Nym Health

The engine is the entire product and there is no coding bureau underneath, which is the distinction that separates genuine autonomous coding vendors from RCM companies claiming AI over offshore labour. Same test that earned CodaMetrix an A. The Clinical Language Understanding technology is proprietary and built by an interdisciplinary team of physicians, computational linguists and engineers, and the company sells nothing else.

The strongest autonomy disclosure in this category and the direct answer to what CodaMetrix withholds. Nym publishes both the mechanism and the threshold: encounters are routed to billing when coding confidence exceeds 95 percent, and charts the engine cannot confidently code above that accuracy threshold are returned to human coders. It also states plainly that it assigns codes only for charts it fully understands, with unintelligible charts automatically flagged and returned.

CodaMetrix was graded B in this index precisely because its human-routing threshold is not published; Nym publishes it, which is the key operational disclosure for autonomous coding. Note the honest framing that this is a first-pass coder running in the background inside the existing workflow rather than a replacement for the coding function.

Unusually specific and, more importantly, explicit about what the system is NOT. The company states its own category definition, that autonomous coding may use end-to-end deep learning, NLP with rules, or a hybrid, and identifies its own approach as computational linguistics plus machine learning models combined with rules-based clinical ontologies encoding AMA, CMS and WHO coding guidelines.

The pipeline stages are named: semantic representation, context extrapolation, ontological linking and narrative construction. It also names the specific failure mode it handles, negation, where keyword-based computer-assisted coding wrongly codes a condition the note explicitly rules out. A vendor that publishes its architecture, its taxonomy of alternatives, and the error class it targets is operating well above the disclosure norm here.

The rule sources are named and the operating chain is not. The approach is described as computational linguistics and machine learning combined with rules based clinical ontologies encoding the coding guidelines of named United States and international authorities, so a buyer can identify which external bodies' rules the system applies and go and read them, which answers the data half of this axis better than most vendors manage and is the right disclosure for a product whose output must satisfy those bodies.

The architecture is set out in named stages rather than as a category claim. One architectural feature also bounds the chain in a way worth crediting here as well as on liability. Because successfully coded encounters are finalised without human intervention, no person reads those charts, which removes an entire class of access rather than governing it. That applies to the successfully coded share only, and nothing states how large the residual share routed to human coders is.

On enumeration there is nothing: no model or model family, no foundation model provider, no hosting arrangement and no sub processor list was located, and no position on whether customer chart data trains or refines the engine. A residency claim circulates through a third party aggregator rather than the company's own material and is not credited. Ask for the training position, the residual human read share, and a sub processor list.

Stronger than most RCM vendors but still vendor-sourced. Scale is substantial and specific: over 5.5 million charts annually across more than 250 US healthcare facilities, with named health system customers including Geisinger, Inova, Intermountain Health and OSU Physicians. A KLAS Research Emerging Solutions Spotlight report is cited in which 100 percent of Nym customers said they would purchase again, which is genuine third party research rather than a vendor survey.

Graded B rather than A because the headline over 95 percent accuracy figure carries no published audit methodology, sample size or independent verification, and accuracy on successfully processed charts is a different and more favourable measure than accuracy across all charts submitted, since the hardest charts are excluded by the confidence threshold. That denominator question is the one a buyer must ask.

Converted from Not Rated. The architecture removes an entire exposure class, which is a stronger position than most privacy policies describe.

Traditional medical coding requires a human coder to read the complete chart, including the unstructured clinical narrative. That is the largest routine exposure of protected health information in the revenue cycle, and it scales with volume and with outsourcing. Autonomous coding at zero human intervention eliminates it for every chart the engine codes successfully. No person reads the note.

That is an architectural claim rather than a policy commitment, and it follows directly from the product design the company documents on its own site: the engine takes a first pass and routes successfully coded encounters straight to billing without human involvement. It is the strongest thing on this axis and it is why the grade is a B rather than a C.

