Notable

The models drive the agents, and a platform sits underneath them. Notable sells AI agents for patient access, revenue cycle, care operations and the contact center, a Sidekick assistant that works in natural language inside existing systems, and Flow AI, an in-platform assistant for building automations.

Underneath is a workflow platform: Flow Builder, a no-code tool for designing and publishing automations, a Connector Hub of integrations that read and write across record systems and payer portals, and dashboards for workflow performance. With the models removed, a buyer would still hold a configurable workflow automation and integration platform, so the models are the engine of the agents rather than the whole product.

Autonomy is claimed and oversight is asserted without a mechanism. The agents are described as virtual team members performing end-to-end workflows, including prior authorization, appeal letters, denials, referrals, chart review for risk adjustment and patient voice calls, and Flow Builder lets a health system's own IT and non-technical staff build, train and publish new agents, with 'build, test, and publish' as the stated path.

Every access to information is logged immutably and traceable to a user, and dashboards report workflow performance. What is not published is when an agent stops and hands work to a person, what confidence or exception rule triggers that, what review a customer-built agent must pass before it runs, or what the voice assistant does when a caller needs a person at night, although one customer story sells round-the-clock answers.

The architecture is described in general terms and nothing is identified. The company describes agents built from out-of-the-box 'AI skills purpose-built for healthcare' in a skills library, a natural language assistant (Sidekick), an in-platform build assistant (Flow AI), and Flow Builder for building, training and deploying agents, over integrations that read and write structured and unstructured data. No foundation model or provider is named, no model is described for chart review, voice or document work, and no evaluation method, versioning or update practice is published.

Nothing identifies any party between a patient record and an answer. No foundation model or provider, speech or voice provider, hosting provider or subprocessor is named on the home or platform pages, and the trust center's public view lists documents without a subprocessor section.

The chain here is long by design: agents read and write records across several record systems and payer portals, run patient voice calls, and draw on an AI skills library, and each of those can involve outside model and telephony services.

Named deployments with dated outcome figures, curated by the vendor. Security Health Plan of Wisconsin reports that after deploying Notable's HCC chart review across its Medicare Advantage population, providers documented more than 2,800 additional conditions a year across more than 15,000 members reviewed, with the suspecting tool surfacing 440 new conditions addressed in the first eight months of 2024, a combined $7.1 million in additional annual revenue ($467 per member per year), and a 6.4 percent increase in complete documentation of persistent HCC codes across Marshfield Clinic.

CommonSpirit Health reports more than 160,000 Medicare Annual Wellness Visit outreaches in 2024, 74,878 staff hours saved and its 58.8 percent visit target reached by September 2024 in the rollout regions. Southwest General's voice assistant reports a 57 percent containment rate, and referral work shows 97 percent of in-scope referrals automated. The figures are vendor-published without independent evaluation, and the revenue figures measure documentation captured rather than conditions confirmed on audit.

One concrete control and general assurances; the questions AI raises are unanswered. All access to information within the platform is logged immutably, traceable to individual users, and reviewed regularly. Beyond that the platform page says data security follows industry best practice with details on request and that privacy of customer data is 'top of mind'.

The website privacy policy states that it does not cover data collected while performing services for customers, which falls under each customer's agreement, so no published document addresses retention, whether patient data trains the agents or the AI skills library, or de-identification. The platform reads and writes records and runs patient voice calls across 12,000 sites of care.

Compliance is claimed and nothing states business associate status. The company's announcements name compliance with the HIPAA Security Rule among its frameworks, the platform page says data handling complies with the highest standards of privacy and security, and the trust center lists HITRUST and a master services agreement.

The only published privacy document is the website policy, which says it does not cover data collected while performing services for customers, including data about patients of health care providers that use Notable, and that such data falls under a separate customer agreement. No business associate agreement is described. The platform runs registration, intake and voice calls directly with patients, so data collected before a patient is established in the record also needs a home in that agreement.

