Patients.app

The models do the work. Retrieving records from outside organisations, scanning thousands of pages across EMRs, PDFs and scanned documents, screening them against a centre's own criteria, surfacing contraindications and generating intake, anaesthesia and review committee reports are all model tasks, and there is no platform, system of record or services organisation underneath them. The human elements described, nursing review and the trained transplant recipient support layer, sit downstream of the AI rather than substituting for it.

Genuine human structures sit downstream in both products, which is why this is not lower. Perioperative output speeds nursing review rather than replacing it, transplant output is packaged as reports for a review committee, a human body that makes the candidacy decision, clinical oversight is attributed to a named physician, and every result links to its source so a reviewer can check any assertion.

Held at B for three reasons. No confidence signal, threshold or abstention behaviour is published anywhere. The system automatically fills UNOS and TIEDI forms, meaning generated content enters national transplant registry systems, and nothing describes what a human verifies before submission or what happens if a field is wrong. And highlighting strong candidates shapes what a committee sees before it deliberates, which is influence exercised upstream of the gate rather than checked by it.

Ask what is verified before a form is submitted and before a candidate list reaches committee.

One real property and no measurement. Every result links back to its source, which the company frames as making context and authenticity clear, and that is the right instinct for a product whose output feeds a committee decision. Beyond it nothing: no model or model family named, no accuracy figure for criteria screening or contraindication detection, no evaluation methodology and no model card. For a product that flags what is MISSING from a record, the number that matters is how often it misses something that was missing, and that is unpublished.

Nothing identifies any party in the chain: no model or model family, no hosting arrangement and no sub processor list was located, and no retention period, training use statement or de identification posture was found. One question here is sharper than any other retention question in this index and it is answerable in a way ordinary retention is not.

The product assembles records from referring sites across the country to support a transplant evaluation, and where a candidate is declined, dies waiting, or is never listed, that assembled record has no ongoing clinical purpose: it was gathered for a decision that has been made. Most retention questions concern data that stays useful and therefore have no natural answer.

This one concerns a corpus whose purpose expires at a determinate moment, so establish what happens to an assembled record when a candidate is declined, and whether deletion is triggered by that event or left to a general schedule. The composition makes it weightier.

A transplant workup assembles the most complete picture of a person that exists anywhere, covering full history, imaging, laboratory results, psychosocial evaluation, substance use history, financial and social support assessment and adherence judgements, and much of it is gathered precisely because it bears on suitability, so it is candid in ways ordinary clinical records are not. It is also drawn from organisations that are not the customer and have no relationship with the vendor, so those organisations cannot see what is held or ask for it back.

One efficiency claim and nothing else. The company reports 30 to 60 minutes saved per case on surgical readiness screening, with no baseline, method or reference organisation attached. No customer is named, no funding was located, no case study exists, and no independent evaluation was found. For the transplant product in particular, where the outputs feed a committee that decides candidacy, the absence of any published accuracy or concordance data is the gap that matters most.

No retention period, training use statement or de identification posture was located in a second pass.

The observation the earlier assessment made is the sharpest question on this record and deserves stating in full, because it is not one this index has raised anywhere else. The product assembles records from referring sites across the country to support a transplant evaluation. Where a candidate is declined, or dies waiting, or is never listed, that assembled record has no ongoing clinical purpose. It was gathered for a decision that has been made.

Most retention questions in this index concern data that stays useful. This one concerns a corpus whose purpose expires at a determinate moment, which makes it answerable in a way ordinary retention is not: establish what happens to an assembled record when a candidate is declined, and whether deletion is triggered by that event or left to a general schedule.

The composition makes it weightier. A transplant workup assembles the most complete picture of a person that exists anywhere: full history, imaging, laboratory results, psychosocial evaluation, substance use history, financial and social support assessment, and adherence judgements. Much of that is gathered precisely because it bears on suitability, so it is candid in ways ordinary clinical records are not.

And it was drawn from organisations that are not the customer and have no relationship with the vendor, which means those organisations cannot see what is held or ask for it back.

