NarxCare

Bamboo Health states the mechanism plainly, and stating it plainly lowers the grade rather than raising it. The Overdose Risk Score is derived from a logistic regression model that evaluates ten inputs drawn from a patient's dispensation history. The Narx Scores alongside it correspond numerically to PDMP data rather than being learned, and a large share of the product is interactive visualisation of prescription history.

So the platform is data presentation with one comparatively simple statistical model at its centre. That model is nonetheless what the product is argued about and what changes clinical behaviour, which is why this sits at B rather than lower. Worth stating for the category as a whole: the most contested algorithm in American prescribing is a ten input logistic regression, so the opacity attached to it is a matter of publication policy rather than of technical complexity.

By design the oversight model is correct and stated more forcefully than most. Every document carries the same caution, that NarxCare is intended to aid rather than replace medical decision making and that none of the information should be used as sole justification for providing or refusing medications, and the company's patient facing page repeats it. The gap is between designed autonomy and operational autonomy.

Peer reviewed work argues that daily practice contradicts the disclaimer, clinicians quoted in medical press note that a large bold three digit score conveys more precision and authority than it has earned, and patients have reported being refused pain treatment after a score was viewed. Nothing published describes a mechanism for detecting whether the caution is being followed, and the product's own presentation works against it. A vendor whose disclaimer is load bearing has an interest in measuring whether the disclaimer holds, and that measurement does not appear to exist.

More is published than the black box framing suggests, and less than external validation requires. Bamboo Health names the model class as logistic regression, states that it uses ten inputs from PDMP data, released a NarxCare Application Overview in September 2023 detailed enough that an outside group was later able to reconstruct comparable features from it, and explicitly lists clinical factors the model cannot see because PDMP data does not contain them, including mental health conditions, substance use conditions, respiratory, hepatic and renal conditions and prior overdose history.

That last disclosure is a genuine and uncommon statement of a model's own blind spots. What is absent is everything needed to check it: no coefficients, no thresholds, no calibration curve, no per score observed event rate and no training population description. Researchers publishing in npj Digital Medicine in 2026 still characterise the score as a black box on that basis. Timing matters to the grade too, since the documentation arrived after roughly a decade of national deployment and sustained professional criticism rather than before it.

The handling arrangements here are more formal than anywhere else in this category, which follows from what the data is and who owns it. The operator runs the platform for more than forty state and territory monitoring programmes under government contracts, so the flows are governed by state statute as well as by federal privacy rules, and the underlying repository belongs to the state rather than to the health system or the vendor.

Independent certification covers the platform components and sub processor disclosures are published through a trust centre, which is the artifact this axis asks for and which most vendors in this index decline to provide. The content is among the most sensitive anywhere in the index: a longitudinal record of every controlled substance a person has been dispensed.

Held below the top grade because the model layer is named only by class and the data chain most relevant to a buyer runs through parties they cannot negotiate with. A provider organisation is not the controller in the usual sense, so what it can require by contract is narrower than it would be for a commercial vendor, and a buyer should understand which questions are answerable by the operator and which sit with the state programme. Ask for the sub processor list, and establish which entity holds the obligation to the person scored.

Evidence exists and is badly mismatched to the scale of deployment. A peer reviewed study found the Narx Score metric could serve as a useful initial universal prescription opioid risk screener, and a validation reported a false positive rate of 17.2 percent and a false negative rate of 13.4 percent, figures a clinician quoted in Annals of Emergency Medicine characterised as close to a third of patients misclassified against a usual screening standard above 90 percent.

Against that, a 2023 analysis in JAMIA makes three specific charges: the validation cohort is a subset of patients in Ohio, Michigan and Indiana, so the score is not technically validated for the large majority of patients it is applied to; there has been no subgroup analysis; and the score has never been clinically evaluated, meaning no study establishes that using it improves an outcome.

Constructive local evidence does exist, including orthopaedic work associating higher scores with longer stays and readmissions that a department used to trigger pain management consults rather than to withhold treatment. The grade reflects the distance between a national footprint and an evidence base of this size.

The data handled here is among the most sensitive in the index, a longitudinal record of every controlled substance a person has been dispensed, and the handling arrangements are correspondingly formal. Bamboo Health operates the platform for more than 40 state and territory monitoring programmes under government contracts, so the flows are governed by state statute as well as by federal privacy rules, and the company's monitoring platform components carry HITRUST certification with subprocessor disclosures published through a trust centre.

Two points a buyer should carry. The health system is not the data controller in the usual sense, since the underlying repository belongs to the state, which changes what a provider organisation can negotiate. And the person scored has no described route to see or contest their own score, with the company's guidance to patients being to raise concerns with the provider who viewed it.

HIPAA appears inside an audited control set rather than as a standalone assertion, which is the stronger form. The company's trust centre names HIPAA alongside NIST 800-53, HITRUST and SOC 2 as standards validated with external auditors, and its support documentation describes an internal HIPAA compliance programme backed by annual third party assessments. Held below the top grade for two reasons.

No business associate agreement text, tier or execution path is published, so a buyer sees the claim rather than the instrument. And the interaction between HIPAA and the state statutes that actually govern prescription monitoring data is not explained anywhere public, which is the question a provider organisation's privacy office will ask first and the one this vendor is best placed to answer.

This is the strongest axis on the record and among the stronger security postures in the index. A public trust centre at trust.bamboohealth.com presents an updated SOC 2 Type II report with the type specified, HITRUST certification with interim and updated letters, alignment to NIST 800-53, and subprocessor disclosures, and states that documents are refreshed as audits complete.

