Persivia

The company tells you what it is built on, and what it is built on is a rules engine with inference layered over it.

That candour is worth crediting before anything else. Product material describes more than a decade of clinical rules engine and analytics work combined with clinical content expertise as the foundation of the platform. Most vendors in this lane would have buried that lineage. Naming it lets a reader interpret the rest accurately.

The rest is a mixture. Some of what is described as powered by artificial intelligence is automation of eligibility determination, care plan assembly, alerting and care gap identification, which are rules executing against a curated content library of more than 200 programmes. That library is a genuine asset built by clinicians over years, and it is not a model. Other components are real inference: risk stratification that predicts which patients will be readmitted or become high cost, pattern detection across large datasets, and software agents conducting natural language conversations with patients by text and voice.

The judgement is that the scarce asset here is the content and the rules, with prediction and language handling as capable layers on top rather than the foundation. Strip the models out and a functioning value based care platform remains, because the programmes, the aggregation and the reporting would still work.

Graded C, consistent with how Arcadia and Health Catalyst are graded in this index, and it is the correct outcome of the same question that led this index to pass over a care orchestration vendor as likely rules based. Persivia clears that bar because the predictive and conversational layers are real, and it sits at C because they are not the foundation.

Ask which functions are model driven and which execute authored rules, and what accuracy the risk models achieve.

Autonomy is described plainly and the scope is sensibly bounded, and the escalation path is missing.

The honesty is worth crediting. The company states that software agents conduct outreach without requiring additional staff capacity, which is an accurate description of what autonomous patient contact is for. Vendors more often describe the same function as augmenting a care team while quietly selling the headcount saving, and this record does not.

The scope is bounded in a way that reduces risk. Named uses are follow ups, appointment reminders, medication adherence prompts and chronic care education, which are low acuity, high volume tasks where the cost of an imperfect interaction is small and the cost of not doing it at all is a missed care gap. Confining autonomous contact to that band is a defensible design choice rather than an oversight failure.

The analytics layer sits on the other side of the line, with risk stratification, alerts and care gap lists surfacing to care teams who decide what to do.

What is absent is what happens when a bounded conversation stops being bounded. A patient answering a medication adherence prompt may report chest pain, describe a fall, or say something indicating crisis. Nothing located describes how an agent recognises that it has left its competence, who is notified, within what time, or whether a human reviews conversation transcripts at all. An automated channel that patients treat as a route to their care team creates an expectation of a listener, and no published material establishes that there is one.

Graded C.

Ask what triggers escalation from an agent to a person, the response time attached, and whether transcripts are reviewed.

The boundary between rules and models is the single most useful thing this vendor could publish, and it is precisely what is missing.

Company material describes the platform as resting on more than a decade of clinical rules engine and analytics work, and separately describes eligibility determination, risk adjustment, risk stratification, care plan generation, clinical alerting, care gap detection and assessments as each powered by artificial intelligence. Those two statements coexist across the published material and nothing reconciles them. A buyer cannot tell which of those functions executes a clinician authored rule and which produces a model output, and the difference decides everything about how the result should be treated. A rule can be read, audited and corrected. A model has an accuracy figure, a failure distribution and a retraining requirement, and this record supplies none of the three.

Everything downstream of that ambiguity is closed. A dedicated pass located no model card, no accuracy, calibration or validation figure for any predictive function, no description of algorithms used, no retraining cadence, no drift monitoring account, and no identification of the language or speech models behind the conversational agents.

The programme library is the one component described concretely, with more than 200 evidence based programmes combining pathways and analytics, and even there the evidence basis behind any individual programme and the process for updating it as guidelines change are not published.

Graded D. A platform marketed on artificial intelligence throughout, describing its own foundation as a rules engine, and publishing no performance figure for either.

Ask for a function by function split between rules and models, accuracy for each predictive function, and the models behind the agents.

The chain is closed at every link, and the conversational layer makes that harder to accept than it would otherwise be.

A dedicated pass located no sub processor register, no hosting or infrastructure provider, no named third party component, no data licensor and no subcontractor list.

The language and speech dependency is the specific problem. Agents conduct natural language conversations with patients by text message and voice. Neither capability is plausibly built from nothing by a company of this size, so an external provider almost certainly processes patient conversation content, and that provider is not named. A buyer therefore cannot determine who hears a patient's voice, what is retained, under what terms, or in what jurisdiction. It also cannot assess continuity, since a provider deprecating a model version or altering output behaviour would change how the product speaks to patients with no notice the customer could anticipate.