Two qualifications keep it from an A. The exposure is removed for successfully coded charts, not all charts: encounters below the confidence threshold are routed to human coders by design, so a residual share is read by people and nothing states how large that share is. And a claim circulates that protected health information never leaves the United States, but it was located through a third party aggregator relaying vendor material rather than in the company's own published documents, so it is not credited here.

Still unpublished: retention periods for charts and derived artefacts, any de identification step, and whether customer chart data is used to train or refine the engine.

Ask what proportion of charts a human reads, and whether chart data trains the models.

Converted from Not Rated. No published position was located, which is notable at this deployment scale.

No business associate agreement, addendum, role statement, subcontractor flow down, breach notification timetable or review cadence was retrieved across two differently phrased searches. The company reports deployment across more than 250 facilities including named academic health systems, so agreements plainly exist and have been negotiated many times over. None of it is public.

The role is unambiguous. The health system is the covered entity. The engine reads complete patient charts including the unstructured clinical narrative and returns billing codes, which makes this a business associate with direct liability under the rule.

One feature of the architecture is worth raising in the same conversation because it changes what the agreement has to cover. Where no human at the vendor reads the chart, the usual workforce access provisions, training obligations and access review requirements apply to a much smaller surface than they would for a coding service staffed by people. A buyer negotiating this agreement should establish which workforce provisions apply at all, and to which residual population of charts routed for manual coding.

The route to an A in this index is publishing the instrument so a buyer can read it before entering a sales process. It is not taken here, and absence of a retrieved document is not proof none exists.

Ask for the agreement, and specifically for the terms covering charts that fall below the confidence threshold and are read by people.

Converted from Not Rated, and the reasoning is a sourcing discipline point rather than a simple absence.

A claim that the company holds SOC 2 Type II certification, supported by annual third party audits and continuous vulnerability scanning, circulates on third party aggregator sites that relay vendor supplied material. It was not located in the company's own published documents across two differently phrased searches, including one using its own product and technology terms.

This index has an established rule on exactly this situation and it is applied here rather than set aside. An audit or compliance partner's own account of work it performed is creditable for certification facts, with attribution, because the party that did the work is describing it. A competitor comparison site, a directory or an aggregator is not, because the chain back to evidence is broken. The rule was set when a vendor's certification level was found only through its audit partner, and it was applied in the other direction when similar claims appeared on comparison sites and job adverts.

So the position is: the claim may well be accurate, it is plausible for a vendor selling into large health systems where security review gates procurement, and it cannot be credited from an aggregator. No trust centre, no report, no attestation period and no encryption specification were located from the vendor.

This is the cheapest gap in this record to close. A single security page naming the report and its period would move this grade materially.

Ask for the report directly, confirm the type and the period covered, and confirm whether any second framework is held.

Converted from Not Rated. The prior note carried the correct analysis with no grade attached. Against the regime that actually governs, this is the strongest record in the category.

The scoping holds. No device pathway applies to coding and billing automation and none is claimed. What governs is coding compliance under the American Medical Association, Centers for Medicare and Medicaid Services and World Health Organization guidelines, which the rules based ontologies encode directly, plus False Claims Act exposure that sits on the billing organisation rather than on the vendor.

Where no vendor level regulator exists, this index grades on what the vendor publishes in its place: accuracy, audit trail, and whether a human verifies before submission. All three are answered here, which is why this is an A and why it is the benchmark other vendors in the category are measured against.

Accuracy is published, stated at 98 percent and above and reported by specialty. The audit trail is not merely claimed to exist but described: a traceable record for every code assigned, carrying the supporting clinical findings and the guideline references that justified it. That is the artefact a compliance officer needs when a claim is challenged, and describing its contents is more useful than asserting transparency.

The decisive disclosure is the routing rule. Encounters the engine cannot code confidently above its accuracy threshold are sent to human coders. Publishing where the line sits between machine and human is the single most useful thing a vendor in this category can do, because the entire safety argument depends on it, and almost nobody else does it.

One further point earns credit: the engine is stated to update automatically when new coding guidelines are released, which addresses the drift risk directly.