Ask for the retention schedule, the deletion trigger on a declined candidate, and the training position in contract language.

No compliance statement or business associate agreement terms were located, and the multi party question the earlier assessment identified is the substance of this axis.

The ordinary arrangement in this index is simple: a covered entity engages a vendor, the vendor processes that entity's records, one agreement covers it. Here the vendor also retrieves records from referring sites, which are separate covered entities that did not engage it and may not know it exists.

That retrieval needs a basis, and there are several possible ones. It may run on the transplant centre's own right to request records for treatment, with the vendor acting as its agent. It may run through a health information network under that network's participation terms. It may rest on patient authorisation obtained during the referral. Each carries different limits on what may be requested, what may be retained afterwards, and what may be done with it.

So the question is not simply whether an agreement exists but which mechanism authorises each retrieval, and whether the answer differs by source. Establish it before evaluating anything else on this record, because it determines whether the referring organisations have any visibility or recourse at all.

One further question follows from the destination. Data assembled by the vendor reaches the national transplant registry, and submissions there are governed by network participation terms rather than by a bilateral agreement. Establish how those two contractual layers fit together and which governs the data once submitted.

Ask for the agreement, the legal basis for third party retrieval, and the position on registry submission.

No attestation and no trust centre were located in a second pass, which also failed to reach the vendor's own security material.

The access profile is what makes this worth pressing rather than filing as an early stage absence. The platform retrieves records from organisations across the country that are not its customers, which means it holds credentials, network standing or request mechanisms reaching well beyond any single client's estate. Misuse of that capability would reach across institutions rather than within one, and it is not a capability an ordinary application possesses.

What an examination would need to describe is therefore narrower and more specific than a generic control review. How the retrieval capability is authenticated and to whom. What prevents a request for a patient who is not a candidate at the customer centre. Whether requests are logged in a way the customer can audit, and whether the referring organisation can see what was requested. How the assembled corpus is segregated between customers.

The transplant setting adds a further consideration. Transplant centres compete for candidates and are assessed on outcomes, so a platform holding assembled workups across multiple centres is holding commercially sensitive material as well as clinical material. Separation is a competitive question as much as a regulatory one.

The customer base is small and specialised, which means each centre's own review is likely to be thorough. Assessments of this vendor probably exist privately; none is published.

Ask what external testing has been performed, how retrieval authority is controlled and logged, and how customer data is separated.

No clearance or device authorisation was located, and the earlier assessment was right that device regulation is not the relevant frame. A second pass did not reach the vendor's own regulatory material, so what follows describes the regime the product operates inside rather than the company's stated position in it.

Transplant programmes are governed by network policy and audited on data submitted through the national transplant information systems. The data collection component is a series of forms required at defined points through a candidate's course, and programme performance is assessed on what those forms contain. So a product that fills them sits inside a compliance regime with its own accuracy obligations, its own audit cycle, and consequences that fall on the transplant centre rather than the vendor.

One feature of that regime is specific enough to change a buyer's diligence and is not obvious from outside. The network's interfaces are documented as available to interface candidate and recipient data to and from a validated record system, with what counts as validated determined by the network operator. So a third party product writing into those systems does not merely need to be technically capable; it needs to sit on the right side of a determination made by the network rather than by a general regulator. Establish whether the vendor has that standing, and by what route data reaches the registry.

Accountability is the question to put directly. Ask who attests to the accuracy of submitted data, what the vendor's contractual position is if a submission is wrong, and how a centre reviews generated entries before they are filed.

Payment consequences now attach through the mandatory kidney transplant model, which raises the stakes on accuracy further.

The grade describes disclosure, and this is the most consequential disclosure gap found anywhere in this lane.