The content library raises a second question of the same kind. More than 200 evidence based programmes encode clinical guidance drawn from published sources, and how that content is licensed, attributed and updated as guidelines change is not described. A pathway silently running against a superseded guideline is a supply chain failure that presents as a clinical one.

The recapitalisation adds a governance dimension rather than a technical one. Under private equity ownership since April 2025, decisions about which components are built, licensed or consolidated sit with new holders, and nothing describes how a change would reach customers.

Graded D.

Ask for the sub processor register, the providers behind the voice and language agents, and how programme content is licensed and kept current.

Real external validation of the data, and outcome claims whose publication route undermines them.

The validation is genuine. The Certified Data Partner designation in the National Committee for Quality Assurance Data Aggregator Validation programme means an external body examined whether data flowing through this platform is fit to be scored on, which for an aggregation product tests the actual deliverable. Analyst recognition includes appearance in a major research firm's work on digital health platforms and an earlier best decision support award for accountable care organisations from an industry survey firm.

The outcome figures are specific and that is what makes their sourcing a problem. A sixth place national ranking among Medicare Shared Savings Program participants, 34 million dollars in shared savings, a 65 percent reduction in thirty day readmissions through automated care transition protocols, and a data pipeline live in eight weeks against a stated industry norm of six to twelve months are all precise enough to be checkable. They appear in a published comparison of the eight leading platforms in this market, and that comparison is published by Persivia. A vendor ranking a field that includes itself is not a neutral source for its own performance numbers, and this index records that plainly rather than passing the figures on unqualified. This is the same conflict pattern flagged against three separate vendors in earlier passes, and the finding here is the more unusual form, because the conflict sits in a document formatted as an independent market survey.

No customer is named against any figure, no denominator or period is given, and no peer reviewed publication was located.

Ask which customer produced each figure, over what period, and whether any result has been validated by anyone without a commercial interest in it.

An affirmative claim of continuous learning, a conversational channel reaching patients directly, and no governance statement covering either.

The claim is the starting point. Company material states that the platform is powered by artificial intelligence that becomes more capable with every interaction. That is a stronger assertion than most vendors make, and it converts the usual question about model training from an omission into an open contradiction with the silence around it. Learning from every interaction across a multi customer platform is either learning confined within one customer's tenancy, which limits the benefit, or learning that crosses customer boundaries, which is a business associate question of the first order. Nothing located says which, and a vendor advertising the capability is better placed than most to describe its boundary.

The channel raises the stakes further. Software agents conduct natural language conversations with patients by text message and voice about medication adherence, chronic disease and appointments. Those conversations contain protected health information generated by the patient in an unstructured form, and no statement was located covering what is retained from them, whether transcripts and recordings are stored, whether they feed the learning described above, or whether an external language model or voice provider processes them.

The custodial engineering that is described sits at the aggregation layer, where a longitudinal record is assembled across seven source types, and social determinant flags are used to target outreach. Using deprivation and demographic signals to decide who gets contacted is defensible practice and it also places sensitive attributes into an operational decision path with no published governance around their use.

Graded D. This is the sharpest version of this question in the lane, because the vendor asserts the capability that creates the risk and describes none of the controls.

Ask what is retained from patient conversations, whether learning crosses customer boundaries, and which external providers process voice and message content.

A credible compliance posture at the certification level, with the contractual layer entirely private.

The supporting evidence is real. HITRUST certification of the platform maps healthcare regulatory requirements onto an audited control set rather than leaving compliance as an assertion, and the aggregation validation credential involves an external body examining data handling. Business associate status is the correct posture for a processor holding identified clinical, claims and social data on behalf of providers and plans.

What is absent is every term a buyer would negotiate. No template business associate agreement, breach notification window, liability cap position, audit rights statement, subcontractor flow down provision or data return and destruction clause was located.

One feature of this product raises an obligation most records in this lane do not carry. Software agents contact patients directly by text message and voice, which means protected health information leaves the platform through conversational channels into consumer devices. The compliance questions attached to that are specific: what is transmitted in an unencrypted text message, how patient consent to that channel is captured and recorded, and how a patient revokes it. Nothing located addresses any of the three.

Graded C for a certified posture with the contractual specifics and the outbound channel obligations undisclosed.

Ask for the template agreement, the breach notification window, and how consent for text and voice outreach is captured and revoked.

A real certification at a modest assurance level, on one product, with no current attestation surface.

The credential is genuine. CareSpace holds HITRUST implemented one year certification, awarded in March 2024. That framework maps recognised standards and healthcare regulation into a single audited control set, and holding any level of it requires an external assessor rather than a self declaration.

