ModMed

This is an EHR and practice management company adding an AI layer, not an AI native platform, and the distinction matters for a buyer. The core purchase is EMA or gGastro, a specialty specific cloud EHR with practice management, revenue cycle, analytics, and patient engagement.

The AI is real and shipping, notably ModMed Scribe for ambient documentation and a set of assistants for scheduling, eligibility, prior authorization, and denial appeals, but a practice selects ModMed for the EHR and inherits the AI. Removing the AI leaves a substantial product; removing the EHR leaves nothing.

The review gate is stated explicitly and consistently, which is the right posture for documentation and coding. Scribe translates conversation into suggested visit notes, prescriptions, lab orders, and suggested ICD-10 codes, with the company stating the provider remains in control to review and approve them after. The company frames the broader assistant set as handling repetitive lower value tasks while keeping the practice fully in control of decision making. The assistants that execute multistep prior authorization and denial appeal workflows are the ones where autonomy is highest and published oversight detail is thinnest.

One specific disclosure, and otherwise proprietary is asserted rather than explained. The company states Scribe 2.0 runs on proprietary, specialty trained models, trained on real de identified clinical data sampled from over 750 million patient encounters and developed with on staff specialty physicians using specialty synonym libraries, which is a concrete and checkable provenance claim about training data.

No model architecture, foundation model, version, update practice or accuracy benchmark is published, and the note that results may vary based on practice size and product usage is the only performance qualifier offered.

The corpus is described and the parties are not. The company states that ModMed Scribe 2.0 runs on proprietary, specialty trained models built natively within its EHR, trained on de identified real world clinical data sampled from more than 750 million encounters, with specialty synonym libraries developed by practicing physicians. For a record system vendor that also answers, by implication, whether customer encounters feed the model: the training corpus is derived from the installed base, with de identification as the mitigation.

Everything about who runs it is missing. No foundation model, hosting arrangement or subprocessor for the AI assistants is named. The privacy policy refers only to unnamed third party hosting providers, and says voice recordings made through the EHR's speech to text module may be collected by a dictation service provider and used to improve dictation, without naming the provider or saying whether the same arrangement applies to the scribe.

Evidence is customer anecdote and market ranking rather than measured study. The company claims specialty physicians finish notes in less than an hour, footnoted that results may vary, and publishes customer stories such as a practice saving two hours a day. Historical third party recognition exists in the form of top Black Book EHR rankings across dermatology, ophthalmology, plastic surgery, otolaryngology, and urology, but those rate the EHR rather than the AI. There is no controlled evaluation of documentation accuracy or time savings.

Training use is described and nothing about retention is. ModMed states that Scribe 2.0 is trained on de identified real world clinical data sampled from more than 750 million encounters, which tells a buyer that customer encounters feed model development after de identification. The privacy policy adds that de identified information may be used for any lawful purpose and shared in all legally permissible ways, and that voice recordings made through the EHR's speech to text module may be collected by a dictation service provider and used to improve dictation.

That is a permission rather than a safeguard, and the questions central to an ambient product are unanswered: how long audio is retained after the note is suggested, whether it is deleted, how de identification is performed, and whether a practice can opt its encounters out of training. No safety engineering is published: no guardrails, hallucination mitigation or handling of a safety event.

No business associate status or agreement terms are published. The privacy policy, dated January 2025, says only that ModMed's use of protected health information received through its systems is governed by its agreements with providers and by applicable law including HIPAA, and directs patients to their provider for anything concerning that information. That is a reference to the regime rather than a statement of the company's role or terms.

A certified electronic health record serving specialty practices across the United States will hold business associate agreements with its customers, but nothing about their terms, scope or subcontractor coverage can be read before a sales conversation. The company does publish buyer education on protecting health data, addressed to what a practice should do, with no equivalent account of its own obligations.

No SOC 2, HITRUST or ISO 27001 attestation and no trust center is published in the company's own material.

What does exist: a published security disclosures page carrying a coordinated vulnerability disclosure program, with a named reporting route for both customers and outside security researchers. It is a real signal about how the company handles findings against it, and it is not an attestation.

The gap is wide for a vendor of this shape. This is a certified electronic health record holding complete patient records for specialty practices across the United States, now running AI assistants over them, and a practice cannot self serve any independent assurance about how those records are protected.

