NextGen Ambient Assist

As at ModMed, Elation Health and Oracle Health, the platform carries the product rather than the algorithm. Ambient Assist is a module of the NextGen EHR, activated through a NextGen account representative, and no practice selects NextGen because of it. The module itself is generative, but the moat is the ambulatory installed base and the 26 specialty template library, both of which predate the AI and would survive its removal.

A conservative posture, resting on a structural difference rather than a stated policy.

The note is placed in the chart explicitly pending provider review, and codes, medications and lab or imaging orders arrive as suggestions rather than as prefilled order objects. That distinction is the whole of it. A suggestion requires an affirmative act to become an order; a prefilled order requires an affirmative act to stop being one, and defaults decide what happens on a busy afternoon. A product that drafts the order itself carries a different review burden, and the difference is not cosmetic.

The vendor also states in its own materials that clinical validation and oversight are essential for reliability, and answers the question of whether the system replaces the physician by saying it does not and that providers will still review generated notes. That is a concession of the limits of its own output.

The oversight structure is described without any of the measurements that would size it. No confidence threshold, no acceptance rate, no edit burden figure, and nothing on what happens after a suggestion is accepted and turns out to be wrong.

One scope point is open. The decision support capability that generates diagnosis and order suggestions is described for the enterprise edition. A smaller practice edition exists, and whether the same suggestion behavior and the same review gate apply there is not stated.

Publishes a headline accuracy figure of over 90 percent but never defines it. There is no statement of what was measured, against what reference standard, on how many encounters, or in which specialties, so the number cannot be compared with anything or falsified. Vendor sourced time saving claims are also internally inconsistent, appearing as 1.5 to 2 hours per day in some materials and 2.5 hours per day in others. An undefined accuracy percentage is a marketing figure rather than a benchmark.

Nothing published identifies any party in the chain. No foundation model provider, model class or version is named, no hosting or cloud arrangement is described for this module, and no subprocessor list is published.

The product is delivered inside an enterprise electronic health record, and vertical delivery of that kind often means a short chain in practice. But a chain inferred from the delivery model is not a disclosed one, and nothing public lets a buyer confirm whether encounter content stays within the vendor's own systems or reaches a third-party model service.

The data handling disclosures are fuller, and they describe the shape of the gap rather than filling it. Audio and transcripts are stated never to be stored or saved, transcripts are described as temporary artifacts used only to generate the structured note, and documentation is stated to flow into the enterprise record rather than persisting on the device. All of that says how content is handled without saying who handles it.

Vendor reported time savings and customer testimony only. No peer reviewed publication, no controlled comparison, no independent evaluation and no third party performance rating is published.

Taken as a set, the published figures have moved. The 2023 launch claimed up to two hours of documentation time saved per day; the current product page claims 2.5 hours, alongside five additional patients per day and up to a 90 percent reduction in weekend charting. None carries a method, denominator or comparison group. A figure that grows across releases without a study behind it is a marketing number being revised, not a result being replicated.

Three named single-clinician case studies are published, which is more than nothing and is testimony rather than measurement.

What would move this is an evaluation with a control or a before-and-after with a stated method, at practice rather than clinician level.

Purpose and location are stated, not just assured. NextGen states that conversations become temporary transcripts used only to generate the structured note, and that documentation flows into the Enterprise EHR rather than persisting on the mobile device, which is a purpose limitation and a data location statement rather than a generic assurance. Its named control set also includes patient consent alongside encryption, secure storage, access controls and audit trails. A formal commitment that customer audio and transcripts are never used for model training is not stated in those words.

Sold as HIPAA covered software inside an existing NextGen enterprise agreement, with encryption, access controls and audit trails named, and a substantial security estate behind it: annual SOC 2 Type II and SOC 3 audits, a HITRUST CSF letter, TX-RAMP level 2 certification and DirectTrust accreditation.

What is not published is the business associate position itself. No statement that the vendor acts as a business associate, no agreement, no template, and no scope statement. Terms are contracted through the account relationship, so a prospective buyer cannot read what will govern protected health information before entering a sales process.

What is known rests on the enterprise contracting model rather than on a published statement. An ONC certified ambulatory record vendor of this size very likely executes business associate agreements as a matter of course, but that is inferred from how the product is sold rather than read in any published document. Under a strict reading of the four element standard an inferred agreement falls short, and whether that strictness applies is an open question rather than a settled one.

One scope question specific to the ambient capability. The security scope lists published by the vendor name the record system, practice management and population health products, not this module. An agreement covering the enterprise platform may or may not describe ambient capture of a patient conversation.

The vendor's own trust page states that it undergoes annual SOC 2 Type II and SOC 3 audits by an independent AICPA firm covering security, availability, confidentiality and privacy, that it holds a HITRUST CSF letter with scope, that it achieved TX-RAMP level 2 certification from the Texas Department of Information Resources, and that it is an accredited health information service provider under DirectTrust. Its modules are ONC certified with a published certificate number. These are the vendor's attestations, not an infrastructure supplier's.

Two gaps remain.

