Navina

Proprietary language models do the core work. The company describes automatically classifying document types such as consult notes and imaging reports, using its own language models to extract and structure information including ICD-10 codes and clinical dates from free text, and applying segmentation algorithms to handle long multi document records.

Most consequentially it surfaces suspected chronic conditions never explicitly documented before by parsing evidence across notes, imaging, medications, labs, and vitals. Inferring an undocumented condition from scattered evidence is not a retrieval task.

The design principle is that every insight carries its evidence, and the company builds its trust argument on exactly that. Each diagnosis suggestion is backed by clinical evidence linked to the original source, presented at the point of care for the clinician to accept or reject with one click documentation. Customer physicians specifically cite the evidence backing as what builds trust in the software. For a system suggesting diagnoses that raise risk scores and revenue, making every suggestion traceable to source is the control that separates decision support from upcoding pressure.

Architecture is described with real specificity: proprietary language models rather than a generic wrapper, document type classification, structured extraction of codes and dates from free text, and segmentation for long complex records. The company publishes an explicit position against black box models, stating insights are clearly explained and directly referenced to original clinical sources.

What is not published is model performance measurement, validation methodology, or accuracy of the suspected condition inference, which is the number that matters most given what those inferences drive.

The architecture is described specifically and the corpus is described in a way that raises the question it appears to answer. On architecture the disclosure is real: proprietary language models rather than a generic wrapper, document type classification, structured extraction of codes and dates from free text, and segmentation for long complex records, alongside an explicit published position against black box models with insights referenced back to original clinical sources.

On the corpus the company states its models are trained on meticulously curated datasets representative of the full spectrum of society, incorporating data from different geographic locations, socioeconomic backgrounds and health conditions. That is a claim about composition made with no statement of provenance: where the data came from, on what legal basis it was obtained, or whether customer patient records join it.

A vendor that describes the quality of its training data owes a buyer an account of its origin, and the more carefully the composition is characterised the more conspicuous the silence about the source becomes. Nothing else is enumerated: no base model or provider, no hosting arrangement, no sub processor list, and no residency statement, alongside no retention period, deletion procedure or end of contract disposition. Ask where the training corpus came from, whether your patients' records train or improve the models, and for a retention schedule in writing.

Quantified customer outcomes at named organizations, though vendor reported. Published figures include 70 percent time saved, 23 percent more diagnoses per visit, and 38 percent higher risk scores, with a named customer reporting 97 percent clinician adoption, 41 percent more conditions surfaced, and 94 percent of clinical insights addressed. Case studies span a multi specialty group and a large ACO.

Buyers should read the risk score figures carefully: higher RAF is the customer's commercial objective but is not by itself evidence of better care, and no published analysis separates appropriate condition capture from score inflation.

Access control is described and the description is specific: least privilege applied rigorously, multi factor authentication, encryption, and a stated commitment to strict data governance, sitting on top of ISO 27001 and SOC 2 Type II certification with annual third party audits. For controlling who reaches the data, this is a credible position.

What is missing is the whole of the data lifecycle. No retention period, no deletion procedure, no end of contract data disposition, no residency statement, no subprocessor list, and no statement on whether patient data processed through the platform is used to develop or improve the company's models.

That last omission is the one to press, because the company makes an affirmative claim that depends on it. Navina states that its models are trained on meticulously curated datasets representative of the full spectrum of society, incorporating data from different geographic locations, socioeconomic backgrounds and health conditions. That is a claim about the composition of a training corpus, and it is made without any statement of provenance: where the data came from, on what legal basis it was obtained, or whether customer patient records join it. A vendor that describes the quality of its training data owes a buyer an account of its origin.

Buyers should ask for the retention schedule in writing, ask directly whether their patients' records train or improve the models, and ask where the existing training corpus came from.

Navina states that its platform was built with strict data governance and HIPAA compliance, and that it ensures strict compliance with HIPAA and other relevant regulations. The claim is clear and is made prominently rather than buried.

What is entirely absent is the instrument. No business associate agreement, template or summary of terms was located, the company does not identify itself as a business associate in any retrieved material, and nothing describes how the relationship with a contracting practice or health system is documented. This is the pattern of asserting the outcome without describing the mechanism, and it is the single most common gap this index has found.

It is more consequential here than for a reference product, because Navina reads directly from the patient chart to generate its insights. A vendor processing identifiable clinical records on behalf of a provider organisation is a business associate as a matter of law, so the agreement exists somewhere; it is simply not visible to a buyer before they enter a sales process.

The surrounding assurance is real, with ISO 27001 and SOC 2 Type II certification and annual third party audits, which is why this is not the weakest form of the gap. Buyers should request the business associate agreement early and ask whether its terms are negotiable.

Navina states that it holds ISO 27001 certification and SOC 2 Type II, with the type named, and that annual evaluations by third party auditors reinforce its adherence to those standards. Named controls include the principle of least privilege and multi factor authentication. The company also employs a chief information security officer with prior experience in the same role elsewhere, and its engineering leadership comes from established security companies, which is context rather than assurance but is worth recording for a buyer weighing organisational maturity.

Two independent certifications with an annual audit cadence is a solid position and sits comfortably above vendors making unevidenced alignment claims.

