Pearl Health

AI powered patient prioritization is the platform engine: predictive insights identify the highest urgency patients before costs escalate. Held back from A because the product is a hybrid, predictive software wrapped in risk bearing value based care enablement services, and the AI platform cannot be purchased separately from the enablement relationship.

Advisory by design: predictions and insights surface to care teams who act on them, and workflow automation covers scheduling and post discharge follow up. No formal oversight or governance documentation retrieved beyond this implied posture.

The functions are clearly described and the technology beneath them is not.

What is public: predictive identification of high urgency patients, financial risk modelling, workflow automation for scheduling and post discharge follow up, and actuarial matching of provider cohorts to Medicare tracks. The company describes itself as native to artificial intelligence and purpose built for risk bearing Medicare models, and its own publishing engages seriously with methodological questions in the field, including a critique of documentation driven risk adjustment and work on applying updated sepsis criteria to reduce overdiagnosis. That is a more substantive intellectual footprint than most vendors in this category maintain.

What is absent is anything about the models themselves. No method, no features, no training data description, no performance figures, no validation design, no versioning, and no statement of the conditions under which a prediction should not be relied upon.

One observation from outside commentary frames the gap well: predictive models in this setting must be accurate enough to earn trust and transparent enough for care teams to act on. A prioritised patient list is only actionable if the clinician can see why a patient appeared on it, and nothing published describes what explanation accompanies a prediction at the point of use.

Ask what drives a patient's priority score and what the clinician is shown, how models are validated and revalidated, and how changes are communicated to practices relying on them.

A rigorous security certification sits on this record and the contrast is worth naming, because the two are routinely conflated: holding a certification demonstrates that controls exist, and says nothing about what the company is permitted to do with the data those controls protect. Encryption and access management do not constrain secondary use.

The holdings are substantial, spanning a reported ten thousand providers across more than forty states, roughly a quarter of a million beneficiaries and several billion dollars of annualised medical spend, which means beneficiary claims history at population scale, longitudinal and identifiable. How those people came to be in scope is the point that distinguishes this from most records here. A patient chooses a physician.

They do not choose the enablement company their physician contracts with, and alignment to an accountable care organisation happens through claims based attribution rather than enrolment, so many beneficiaries will not know the relationship exists at all. Whatever consent framework applies, it is not one the individual actively entered, and a quarter of a million people are therefore in scope without an act of their own.

Nothing states retention, whether beneficiary data develops the predictive models, whether improvements derived from one provider network serve another, or what happens when a provider leaves. Ask all four, and ask what beneficiaries are told.

Scale is well documented (10,000+ providers, roughly 250,000 Medicare beneficiaries, about $3.6 billion in annualized medical spend). Outcome claims, including an expected $500 million in gross savings, are vendor announced projections rather than published or peer reviewed results.

No retention position, training use statement or de identification posture was located, on a record where the security certification is otherwise strong. The contrast is worth naming: holding a rigorous certification demonstrates that controls exist, and says nothing about what the company is permitted to do with the data those controls protect.

The holdings are substantial. The platform operates across a reported ten thousand providers in more than forty states, covering roughly a quarter of a million Medicare beneficiaries and several billion dollars of annualised medical spend. Working in Medicare accountable care means access to beneficiary claims history at population scale, which is longitudinal, comprehensive and identifiable, and which the beneficiaries themselves did not choose to place with this company.

That last point deserves emphasis and distinguishes this from most records here. A patient chooses a physician. They do not choose the enablement company their physician contracts with, and alignment to an accountable care organisation happens through claims based attribution rather than enrolment, so many beneficiaries will not know the relationship exists. Whatever consent framework applies, it is not one the individual actively entered.

Nothing states retention, whether beneficiary data develops the predictive models, whether improvements derived from one provider network serve another, or what happens to data when a provider leaves.

Ask for retention, a written training position, separation between provider networks, and what beneficiaries are told.

