future training.

Evidence is customer anecdote and market ranking rather than measured study. The company claims specialty physicians finish notes in less than an hour, footnoted that results may vary, and publishes customer stories such as a practice saving two hours a day. Historical third party recognition exists in the form of top Black Book EHR rankings across dermatology, ophthalmology, plastic surgery, otolaryngology, and urology, but those rate the EHR rather than the AI. No controlled evaluation of documentation accuracy or time savings was located.

The training data disclosure is the substantive signal here: the company states Scribe was trained on de identified clinical data, which addresses the question buyers most often fail to ask a scribe vendor. As an EHR vendor the company is necessarily a business associate handling PHI at scale under existing customer agreements. What is not published is the AI specific stewardship posture, meaning retention of ambient audio, whether customer encounters feed future model training, and opt out mechanics.

No HIPAA compliance statement and no business associate agreement terms were located in the company's own published materials. Business associate status is structurally certain for a certified electronic health record serving thousands of United States providers and agreements exist contractually, but this axis grades published commitments rather than structural inference.

The asymmetry is worth naming, and it is the fourth instance of a pattern this index keeps finding. ModMed publishes buyer education on protecting sensitive health data, a practical checklist covering encryption, passwords, access review, offboarding and public network use, addressed to what a practice should do. It publishes no equivalent account of what it does with the records it holds on that practice's behalf. The guidance is accurate and useful and the company is better placed than most to close the gap. It joins AKASA on pricing methodology, Adonis on SOC 2 and mdhub on substance use confidentiality: sound advice about a standard the vendor's own public material does not meet.

For a practice, the BAA is obtainable through the sales process. The point is that nothing is knowable before entering it.

No SOC 2, HITRUST or ISO 27001 attestation was located in the company's own published materials, and no trust centre was found.

What does exist and is worth crediting: a published security disclosures page carrying a coordinated vulnerability disclosure programme, with a named reporting route for both customers and outside security researchers. Very few vendors in this index publish one, and it is a real signal about how the company handles findings against it. It is not an attestation and does not substitute for one.

The gap is wide for a vendor of this shape. This is a certified electronic health record holding complete patient records for thousands of United States practices across eleven specialties, and a practice cannot self serve any independent assurance about how those records are protected. Ask for the attestation, its type, its period and the systems in scope.

One separation to keep clear, because this vendor invites the confusion by holding real credentials elsewhere: ONC health IT certification is functional and interoperability assurance, and its Decision Support Intervention criterion is AI governance. Neither is an information security attestation, and the presence of both makes the absence of the third easier to overlook.

No FDA pathway applies to documentation, scheduling or administrative automation, and none is claimed.

Graded B rather than C because a real regulatory regime does govern this vendor and it holds the credential for it. The relevant surface is ONC health IT certification and the information blocking rules that attach to certified electronic health record technology, which is a different framework from the Software as a Medical Device pathway this axis usually assesses. A certified vendor is subject to ongoing surveillance, real world testing and public reporting obligations, and its certification status is publicly checkable in a way most vendors in this index cannot match.

The distinction to keep clear, and it is recorded separately on the security axis: ONC certification is functional and interoperability assurance. It is not an information security attestation and the two should not be conflated.

ModMed certified its EMA electronic health record to the ASTP and ONC Decision Support Intervention criterion in January 2025, and states that ModMed Scribe is the technology central to that certification. This is a real and externally audited AI governance regime, and it is the strongest such credential available to a certified electronic health record developer.

What it requires is specific. A developer supplying a predictive decision support intervention must make 31 source attributes available to end users, spanning intervention purpose and cautioned out of scope use, development details and input features, the process used to ensure fairness in development, external validation, quantitative measures of performance, ongoing maintenance, and the schedule for continued validation and fairness assessment. Separately it must apply intervention risk management covering risk analysis, risk mitigation and governance, with the analysis reaching the topics named in the NIST AI Risk Management Framework including validity, robustness, fairness, intelligibility, safety, security and privacy, and it must publicly disclose summary information about those practices. The stated purpose of the attribute set is to let a buyer judge whether a predictive intervention is fair, appropriate, valid, effective and safe.

Held at B rather than A because the regulation requires the information to be made available to users, not published, and no subgroup performance results were retrieved in public material. Publishing subgroup results remains the route to A on this axis. A buyer should request the source attribute set and the risk management summary by name, since both exist as a condition of the certification rather than as a courtesy.

Separately worth noting: the scribe is stated to be trained on de identified data sampled from 750 million patient encounters across eleven specialties, which makes subgroup evaluation feasible here in a way it is not for a smaller vendor. Specialty is the obvious first cut, given the product is sold on being specialty specific.

Two passes located no accuracy or error figure, no published limitations, no warranty, indemnity or remediation commitment for this capability. The only performance qualifier published is that results may vary based on practice size and product usage, which is a disclaimer rather than a characterisation and tells a buyer nothing about where the system degrades.

The training provenance disclosure elsewhere on this record is specific and checkable, which makes the absence of any output commitment more conspicuous rather than less: the company is willing to describe what the model learned from and unwilling to say how often it is right. One line of enquiry is worth pursuing here that does not arise for standalone scribes.

This capability is delivered inside certified health information technology, and that certification programme carries transparency obligations for certain categories of decision support functionality supplied to users. Whether ambient documentation falls inside that scope is a genuine question rather than a settled one, and it is worth putting to the vendor, because if it does there is a disclosure obligation that exists independently of what the vendor chooses to publish. Ask that, and ask what the contract says when a generated note is wrong.

The vendor is the EHR, which is the deepest possible integration and the core of the value proposition. The company states the AI is built directly into EMA with no additional software or integrations required, so approved note content flows into prescriptions and lab orders without a handoff, and clinical charts link directly to practice management and billing.

Electronic prior authorization runs inside the EHR through a partnership arrangement, and the company is a member of CommonWell Health Alliance for external data exchange. The tradeoff a buyer should weigh is that this depth is only available by adopting the EHR itself.

Cloud based and iPad native by design, which the company states plainly as the delivery model. No data residency, tenancy isolation, or hosting detail was located beyond the cloud characterization.

No published pricing for the platform or the AI modules. The company directs buyers to contact sales for implementation packages and associated fees, and separately promotes conference rate offers, so a practice cannot estimate either the licence cost or the incremental cost of the AI layer without engaging sales.

The incremental question is the one that matters for a practice already on this platform. An existing customer evaluating the AI layer is not making a competitive purchase, and nothing published tells them what the addition costs relative to what they already pay.

Specialty depth is the company's central differentiator and it is substantiated. The company states it offers software for eleven medical specialties, with named specialty products and protocol libraries spanning dermatology, ophthalmology, orthopedics, gastroenterology through the separate gGastro platform, urology, otolaryngology, plastic surgery, pain management, allergy, OBGYN, and podiatry, and the scribe products are specialty tuned rather than generic. The setting is ambulatory specialty practice, from solo independents to large groups; this is not a hospital or health system product.