One separation to keep clear, because this vendor holds real credentials elsewhere: ONC health IT certification is functional and interoperability assurance, and its Decision Support Intervention criterion is AI governance. Neither is an information security attestation, and the presence of both makes the absence of the third easier to overlook.

No FDA pathway applies to documentation, scheduling or administrative automation, and none is claimed.

A real regulatory regime does govern this vendor, and it holds the credential for it. The relevant surface is ONC health IT certification and the information blocking rules that attach to certified electronic health record technology, which is a different framework from the Software as a Medical Device pathway. A certified vendor is subject to ongoing surveillance, real world testing and public reporting obligations, and its certification status is publicly checkable.

One distinction to keep clear: ONC certification is functional and interoperability assurance. It is not an information security attestation and the two should not be conflated.

ModMed certified its EMA electronic health record to the ASTP and ONC Decision Support Intervention criterion in January 2025, and states that ModMed Scribe is the technology central to that certification. This is a real and externally audited AI governance regime, and it is the strongest such credential available to a certified electronic health record developer.

What it requires is specific. A developer supplying a predictive decision support intervention must make 31 source attributes available to end users, spanning intervention purpose and cautioned out of scope use, development details and input features, the process used to ensure fairness in development, external validation, quantitative measures of performance, ongoing maintenance, and the schedule for continued validation and fairness assessment. Separately it must apply intervention risk management covering risk analysis, risk mitigation and governance, with the analysis reaching the topics named in the NIST AI Risk Management Framework including validity, robustness, fairness, intelligibility, safety, security and privacy, and it must publicly disclose summary information about those practices. The stated purpose of the attribute set is to let a user judge whether a predictive intervention is fair, appropriate, valid, effective and safe.

The regulation requires the information to be made available to users, not published, and no subgroup performance results appear in public material. The source attribute set and the risk management summary exist as a condition of the certification rather than as a courtesy, so customers can obtain both.

The scribe is stated to be trained on deidentified data sampled from 750 million patient encounters across eleven specialties.

Review before commit is published and nothing stands behind the output. ModMed describes Scribe as producing suggested visit notes, prescriptions, lab orders and billing codes for the provider's review, and its AI assistants as surfacing recommendations for final approval, with every action grounded and cited. That is a real mechanism for catching an error before it reaches the chart or a claim.

The company publishes no accuracy or error figure, limitation, warranty, indemnity or remediation commitment. The published performance qualifier, that results may vary based on practice size and product usage, is a disclaimer rather than a characterization. The company describes in detail what the model learned from and says nothing about how often it is right, and customer quotes about remarkable accuracy are testimony rather than measurement.

One point applies to ModMed in particular. The scribe is stated to be central to the EHR's certification under the decision support intervention criterion, which requires source attributes including quantitative performance measures to be made available to users. Those measures exist as a condition of certification even though they are not published.

The vendor is the EHR, which is the deepest possible integration and the core of the value proposition. The company states the AI is built directly into EMA with no additional software or integrations required, so approved note content flows into prescriptions and lab orders without a handoff, and clinical charts link directly to practice management and billing.

Electronic prior authorization runs inside the EHR through a partnership arrangement, and the company is a member of CommonWell Health Alliance for external data exchange. The tradeoff is that this depth is only available by adopting the EHR itself.

Cloud based and iPad native by design, which the company states plainly as the delivery model. Beyond that cloud characterization, it gives no data residency, tenancy isolation or hosting detail.

No published pricing for the platform or the AI modules. The company directs buyers to contact sales for implementation packages and associated fees, and separately promotes conference rate offers, so a practice cannot estimate either the license cost or the incremental cost of the AI layer without engaging sales.

The incremental question is the one that matters for a practice already on this platform. An existing customer evaluating the AI layer is not making a competitive purchase, and nothing published tells them what the addition costs relative to what they already pay.

The practice management systems carry AI assistants for scheduling, eligibility processing, prior authorization and claim denial appeals, with recommendations surfaced for staff approval. Specialty depth is the company's central differentiator and it is substantiated.

The company states it offers software for eleven medical specialties, with named specialty products and protocol libraries spanning dermatology, ophthalmology, orthopedics, gastroenterology through the separate gGastro platform, urology, otolaryngology, plastic surgery, pain management, allergy, OBGYN, and podiatry, and the scribe products are specialty tuned rather than generic. The setting is ambulatory specialty practice, from solo independents to large groups; this is not a hospital or health system product.