Stronger than most records in this category because of what the certification covers, and short of the top grade because the contracting position is unpublished.

The company holds certification against the healthcare control framework at its risk based tier. That framework is constructed around the privacy and security rule requirements themselves, so certification is closer to an independent examination of health privacy controls than a general security attestation would be. A counterparty asking whether safeguards exist has a real answer, even before contracting.

What is unpublished is the relationship itself, and here the structure is genuinely more complicated than for a software vendor. The company supplies technology and services to primary care providers, which is business associate territory. It also participates in Medicare accountable care arrangements and bears financial risk on the populations those providers serve, which is a different position entirely, with its own permitted uses of beneficiary information under the relevant programme rules rather than under a business associate agreement alone. A single organisation performing both is common in this segment and the instruments differ, so which one governs a given data flow is not something a provider should infer.

No business associate availability statement, contracting entity, subprocessor list or permitted use terms were located.

Ask which entity contracts and in which capacity, what governs beneficiary data used for risk bearing as distinct from care support, and how partner vendors introduced into the workflow are covered.

The company announced certification against the healthcare control framework at its risk based tier, which is the most demanding level that framework offers and the one most directly aligned to this business.

That choice of framework matters more than a logo count. The healthcare control framework is built around the requirements of the privacy and security rules specifically rather than around generic service organisation controls, and the risk based tier requires the full control set assessed by an authorised external assessor with quality review by the framework body itself, on a two year certification cycle. For a company holding Medicare claims and clinical data across a large provider network, that is the right assurance to hold and it is meaningfully harder to obtain than the common alternative.

Held at B rather than A for three reasons. No trust centre or documented request path was located, so a counterparty must ask rather than read. No penetration testing or vulnerability disclosure was found. And no scope statement is published, which matters because the business spans a technology platform, actuarial and data science functions, and risk bearing operations, and certification scope across that estate is not self evident.

One question follows from the company's own partnerships. It has announced work bringing ambient documentation and point of care intelligence to clinicians in its risk bearing models, which introduces another vendor into the data path. Ask whether partner tooling sits inside the certified scope or outside it.

Ask for the certification letter and scope, the assessment date, and the subprocessor position.

A scoping determination that closes, with the operative regime being programme rules rather than device regulation.

Nothing here is a medical device. The platform identifies patients likely to deteriorate or to drive avoidable cost, prompts outreach, and models financial performance. Clinical decisions remain with the primary care providers who use it, and no diagnostic or therapeutic claim is made.

What governs is the Medicare accountable care programmes the company operates within, and their requirements are substantive rather than administrative. Participation rules for the accountable care models define beneficiary alignment, quality reporting, benchmark methodology and the terms on which shared savings or losses are settled. Risk adjustment carries its own compliance surface, with data validation audits testing whether submitted diagnoses are supported by the record. And because the company bears financial risk, the ordinary programme integrity rules on inducements and on steering apply to how it engages both providers and beneficiaries.

One thing on this record deserves credit here rather than criticism. The company's own publishing carries a critique of documentation driven risk adjustment, arguing that the current approach overpays for inflated diagnoses and proposing inference from utilisation and trajectory instead. A risk bearing organisation publishing an argument against the most gameable part of the system it profits from is unusual, and a buyer should weigh it.

Ask which programmes and tracks apply, and how risk adjustment integrity is evidenced.

No governance framework, model documentation, evaluation methodology or subgroup analysis was located, and this vendor's models make two different kinds of consequential decision.

The first is clinical prioritisation. Predictive insights identify the patients a care team should reach first, across a reported quarter of a million Medicare beneficiaries. That is allocation of finite clinical attention, and if the model learns from historical utilisation it will reflect who has historically been able to access care. Patients who use less care because of distance, cost, language or mistrust generate a thinner signal and can be scored as lower priority, which reproduces the gap while appearing to optimise.

