NarxCare

Bamboo Health states the mechanism plainly. The Overdose Risk Score is derived from a logistic regression model built from historical monitoring data that evaluates ten inputs drawn from a patient's dispensation history and compares them with the histories of people who died of unintentional overdose, which makes it a learned component.

The Narx Scores alongside it are percentile ranked descriptive statistics against the home state's monitoring population rather than a learned model, and a large share of the product is interactive visualization of prescription history. So the platform is data presentation with one comparatively simple statistical model at its center. That model is nonetheless what the product is argued about and what changes clinical behavior. The model at the center of the controversy is a ten input logistic regression, so the opacity attached to it is a matter of publication policy rather than of technical complexity.

The designed oversight is explicit. Bamboo Health states that the Overdose Risk Score requires review by a healthcare professional exercising independent clinical judgment in the context of the patient's history, that the scores aid rather than replace medical decision making, and that none of the information should be the sole justification for providing or refusing medication; its patient page and training materials repeat it.

It also publishes the clinical factors the score cannot see, which tells the reviewing clinician what to add. The system never acts: a prescriber or pharmacist sees a report and decides. What is missing is the part that covers failure.

Nothing published describes how misuse of the score is detected, what happens when a score is wrong, or any escalation path, while a 2023 perspective in the Journal of General Internal Medicine argues that practice contradicts the caution and patients have described being refused pain treatment after a score was viewed (Wired, 2021). No measurement of whether that warning holds in practice is published.

The approach is named and the inputs are described. Bamboo Health states that the Overdose Risk Score is a logistic regression model evaluating ten inputs from monitoring data, such as prescriber counts, pharmacy counts and morphine milligram equivalents over varying windows, and that the Narx Scores are percentile ranked descriptive statistics against the home state's population.

Its NarxCare Application Overview (2023) sets out the report and analytics in enough detail that an outside group reconstructed comparable features from it, and Bamboo lists the clinical factors the model cannot see because monitoring data does not contain them: mental health and substance use conditions, respiratory, hepatic and renal conditions, and prior overdose history.

Nothing lets a buyer check the model or know when it changes: no coefficients, thresholds, calibration curve, observed event rate per score band or training population description, and no versioning or update practice. Researchers writing in npj Digital Medicine in 2026 still describe the score as a black box on that basis, and the documentation arrived after roughly a decade of national deployment rather than before it.

The model layer is Bamboo Health's own: the Overdose Risk Score is a logistic regression it built and runs, so no outside model provider sits between the record and the score. The host is named, Amazon Web Services, and the trust center says it reflects subprocessor disclosures, but no subprocessor list is published for a buyer to read, and no retention or training terms govern the data once it arrives.

The data is a longitudinal record of every controlled substance a person has been dispensed, and the repository belongs to the state program rather than to the provider organization or to Bamboo, so what a provider can require by contract is narrower than with a typical vendor.

Published research exists and is thin for a product used this widely. The one independent validation is Cochran and colleagues (Drug and Alcohol Dependence, 2021), run through the NIDA Clinical Trials Network in 19 pharmacies of a national chain in Ohio and Indiana: the narcotics score showed fair agreement with the WHO ASSIST screen (area under the curve at or above 0.70, kappa 0.35) and the authors call it a useful initial universal screener, while 17.2 percent of participants were false positives and 13.4 percent false negatives against that screen.

The Overdose Risk Score's own validation covers patients in Ohio, Michigan and Indiana only. A 2023 JAMIA paper calling for better validation of overdose risk algorithms notes that the score is therefore not validated for most of the patients it scores, has no subgroup analysis and has never been clinically evaluated, and a 2023 perspective in the Journal of General Internal Medicine notes that no study links Narx Scores to clinical outcomes.

Single site orthopedic work (JAAOS Global Research and Reviews, 2022, 1,136 knee replacement patients) associates higher admission narcotic scores with longer stays and readmission. The evidence is published and partly independent, with no outcome study and no validation of the overdose score outside three states.

Bamboo Health publishes categorical commitments without the schedule behind them. Its trust center states that it deletes customer data on request, and its privacy and security FAQs state that it signs a business associate agreement with every customer, receives and uses protected health information under that agreement, and follows the agreement's breach notification procedure; NarxCare is listed within the scope of its HITRUST and SOC 2 Type II reports.

What is not published is a retention window for monitoring data, whether any customer or state data is used to build or refit the models, and any de identification practice. The data is a longitudinal record of every controlled substance a person has been dispensed, and the repository is the state's. Nothing is published on safety engineering either: how a wrong score, a mismatched patient record or a misused report is detected and corrected.

Business associate status is stated company wide. Bamboo Health's privacy and security FAQs state that it enters a business associate agreement with every customer, that protected health information is received and used under that agreement, that it runs an internal HIPAA compliance program with annual third party assessments and penetration tests, and that breaches follow the notification procedure in the agreement.

Its trust center lists HIPAA among the standards it validates with external auditors, with NarxCare inside that scope. No agreement text, tier or execution path is published, so a buyer sees the commitment rather than the instrument. The interaction between HIPAA and the state statutes that govern prescription monitoring data is also not explained publicly, and it is the first question a provider's privacy office will ask, since the monitoring data belongs to the state program.

A public trust center at trust.bamboohealth.com names a SOC 2 Type II report and a HITRUST CSF validated assessment, both scoped to NarxCare among Bamboo Health's products and downloadable by approved customers through the portal, and states annual third party audits and annual third party penetration testing. The certification was first announced in 2021 for the monitoring platform components, including the AWARxE repository, the Clearinghouse, the Gateway and the Interconnect service.