Four recognized frameworks are listed as the company's own, with the artifacts gated. A Security Center at trust.notablehealth.com, linked from the site footer and run on SafeBase, lists HITRUST, SOC 2 Type 2, PCI DSS and ISO/IEC 27001:2022, and offers a HITRUST report, network diagram, CAIQ questionnaire, CORL Clear rating, cyber insurance and the master services agreement, with data access marked restricted and a 48-hour recovery time objective.

The platform page adds immutable audit logs traceable to individual users and says further detail on data security is provided on request. The HITRUST level, the SOC 2 period and scope, and the ISO certificate's registrar are not stated in the public view, and the documents require an access request.

No device claim is made and most of the work is administrative: intake, registration, scheduling, eligibility, estimates, prior authorization, denials, referrals and contact center calls. Two functions sit near the boundary and no regulatory position is stated for either.

The HCC chart review suggests diagnoses for risk adjustment documentation; the Security Health Plan story says it embeds concrete evidence from the patient's chart in the provider's record system workflow and that providers address and document the conditions at the point of care, so each suggestion's basis can be checked in the source documents.

Patient-facing voice agents give pre-procedure instructions and, in Southwest General's story, answer patients' questions around the clock; whether they deliver the health system's approved text word for word, and what happens when a caller raises a symptom, is not published.

Governance appears as operational measurement and a build-and-test path, not as evaluation of model behavior. Every agent conversation and action is logged to a user, dashboards report workflow performance for benchmarking, and Flow Builder describes a build, test and publish sequence for agents a health system writes itself. No governance framework, evaluation method, bias or subgroup testing, or approval standard for customer-built agents is published.

That matters most where the product moves authorship to the customer: a non-technical author can build an agent that acts on scheduling, authorizations or care gap outreach, and nothing published says who validates it before it runs.

Mechanisms exist to trace an output, and nothing stands behind it. Every access and action is written to an immutable audit log traceable to a user, and workflow dashboards let a customer see what each agent did and how it performed, so a wrong authorization, a missed care gap or a misrouted referral can be traced after the fact.

The home page publishes a 95 percent accuracy rate beside its chart review figures with no method, denominator or period, so it cannot be tested, and no warranty, remedy or service credit attached to an agent's output is described. Customer-built agents raise a further question of who answers for an agent the health system wrote.

Record systems are named and reading and writing is claimed; none is verifiable in a marketplace. The company describes a flexible integration architecture that reads and writes across disparate data sources using whichever method reaches the system, including APIs, robotic process automation and HL7, across Epic, Oracle Health, MEDITECH, athenahealth and payer portals, with a Connector Hub for integrations.

A customer quote on the platform page describes a Cerner integration at Gillette Children's run directly between the health system and Notable. No Epic Showroom listing, integration documentation or per-system production list is published, and robotic process automation paths depend on the record system's screens staying the same.

Nothing published says where the platform runs or where patient data rests. No hosting provider, region, residency commitment, tenancy model or subprocessor list appears on the home or platform pages, the website privacy policy excludes service data, and the trust center's public view lists a network diagram and a 48-hour recovery time objective but places the diagram behind an access request.

The integration method raises a question hosting alone does not: where robotic process automation drives a record system's screens, the platform holds service account credentials inside the customer's own systems.

No price is published, and the shape of the offer is discoverable. The platform is sold to health systems and health plans through a demo, packaged as AI agents across patient access, revenue cycle, care operations and the contact center, with Flow Builder, Sidekick and a Connector Hub for integrations, and a Builders Program for partners. The trust center lists a master services agreement among its documents.

Patient access is one strand of the work, covering intake and registration, scheduling and self scheduling, eligibility checks, referral processing and order transcription, preprocedure instructions by voice agent, and contact center automation.

Value based care is another, with risk adjustment chart review and care gap closure sold to health plans and value based providers; Security Health Plan is named for Medicare Advantage and ACA risk adjustment, and CommonSpirit Health for Medicare Annual Wellness Visit outreach.

Coverage is named by function across patient access, revenue cycle (estimates and copay collection, prior authorization, appeal letters, denials), care operations and the contact center, for health systems and health plans. Validation stands behind part of it: Southwest General, CommonSpirit Health, Security Health Plan with Marshfield Clinic, Montage Health, MUSC Health and Gillette Children's are named. No clinical specialty coverage is described.