The product highlights strong transplant candidates against a centre's guidelines, surfaces contraindications and prioritises who reaches a review committee. Access to transplantation is one of the most extensively documented sites of inequity in American medicine, with well established disparities by race, insurance status, geography and referral pattern, and much of that inequity operates precisely through referral, evaluation and listing decisions rather than through allocation once listed. A model trained on historical listing decisions and applied to candidate prioritisation inherits whatever patterns those decisions contained, and a model reading records assembled from referring sites inherits whatever unevenness exists in what was documented about whom.

None of this is an allegation about this product, which may perform evenly. The point is that no subgroup or demographic performance disclosure of any kind was located, and this is the single application in this index where that absence carries the highest stakes. Published subgroup performance would be a genuinely significant disclosure and the first thing to ask for.

Credit where due: source linking, a named clinical overseer and a peer support layer of trained transplant recipients all indicate a company thinking about the human side of the process.

Every result links back to its source, which the company frames as making context and authenticity clear, and that is the right instinct for a product whose output feeds a committee decision rather than an individual clinician's judgement: a listing committee weighing a candidate needs to see where each element came from, because a referring site's note and a self reported history carry different weight.

Held at C because the product's own function defines a measurement it does not publish. The system flags what is missing from a record, so the number that matters is how often it misses something that was missing, and that is unpublished. A gap detector's failure is recursive in exactly the way that makes it invisible: an unflagged gap looks identical to an absent gap, the committee proceeds believing the workup is complete, and nothing in the record shows that a question was never asked.

No model or model family is named, no accuracy figure for criteria screening or contraindication detection exists, no evaluation methodology or model card was located, and no warranty, indemnity or remediation commitment attaches. The consequence sits on a candidate whose evaluation proceeded on an incomplete picture, and in transplant that determines whether a person is listed. Ask for the miss rate on gap detection against a reviewed sample, and what the committee is shown about the system's own confidence.

Real capability described, nothing named. The platform plugs into the customer's EMR and separately retrieves records from external systems and referring sites nationally, and it ingests EMR data, PDFs and scanned documents, which is the right ingest breadth for a referral driven workflow where records arrive in whatever form the sending organisation used. It also writes into UNOS and TIEDI.

Graded C because no EHR vendor, exchange network, integration standard or certification was located anywhere, so an organisation cannot establish what is supported or how retrieval actually works without asking.

No hosting model, cloud provider, region, residency commitment or customer hosted option was located, and a second pass did not reach the vendor's own technical material.

Residency has a particular character on this record because of where the data comes from and where it goes. The platform draws records from organisations nationwide and submits data onward to the national transplant registry, so it sits between many sources and one national destination rather than serving a single customer's estate. The question is not only where the vendor's own store sits but what transits it, what persists after a submission, and whether the assembled corpus is retained separately from what was filed.

One practical instruction follows from the search itself and is worth recording. This vendor's own surfaces did not surface across two passes using product and domain terms, which is common for small companies with generic names and means the absence recorded here reflects retrieval rather than a considered judgement about the vendor's posture. A buyer should treat every row on this record as a question to ask rather than a finding, and the vendor may well have straightforward answers to all of them.

The specifics to request are the standard set with one addition. Hosting region, residency commitment, subprocessor list, and which model service processes clinical content. And separately, whether any component runs inside the transplant centre's environment or whether everything is vendor hosted, since a centre with its own residency obligations will need to know.

Ask for a technical overview, which most vendors of this kind will supply on request.

No price, tier or pricing mechanism was located. The commercial arguments offered are avoided case cancellations, staff time saved and, on the perioperative side, captured codes and reduced denials, all of which describe claimed value rather than cost.

Narrow by design and genuinely deep within the narrow parts, which is rarer than breadth in this category. Two settings are addressed and both with instrument level work rather than generic summarisation. Perioperative covers surgical readiness screening against centre specific criteria, intake and anaesthesia report generation, and clearance and laboratory gap detection.

Transplant covers candidate identification and prioritisation, contraindication surfacing, review committee report generation and completion of UNOS and TIEDI registry forms. Filling national registry forms is instrument work of the same order as registry abstraction. Graded B rather than A because only two settings are covered and neither is evidenced at a named centre.