The level is the qualification. The implemented one year certification sits in the middle of the framework's three tiers, above the entry assessment and below the risk based two year certification that a large healthcare buyer typically asks for. It examines a curated control set rather than a risk tailored one. Naming which tier was earned is to the company's credit, since vendors frequently report certification without the level, and the tier is what a security reviewer needs.

Three things hold this at C. No audited service organisation control report of either type was located, and that report is the standard artefact a health system procurement process requests. The certification located dates from March 2024 at a one year duration, and no statement of current standing or renewal was found, so a reader cannot establish that it is live. And no trust centre or portal was located where a buyer could retrieve current attestations, scope statements or penetration testing summaries without asking.

The contrast within this lane is instructive. Health Catalyst publishes which certification covers which named product with explicit coverage periods. Here a single certification is announced by press release and its current status is not visible anywhere.

Ask for current certification standing, any service organisation control report, and penetration testing cadence.

Outside device regulation by function, with the patient facing layer sitting closer to the line than the analytics.

Risk stratification for programme targeting, quality measurement, care gap identification and contract performance reporting are administrative and financial activities rather than diagnosis or treatment, so no clearance is required and none is claimed.

The regulatory weight the company carries sits in the payment domain and is substantial. Data validated under the aggregation programme feeds quality submissions that determine payment under federal risk contracts, and the platform is explicitly built around Medicare shared savings participation, accountable care organisation risk models and Medicare Advantage star ratings. Accuracy failures there are federally consequential even though they are not device matters.

The boundary case is patient facing education delivered by software. An agent conducting chronic care education by voice or text is communicating health information to a patient without a clinician composing the message, and where such software stays clear of device classification depends on whether it delivers authored educational content or generates individualised guidance. A language model conversing about medication adherence can drift from the first into the second without anyone deciding that it should. Nothing located establishes which description applies or what constrains the agent's output.

Graded C: correctly outside device regulation, genuinely consequential in payment, and unexamined at the boundary that its newest capability approaches.

Ask whether agent output is constrained to authored content and what prevents individualised clinical guidance.

The exposure runs through three distinct mechanisms in this product and none of them is addressed anywhere published.

The first is the documented one for this category. Risk stratification built on claims and utilisation history has a widely cited failure mode, where historical cost used as a proxy for health need understates illness in Black patients because less had historically been spent on them, and correcting the target variable substantially changed who received additional care. This platform performs exactly that function for accountable care populations.

The second is specific to how this vendor uses social determinants data. Deprivation and demographic flags drive targeted outreach to groups least likely to meet outcome thresholds, which is a defensible and potentially equity improving design. It also places proxies for protected characteristics directly into a decision about who receives attention, and the same mechanism steered slightly differently prioritises whoever is cheapest to move over whoever is sickest. Which objective the targeting optimises is not stated.

The third arrives with the conversational agents. Speech recognition and language understanding have documented performance differences across accent, dialect and age, so an outreach programme delivered by voice may simply work less well for some patients, and those are frequently the patients the programme was created to reach. No performance data by subgroup was located for any component.

A dedicated pass found no published bias testing, no fairness review process, no statement of target variables and no model documentation.

Graded D.

Ask what the risk models predict, what the outreach targeting optimises, and whether agent performance has been measured across accent and language groups.

Recourse is undefined at every point where it would be needed, and this product creates a category of exposure that most records in this lane do not.

A dedicated pass located no indemnification position, no warranty covering model or analytic output, no accuracy guarantee, no service credit regime tied to data quality or availability, and no described route to dispute an output believed to be wrong.

The financial failure modes are the familiar ones and they are substantial. Quality measures computed on incompletely ingested data move a reported score and the shared savings or star rating attached to it. A risk stratification that misses patients means care management resources go to the wrong people and a contract underperforms. For an independent accountable care organisation, a single performance year is often the difference between continued participation and exit.

The distinctive exposure is patient facing. Software agents contact patients directly about medication adherence and chronic disease without a clinician composing the message. If an agent misstates a medication instruction, fails to escalate a patient describing a serious symptom, or contacts the wrong patient with another patient's clinical context, the harm is clinical and it lands on a person rather than on a budget. The provider organisation whose name the outreach carries is the party the patient will hold responsible, and nothing published describes how responsibility is allocated between the organisation whose brand appears and the vendor whose software spoke.

Graded D.

Ask for the indemnification position on quality submissions, whether any warranty attaches to agent output, and how liability for an automated patient interaction is allocated.

Intake breadth is among the widest in this lane and it is externally corroborated, with the mechanics undescribed.