No demographic bias disclosure located, but the governance risk in autonomous coding is not demographic and this vendor addresses the real one structurally. The coding drift exposure flagged on CodaMetrix, where a model learns a health system's historical coding intensity and reproduces its upcoding tendencies, is materially mitigated here by architecture: because code assignment is driven by rules-based ontologies encoding published AMA, CMS and WHO guidelines rather than learned from a customer's historical coding patterns, the system is anchored to the standard rather than to the institution's habits.

The audit trail explaining why each code was assigned makes drift detectable rather than invisible, and the company states the system is automatically updated to reflect current coding guidelines. Graded B rather than A because no independent audit of coding appropriateness, as distinct from accuracy, was located.

This is the vendor this index has repeatedly cited as the benchmark when grading other coding products, and the record should say why. It publishes the confidence threshold governing autonomous handling and the routing rule that follows from it, so a buyer knows which encounters the engine finalises alone and which go to a human coder.

Three other coding vendors assessed here have been marked down for operating comparable automatic lanes while publishing neither, and the existence of this record is what establishes that the omission is a choice rather than an industry limit.

Architecture is disclosed alongside it, with named pipeline stages, an explicit statement of which technical approach the product uses against the alternatives it does not, and a named failure mode it exists to handle, which is a condition the note explicitly rules out being coded as present. Naming the error class you target is a form of limitation disclosure and it tells a reviewer what to check.

Held below the top grade because no precision, recall or accuracy figure is published for the coded output, no evaluation methodology exists, and no warranty, indemnity or remediation commitment attaches. A published threshold without a published error rate at that threshold tells a buyer where the line is drawn but not what happens on either side of it. Ask for accuracy at the operating threshold, the denial or reversal rate on autonomously coded claims, and what the vendor commits to when one is wrong.

Designed to layer on top of the existing enterprise IT stack and integrate into the normal revenue cycle flow without change or interruption, running in the background as a first-pass coder inside the current workflow rather than requiring process redesign. That low-disruption posture is a genuine deployment advantage and is corroborated across sources. Graded B rather than A because no specific EHR or billing system integrations were named in located materials, unlike Candid Health's documented API-first approach.

Converted from Not Rated. No hosting, region, tenancy or residency disclosure was located in the company's own published material.

A claim circulates on third party aggregator sites that protected health information never leaves the United States. That is exactly the kind of commitment that would lift this grade if the vendor stated it, and it is not credited here because an aggregator is not a creditable source for a factual assurance of this kind, consistent with how this index treats certification claims from the same class of source.

What is documented is the integration posture rather than the hosting one. The engine is described as running in the background of existing workflow without disruption, layering on top of current systems, with electronic health record integration typically taking 60 to 90 days. That describes how it connects, not where it runs.

Nothing was retrieved on cloud provider, region, whether an on premise or customer hosted option exists, whether tenancy is logically or physically separated, the subprocessor chain, or backup and recovery posture.

One architectural consequence is worth noting because it cuts the buyer's way. Since the engine consumes charts and returns codes without human review, the data path is narrow and mechanical: documentation in, codes out. There is no reviewer workstation, no coder queue and no offshore review centre in the loop for successfully coded charts. That is a smaller and more auditable footprint than a staffed coding operation, even though none of its locations are published.

Ask where the engine runs, whether processing stays in country, and whether tenancy is isolated.

No pricing published and no pricing basis disclosed. For autonomous coding the pricing unit matters more than usual, since charging per chart processed, per chart successfully autocoded, or as a platform fee produces very different economics when the autonomous rate varies by specialty and documentation quality. None of that is public. Consistent with Candid Health and the wider RCM lane, where commercial opacity is the norm.

Genuine multispecialty coverage with a clear expansion path: emergency department and inpatient origins, outpatient capabilities added in 2024, and radiology among supported specialties, deployed across health systems, hospitals and physician groups in more than 250 facilities. Emergency department coding in particular is a high-volume, high-complexity proving ground.

Graded B rather than A because CodaMetrix in this index documents a wider specialty span including pathology, surgery, GI and inpatient professional coding, and Nym's per-specialty autonomous rates are not published so depth of coverage by specialty cannot be verified.