Held below the top band mainly on where the disclosure lives. These certifications appear in a marketing article about the company's approach to clinical artificial intelligence rather than on a dedicated security or trust page, so a buyer's security reviewer looking in the ordinary places would not find them. No trust centre exists, no certificate is published as a document with its scope and expiry, no penetration testing statement was located, and no subprocessor list is published.

Buyers should request the current ISO certificate and SOC 2 report with their scope sections, ask which systems and entities fall inside the assessment boundary, and ask when each audit period closed.

No clearance, authorisation or published regulatory position was located. The grade reflects the absence of a stated position rather than a judgement that clearance is required.

The product's design supports a clinical decision support exclusion argument under the 21st Century Cures Act, and supports it well. Every insight the platform surfaces is linked back to the underlying clinical evidence in the chart, and the company positions this explicitly against black box models. A clinician who can see which document produced a suggestion is in the position the exclusion contemplates, and a customer quotes exactly that property as the reason the tool earned trust.

The complication is commercial rather than technical, and it should be stated as structure rather than as accusation. A central published benefit of this platform is improved risk adjustment factor accuracy, which directly increases the payment a value based care organisation receives. A system that surfaces diagnoses a clinician might otherwise not have documented is doing something clinically useful and something financially useful at the same time, and those two purposes are not separable in the output. The index has recorded the same structure elsewhere in coding and documentation products.

Buyers should ask the company to state its regulatory position in writing, and should ask separately what governance exists over the diagnosis suggestions themselves: how acceptance rates are monitored, and whether any review distinguishes suggestions that changed care from suggestions that changed only the risk score.

The company publishes a stated ethical approach to clinical AI centered on transparency and clinician trust, positioning explicitly against black box models. That is a real governance posture expressed as product design rather than a program document.

What is absent is any bias evaluation, which matters here in a specific way: a model that surfaces suspected conditions from documentation density may find more conditions in patients with richer records, systematically favoring those with better historical access to care.

The mechanism is real and the missing number is the one the product turns on. Insights are directly referenced to original clinical sources and the company publishes an explicit position against black box models, so a clinician or coder receiving a suggestion can follow it to the documentation that produced it and reject it on the evidence.

That is the control this axis credits consistently, and stating a position against opacity rather than merely happening to be traceable is worth something, because it is a commitment a customer can hold the vendor to as the product changes. What is absent is any measurement of the suspected condition inference, which is the output that matters most here.

A suspected condition surfaced to a clinician before a visit shapes what is assessed and, once documented, what is coded and therefore paid, so the two error directions have different consequences: a false suggestion invites documentation of something that was not assessed, and a missed one leaves a real condition uncaptured.

No precision, recall or validation methodology is published for it, no evaluation methodology exists, and no warranty, indemnity or remediation commitment was located. Ask for precision on suspected condition inference, the clinician agreement rate on surfaced suggestions, and what the vendor commits to when a suggestion is unsupported.

Native in workflow and bidirectional, which is the hard version of this. The company states its solution lives natively in the EHR where clinicians already work, integrates bidirectionally with patient records enabling one click documentation, and generates visit notes synced back to the EHR. Data ingestion spans the EHR plus health information exchanges, claims, and care gap files reconciled into a single view.

Third party sources cite compatibility with major EHR systems, and a co hosted webinar with a major ambulatory EHR vendor and a large medical group indicates working partnership depth rather than API access alone.

No hosting arrangement, cloud provider, infrastructure description, implementation timeline, uptime commitment or data residency statement was located. ISO 27001 certification implies a managed infrastructure discipline behind the product, but a certification is not a description of where data lives or how a deployment proceeds.

What is evidenced is adoption rather than architecture, and it is genuinely evidenced rather than asserted. The platform ranked first in its category in the 2025 Best in KLAS awards, its second consecutive award in that category, and an independent study conducted by the American Academy of Family Physicians reported reduced chart review burden and reduced burnout among users. Those are external assessments of a product in real use, which tells a buyer the deployment works even though it does not tell them how it is deployed.

Buyers should ask where their data is processed and stored, what the implementation timeline and internal resourcing requirement look like, whether any deployment option keeps data inside their own environment, and what uptime is contractually committed. For a tool that sits in the clinician's daily workflow, availability commitments matter more than they do for a periodic reporting product.

No pricing information of any kind was located. There is no list price, no pricing unit, no tier structure, and no indication of whether the platform is licensed per clinician, per attributed patient, per practice or as a share of the risk adjustment gains it produces. That last possibility is worth asking about directly, because performance linked pricing is common in value based care tooling and it changes the vendor's incentives in a way a flat licence does not.

The upside half is unusually well evidenced by comparison. An independent study by a professional medical body reported a thirty per cent reduction in chart review burden and a twenty three per cent reduction in burnout, and the product holds consecutive first place category rankings from a healthcare research firm. A buyer is therefore given credible third party evidence of benefit and nothing at all about cost, which is the asymmetry this index records repeatedly.

Buyers should establish the pricing unit before the figure, and should ask specifically whether any part of the fee is contingent on measured improvement in risk adjustment scores.

Focused on value based primary care and the organizations bearing risk in it, spanning ACOs, medical groups, and multi specialty practices, with functionality covering chart review, visit preparation, risk adjustment, quality measure and care gap closure, and documentation. The company has extended into ambient transcription combined with historical data, widening from a pre visit tool toward the full encounter. Hospital, inpatient, and specialty referral settings are outside the core positioning.