Nothing is retrievable without asking. The HITRUST letter, the SOC 3 report and the TX-RAMP certificate are each available on request, with clients routed to a support community and non-clients to an email address.

Scope does not reach this product. TX-RAMP names NextGen Enterprise EHR, Practice Management and Population Health. The HITRUST scope list published by the company enumerates the EHR, revenue cycle, practice management, population health, mobile, analytics, interoperability and cloud services, and predates the ambient module's launch. So the platform this module runs inside is well attested and the module itself is not named anywhere in that scope.

No clearance claimed and none required for ambient documentation. The base position holds: the system drafts, the clinician reviews and signs.

The scope has moved toward decision support, and the vendor's own framing is the clearest evidence of it. The company describes the product as offering decision support, and its president has described the capability as generating recommendations on diagnosis codes, lab orders and imaging orders by referencing coding datasets against the captured note. Trade coverage of the same announcement filed it under clinical decision support.

Two boundaries follow. Diagnosis code recommendation is the reimbursement boundary, since the codes proposed determine what gets billed. Lab and imaging order recommendation is a different and larger step, because an order is an action taken on a patient rather than a description of one, and a system proposing which tests to run is participating in the clinical decision rather than recording it. The vendor's material also describes the in visit workflow extending to prescribing.

The mechanism is stated rather than obscured: recommendations are described as derived by referencing established code sets against the captured note. Naming the source makes the output more inspectable than an unexplained suggestion, and the reasoning that keeps clinical decision support outside device regulation depends on a professional being able to review the basis of a recommendation. A vendor that says where its recommendations come from is closer to satisfying that than one that does not.

Nothing published says which modules are enabled at a given version, or where the clinician's confirmation sits for orders as distinct from for the note.

Markets appear to be United States only, with English and Spanish documentation.

Partial rather than absent, which is why this is C rather than Not Rated. NextGen does state openly that clinical validation and oversight are essential for reliability, and it names patient consent as part of its control set. What is missing is anything about performance variation: no fairness statement, no subgroup analysis, no accent or dialect disclosure, and no acknowledgment that speech models degrade unevenly across patient populations.

A number is published, which is the beginning of accountability, but in a form that cannot be tested. The stated figure is accuracy of over 90 percent, with no statement of what was measured, against what reference standard, over how many encounters or in which specialties. Without a definition it is a marketing figure rather than a commitment, because there is no way for a customer to establish that it was not met.

The number itself says something the reassurance does not: better than 90 percent, undefined, is consistent with roughly one element in ten being wrong, and whether that means a word, a sentence or a whole section changes what the review burden actually is. Vendor sourced time saving claims are internally inconsistent as well, appearing as 1.5 to 2 hours per day in some materials and 2.5 hours per day in others, which weakens the same set of published claims.

Against that, one point is in the vendor's favor. Patient consent is named as part of the control set, and consent is the mechanism by which the recorded person is treated as a party with a say rather than as a data source. No warranty, indemnity or remediation commitment is published.

Deep inside NextGen and unavailable outside it. Built into NextGen Mobile and writing directly into the NextGen Enterprise chart with no copy and paste step, which is the strongest possible fit for a NextGen site and irrelevant to anyone else.

The interoperability asset usually attributed to NextGen, the Mirth Connect integration engine supporting HL7v2, FHIR R4 and C-CDA, belongs to the parent platform rather than to this module, and third party scribes hold certified NextGen integrations of their own, so native does not automatically mean deepest here.

Hosting is partly disclosed, while residency and where inference runs remain open.

The hosting provider is now named: the platform runs on a major public cloud, with the vendor citing that provider's multi region and availability zone architecture and its encryption of data at rest and in transit. Capture happens through the vendor's own mobile application, and integration into the record runs over a modern interoperability interface.

Naming the cloud is not the same as answering residency. No hosting region is stated for this module, no residency option is offered, and no subprocessor list is published. The cloud provider's regional footprint is described as a property of that provider rather than as a commitment about where a given customer's data sits.

More importantly for an ambient scribe, nothing establishes where inference runs. Whether encounter audio and transcript are processed by a third party model service, which provider that would be, and what it retains are all unanswered. The product now generates diagnosis code and order recommendations by referencing coding datasets, so the pipeline does considerably more than transcribe, and the question of which components run where is correspondingly larger than it was.

The multilingual capability widens the question. Spanish language documentation is offered, and a vendor documenting encounters in more than one language is likely serving populations whose data protection expectations differ.

No published rate card for the module. Activation runs through a NextGen account representative and pricing is negotiated by practice size and contract, so the ambient line item is bundled inside an EHR relationship reported by third parties at roughly $150 to $500 per provider per month for the platform overall. That platform figure is not the price of this module.

Ambulatory only, matched to the NextGen base of independent and specialty practices, with the parent platform carrying 26 specialty template sets. The open question is whether the AI is tuned per specialty or simply writes into specialty templates: third party reviews position specialty tuned scribes as the better fit for high complexity NextGen practices such as orthopedics, cardiology and gastroenterology, which suggests the model is general purpose even where the templates are not. No inpatient or emergency coverage and no published language coverage.