Two things remain open. The clock: the latest dated HITRUST items posted are a validated assessment report from July 2023 and an interim letter from April 2024, so the current certification date is not posted; an updated SOC 2 Type II report is posted without its period stated. And no public vulnerability disclosure program or bug bounty is published.

The regulatory position is stated rather than left to inference, and it is actively contested. Bamboo Health has said that NarxCare falls within the exclusion from Food and Drug Administration oversight for non device medical software established by Congress, the Cures Act provision that turns on whether a clinician can independently review the basis of a recommendation.

In 2025 a clinician group petitioned the agency to conduct a formal review of whether the product qualifies as a regulated device, asked for guidelines governing risk scoring software used in clinical decisions, and asked that algorithms and methodologies be disclosed for independent review. More than a thousand comments were filed and the question is unresolved. The classification is open rather than settled, and the exclusion the company relies on depends on a reviewability claim that the published documentation does not fully support.

A published test shows where one of NarxCare's scores goes wrong across patient groups. Cochran and colleagues at the University of Utah and the University of Cincinnati (Drug and Alcohol Dependence, 2021), an independent evaluation that Bamboo Health announced in October 2021, compared the narcotics score with the WHO ASSIST screen in 1,395 adults collecting opioid prescriptions at 19 pharmacies in Ohio and Indiana: its false positives concentrated among patients reporting disability, poor general health and greater pain, and its false negatives among those reporting overdose history and substance use.

Bamboo also publishes the clinical factors its scores cannot see, including mental health and substance use conditions, respiratory, hepatic and renal conditions and prior overdose history, and states that the Overdose Risk Score does not predict an individual outcome. The gap is the learned model.

The Overdose Risk Score has no published subgroup results: a 2023 JAMIA paper calling for better validation of overdose risk algorithms states that no subgroup analysis of it exists, and the 2022 CDC opioid prescribing guideline warns that risk scores from proprietary algorithms that are not publicly available could produce biased results.

Its inputs, prescriber counts, pharmacy counts and travel patterns, track access to stable care as well as risk, so a patient who moves, loses a physician or lives far from a pharmacy can accumulate score without any change in behavior. Publishing the Overdose Risk Score's performance compared across age, sex, race and ethnicity, rurality and pain status would move this to A.

The scores come with published error rates a buyer can hold them to, from a study Bamboo Health itself announced. Cochran and colleagues at the University of Utah and the University of Cincinnati (Drug and Alcohol Dependence, 2021; NIDA Clinical Trials Network, NIH HEAL funded) compared the NarxCare narcotics score with the WHO ASSIST screen among adults collecting opioid prescriptions at 19 pharmacies of a national chain in Ohio and Indiana.

Of the 1,395 participants analyzed (ClinicalTrials.gov NCT03936985), 17.2 percent, about 240 people, scored moderate or high risk on NarxCare but low on the reference screen, and 13.4 percent, about 187, the reverse. Bamboo announced the study in its own October 2021 release. The figures cover the narcotics score against a self reported screen; nothing comparable is published for the Overdose Risk Score, and no study measures either score against overdose.

Behind the output a clinician decides, since Bamboo states the Overdose Risk Score requires review by a professional exercising independent judgment. What is missing is anything that makes the vendor answerable, and any route for the person scored: Bamboo's guidance to a patient who believes a score was misused is to raise it with the provider who viewed it, which sends the challenge to the party that acted on the number.

Integration is named, in production and read access. PMP Gateway, the managed service that carries NarxCare, embeds monitoring program data and scores in the clinical workflow: the record system sends a patient query and the report and scores return inside the EHR or pharmacy system.

Bamboo Health names Epic, Oracle Health, Meditech and eClinicalWorks among supported systems, eClinicalWorks and Elation list the integration on their own partner and help pages, and statewide integration programs in states including Connecticut, Florida and Minnesota run on it. PMP Interconnect moves data between state programs.

The flow returns a report for display rather than writing into the record, and no public FHIR conformance statement or open API specification is published, integration being delivered as a managed service.

Bamboo Health runs its platform on Amazon Web Services, named openly: its trust center cites AWS best practices alongside NIST 800-53 and says it uses AWS infrastructure and services where possible. That is a single hosted model.

The location is implied rather than committed: the data originates in state prescription monitoring repositories and the customers are United States states and providers, but no region, residency commitment or retention schedule is published, and the split of responsibility between the state owned repository and the Bamboo operated platform is not described in a way a provider organization could audit.

No price, unit, contract shape or implementation fee is published for the state platform or the facility product, but how NarxCare is sold and what decides who pays can be established from Bamboo Health's own material. States contract with Bamboo for the monitoring platform, and health systems and pharmacies reach NarxCare through PMP Gateway integration into their record systems.

Bamboo's integration materials for state programs, such as its Minnesota welcome packet, describe state funded integration, so whether a facility pays depends on its state. Executed state contracts are also public records anyone can retrieve, though that route is the state's disclosure rather than the vendor's.

Breadth of setting is exceptional and breadth of function is narrow. The score reaches emergency departments, primary care, dentistry, surgery, behavioral health and retail pharmacy across more than 40 states and territories, and it applies to every adult and pediatric patient with a controlled substance history rather than to a selected population. Validation covers part of that: the overdose score was validated on patients in three states and the narcotics score in pharmacies in two.

The product addresses one drug class through one data source, prescription monitoring records, and carries none of the clinical context that would let it speak to any other prescribing decision. There is no coverage outside the United States, since the product depends on a state monitoring infrastructure particular to the country.