The second is financial and the company describes it plainly. Its data science and actuarial teams match provider cohorts to the Medicare track and risk level that will boost savings and unlock revenue. That is model selection optimised for financial outcome, and it is a legitimate service. It also means a provider's programme placement, and therefore the incentives acting on their patients' care, is being determined by a model whose objective is financial performance. Nothing published states how patient interest is represented in that optimisation.

The company bears risk on these populations, so the structural point recorded elsewhere in this index applies: an organisation with financial consequence for utilisation has a direct interest in the outcome of decisions its models inform.

Ask for prioritisation performance and outreach rates by patient demographic, and what the track selection model optimises.

The company publishes substantive methodological work on questions its own sector has an interest in leaving alone, and that is the basis for the grade. Its writing includes a critique of documentation driven risk adjustment and work on applying updated sepsis criteria to reduce overdiagnosis, which is a more serious intellectual footprint than most vendors in this category maintain and is notable because documentation driven risk adjustment is a practice this sector profits from.

A vendor arguing against an incentive it benefits from is doing something an ordinary marketing function would not. What is absent is anything about its own models. No method, features, training data description, performance figures, validation design, versioning or statement of conditions under which a prediction should not be relied upon was located, and no warranty, indemnity or remediation commitment. The gap that matters most is at the point of use.

A prioritised patient list is only actionable if the clinician can see why a patient appeared on it, and nothing published describes what explanation accompanies a prediction, so a practice acting on a priority score is acting on a rank it cannot interrogate. The failure direction is the patient never surfaced, who generates no artefact and no complaint. Ask what drives a priority score and what the clinician is shown, how models are validated and revalidated, and how changes are communicated to practices relying on them.

Workflow fit is claimed repeatedly and integration is not described.

The company positions its platform as identifying high priority patients, prompting timely action and fitting into existing workflows without adding noise, and provider testimonials describe using it to focus attention and capture credit for work already performed. That is a clear product intent and it is the right one, because an enablement tool a practice must open separately will not be opened.

What was not located is any specification of how that fit is achieved: no named record platform integration, no interoperability standard, no interface documentation, and no description of whether insights surface inside the chart or in a separate application.

The inbound side is clearer by inference than by statement. Medicare accountable care work runs substantially on claims and beneficiary alignment files supplied through the programme rather than on chart data, which explains how the platform can serve ten thousand providers across more than forty states without an integration project at each. That is a genuine scaling advantage and it carries a limitation worth naming: claims data is retrospective and lags, so a prioritisation built primarily on it is working from a picture that is weeks or months old.

A partnership introducing ambient documentation into these practices suggests movement toward point of care data, which would change this picture.

Ask what data sources drive the models, how current they are, and how insights reach the clinician.

No hosting location, region, tenancy model, retention schedule or subprocessor list was located.

The certification the company holds provides indirect comfort, since the healthcare control framework at its risk based tier addresses infrastructure, access management and third party risk as part of the assessed control set. That is not the same as a published residency or tenancy position, and a counterparty cannot read scope from a certification announcement.

Two questions are specific to this business. Tenancy separation matters because the platform serves a reported ten thousand providers across more than forty states, including independent practices, physician groups and health systems that compete with one another in the same markets, and the data held includes panel level cost and utilisation performance. That is commercially sensitive between customers as well as confidential about patients.

Retention matters because accountable care performance is settled retrospectively over multi year periods, with reconciliation and audit occurring long after the care did. Data therefore has to be kept for programme purposes for years, and what happens to it once those obligations expire, or once a provider leaves the network, is unaddressed.

A third follows from partnerships: introducing a documentation vendor into these practices extends the data path beyond this company's own environment.

Ask where data is held, how providers are separated, the retention schedule against programme obligations, and the subprocessor register.

No public pricing. Contact the vendor. The commercial model is built on value based enablement arrangements; no published rate card retrieved.

Coverage is stated with unusual clarity: Medicare populations, primary care providers, and ACO style risk arrangements across 40+ states. Narrow scope, clearly bounded, which is what this axis rewards.