The certification was first announced in 2021 and named the monitoring platform components specifically, including the AWARxE repository, the Clearinghouse, the Gateway and the Interconnect service, rather than being claimed at company level. Support documentation additionally states annual third party security assessments and penetration tests, which is the cadence question most vendors leave unanswered.

Scope stated per index practice: the trust centre was confirmed to exist and its summary contents read, while the certification report itself is gated to approved customers and was not accessed. No public vulnerability disclosure programme or bug bounty was located, which is the one remaining gap.

The regulatory position is stated rather than left to inference, which earns credit, and it is actively contested, which caps the grade. Bamboo Health has said that NarxCare falls within the exclusion from Food and Drug Administration oversight for non device medical software established by Congress, the Cures Act provision that turns on whether a clinician can independently review the basis of a recommendation.

In 2025 a clinician group petitioned the agency to conduct a formal review of whether the product qualifies as a regulated device, asked for guidelines governing risk scoring software used in clinical decisions, and asked that algorithms and methodologies be disclosed for independent review. More than a thousand comments were filed and the question is unresolved.

A buyer should treat the regulatory classification of this product as open rather than settled, and should note that the exclusion the company relies on depends on a reviewability claim that the published documentation does not fully support.

The absence that matters most is subgroup performance, and it is absent at a scale nothing else in this index approaches. Informatics literature states directly that no subgroup analysis of the score has been published, while the Centers for Disease Control and Prevention has warned that risk scores generated by proprietary algorithms that are not publicly available could produce biased results and that monitoring programme data has contributed to patients being dismissed from clinical practices.

The scored inputs deserve particular scrutiny on this point, because prescriber counts, pharmacy counts and travel patterns track a patient's access to stable care at least as closely as they track risk, so a patient who moves, who loses a physician, or who lives far from a pharmacy can accumulate score without any change in behaviour.

Credit is due for one real disclosure, the published list of clinical factors the model cannot see, and for the repeated statement that the score is not predictive of an individual outcome. There is also no described route for a patient to view or challenge a score attached to them. Publishing stratified performance would change this grade faster than anything else and the data to do it exists.

One disclosure on this record is genuinely uncommon and deserves crediting before anything else: the operator explicitly lists clinical factors the model cannot see because the underlying prescription monitoring data does not contain them, including mental health conditions, substance use conditions, respiratory, hepatic and renal conditions and prior overdose history.

A published statement of a model's own blind spots is rarer than an accuracy figure and more useful to the clinician reading a score, because it tells them what the number is not accounting for in the patient in front of them. The model class is named as logistic regression with a stated number of inputs, and an application overview was released detailed enough that an outside group later reconstructed comparable features from it. Held at C on two grounds.

Nothing published permits checking: no coefficients, no thresholds, no calibration curve, no observed event rate per score band and no training population description, and researchers continue to characterise the score as a black box on that basis. And the documentation arrived after roughly a decade of national deployment and sustained professional criticism rather than before it. The recourse position is the sharpest in this category and should be stated plainly.

A person scored has no described route to see or contest their own score, and the guidance offered is to raise concerns with the provider who viewed it, which asks the affected person to appeal to the party that acted on the number. Ask for calibration by score band and for a patient facing correction route.

Integration depth here is close to the practical ceiling for a United States clinical product. PMP Gateway is a managed service platform delivering monitoring programme data, analytics and tools into care team workflows inside electronic health records and pharmacy management systems in real time at the point of care, and the underlying platform runs for more than 40 state and territory programmes.

Reach extends to hundreds of healthcare facilities and, on the company's account, five of the six largest pharmacy retailers, which means the same score surfaces in the prescribing workflow and again in the dispensing workflow for the same patient. PMP Interconnect additionally moves data between state programmes, which is the interoperability problem that made a national view possible at all. The one documentation gap is that no public FHIR conformance statement or open API specification was located, integration being delivered as a managed service rather than as a published interface.

The architecture is disclosed further than most vendors in this index manage. Hosting is on Amazon Web Services, named openly, with the trust centre citing adherence to that provider's best practices alongside NIST 800-53 controls, and the company offers to supply the hosting provider's own SOC 2 reports under a non disclosure agreement.

Deployment is inherently United States domestic, since the data originates in state prescription monitoring repositories, which answers the residency question in practice even though it is not framed that way. Held at B because no explicit data residency commitment, region statement or retention schedule was located in publicly readable form, and because the split of responsibility between the state repository and the vendor operated platform is not described in a way a provider organisation could audit.

The vendor publishes no price, unit, contract shape or implementation fee, and none was located for either the state platform or the facility level product. What lifts this above the usual undisclosed grade is the channel rather than the vendor.

The dominant route to market is government procurement, so state contracts for prescription monitoring platforms are matters of public record and a determined buyer can retrieve executed contract values, terms and durations from state procurement systems without the vendor's participation. That is a genuine price discovery path available in almost no other category in this index.

Graded C rather than higher because it is an accident of the buyer being a government rather than a disclosure the company chose to make, and because facility level pricing for the clinical product sits outside that channel and remains opaque.

Breadth of setting is exceptional and breadth of function is narrow, and the grade reflects both. The score reaches emergency departments, primary care, dentistry, surgery, behavioural health and retail pharmacy across more than 40 states and territories, which is the widest deployment footprint of any product graded in this index, and it applies to every adult and paediatric patient with a controlled substance history rather than to a selected population.

Against that, the product addresses one drug class through one data source, prescription monitoring records, and carries none of the clinical context that would let it speak to any other prescribing decision. There is no coverage outside the United States, since the product depends on a state monitoring infrastructure that exists nowhere else in this form.