Seven source types are named and they cover the full set a population health calculation needs: clinical records from electronic health record systems, claims, health information exchange feeds, admission and discharge messages, patient reported data, home device readings and social determinants information. Two of those are worth calling out. Admission and discharge feeds are what make care transition programmes possible at all, since a transition programme that learns about a discharge from a claim arrives weeks late. Home device readings extend the record past the encounter and few platforms in this category ingest them.

The output of that intake is a longitudinal patient record surfaced at the point of care, and a customer describes the platform as having unified electronic health record and claims data and given clinicians a complete record in workflow, which is the operational test.

The external corroboration is the strongest element. The Certified Data Partner designation in the aggregation validation programme is an assessment of this exact capability by a body with no commercial interest in the answer.

Speed is claimed at eight weeks to an operational pipeline against a stated norm of six to twelve months. If accurate that is a substantial differentiator, and the claim is published by the vendor in a document comparing itself to competitors, so it is recorded here as a claim rather than a finding.

What holds it below the top is mechanics. No count of supported electronic health record systems, no description of how patient identity is resolved across sources, and no account of whether integration is bidirectional or whether insights return into the record.

Ask how many electronic health record systems are supported natively, how identity is resolved, and whether writes back to the record are supported.

This axis has almost nothing to describe. A dedicated pass located no hosting model, no named infrastructure provider, no statement of whether tenancy is dedicated or shared, no geographic residency position, no region selection, no recovery objective, no availability commitment and no failover description.

What can be inferred is thin and inference is not disclosure. The product is delivered as a platform reached in clinical workflow across many customer organisations, which makes cloud hosting close to certain, and company material refers to a single platform architecture, which suggests one shared codebase rather than customer specific builds. Neither establishes where data sits or who else's data sits beside it.

The gap matters more than it would for a lighter product. This platform assembles identified longitudinal records from seven source types across whole attributed populations, so it is a concentration point, and the questions a security review would ask about a concentration point are the ones with no published answers. Tenancy separation is the first of them, and the platform's own benchmarking and comparison functions imply some computation across customers, which makes the boundary a live question rather than a formality.

Continuity is the other absence. Accountable care organisations run care management, transition programmes and quality reporting on this platform daily, and outreach agents contact patients on a schedule. No commitment covering availability or recovery was located.

Graded D on absence of disclosure rather than on any adverse finding.

Ask where data is hosted, whether tenancy is dedicated, what residency options exist, and what recovery objective the contract carries.

Cost is absent from every published surface. A dedicated pass located no pricing page, no unit of charge, no range, no tiering, no implementation fee position and no minimum commitment.

The omission is more conspicuous here than for most records in this lane, because speed of deployment is the company's lead commercial argument. A claim that the data pipeline is operational in eight weeks against an industry norm of six to twelve months is an argument about cost, since the months saved are months of paid implementation and delayed contract performance. Making that argument while publishing no implementation fee position leaves the buyer holding only the half of the comparison that favours the vendor.

The unit question is open across a product that could plausibly charge per attributed life, per member per month, per programme deployed, per contract managed, per seat or as a platform licence. The programme library sharpens it, because more than 200 deployable programmes raises an obvious question about whether they are included, licensed in bundles or charged individually, and nothing indicates which.

Buyer type is worth noting as context. Independent accountable care organisations and provider networks are among the least resourced purchasers in healthcare, frequently operating without a procurement function, and they are the customers least able to establish a market price by themselves.

Ask for the unit of charge, whether the programme library is included or licensed, the implementation fee, and the contract term.

Broad on both axes that matter here, and the breadth is built rather than claimed.

Clinical coverage runs through a library of more than 200 evidence based programmes spanning chronic disease management, care transitions, preventive care, behavioural health and social determinants. That is coverage a customer can inspect item by item rather than an assertion, and behavioural health inclusion is worth noting specifically because it is the category most often left out of population health programmes and the one whose omission most distorts a risk picture.

Buyer and contract coverage is similarly wide. Payers, providers and hospital systems are all addressed, and supported programmes include Medicare shared savings participation, accountable care organisation risk models, Medicare Advantage star rating improvement, commercial payment transformation and newer federal models, with performance monitored across multiple contracts at once. Managing several contracts simultaneously is the operational reality for most organisations in this market and few platforms describe it as a first class function.

Data source coverage supports the clinical claim. Clinical records, claims, health information exchange feeds, admission and discharge messages, patient reported data, home device readings and social determinants information all feed the record, which is a wider intake than most records in this lane.

What holds it below the top is evidence of depth. Programme count establishes breadth of content and not the quality of any individual pathway, no customer count or installed base figure was located, and nothing establishes how the platform performs in a setting outside ambulatory and accountable care.

Ask how programmes are maintained as guidelines change, and what the installed base looks like by setting.