Phreesia

This is a platform that has added artificial intelligence, not a company built on it, and the company says so itself. Its chief executive has stated publicly that artificial intelligence is a tool rather than the story, and the near term value described to investors is internal: reducing reliance on manual and outsourced work to expand margin.

The customer facing exception is the voice product launched in September 2025, which does genuinely require language understanding to take a refill request or route a clinical question. That is one line among intake, payments, eligibility, consent and financing, all of which predate it and none of which needs a model.

Read this record the way the index reads a practice management system with a scribe attached: the artificial intelligence is real and it is a feature of a larger business.

The voice product handles calls end to end for defined tasks, capturing what is needed and acting or routing without a person, which is real autonomy at the front door of a practice.

The design shows sensible discrimination between task types. Payments and balance enquiries complete automatically; refill requests are captured in full rather than decided; clinical questions are captured and routed to the clinical team rather than answered. Deciding what the system will not attempt is the important part, and here the boundary falls in a defensible place.

Held at B because no escalation rate, containment threshold or after hours failure behaviour is published, and because nothing describes what a caller hears when the system cannot classify what they are asking for.

The voice product's tasks are enumerated clearly and the technology behind them is not described at all: no model, no architecture, no containment or accuracy figure, and no statement of which languages it handles.

The company is markedly more transparent about its finances than about its technology, since securities disclosure obliges it to publish client counts, visit volumes and segment revenue that most vendors here withhold. A reader gets an exceptionally clear picture of the business and almost none of the system.

The controls are independently assessed rather than asserted and they cover three distinct domains, which is more than a single certification demonstrates. An assessment at the full risk based tier is the complete evaluation rather than a curated subset, and it sits alongside an audited service attestation and payment card certification at the highest level, so a buyer knows clinical data handling, operational controls and card handling were each examined by someone outside.

The data is extensive: intake collects clinical history, screening responses, consents, insurance and payment details across a very large number of visits, which makes this one of the broader patient facing collection surfaces in the index. Held at C because certification answers a different question from this axis.

No retention schedule, no secondary use position and no sub processor list was located, and a certification establishes that controls exist and were tested while saying nothing about what the company is permitted to do with the data those controls protect.

One question is specific to this business model and should be asked directly rather than inferred: patients are shown messaging during intake, and whether the clinical information they have just entered informs which messages they see is a stewardship question as much as a commercial one. Ask that, plus retention and a sub processor list.

Scale is verifiable in a way almost nothing else in this index is, and it is still not evidence of benefit.

The figures that matter, 4,514 client organisations and more than 180 million patient visits enabled in a year, are disclosed in securities filings, so they carry legal consequence if wrong. That is a materially better class of corroboration than the unattributed customer counts common here, and this index should credit the difference.

What is absent is any measurement of effect. No published study of intake completion, collection rates, staff time, call containment or patient experience attributable to the product, and nothing at all on the voice product's performance since launch.

Stronger than most because the controls are independently assessed rather than asserted. HITRUST at the r2 tier is the full risk based assessment rather than a curated subset, and it sits alongside SOC 2 Type 2 and payment card certification at the highest level, which together cover clinical data, operational controls and card handling.

The data itself is extensive: intake collects clinical history, screening responses, consents, insurance and payment details across a very large number of visits. Held at B rather than A because no retention schedule or statement on secondary use is published, and because the question raised on the governance axis, whether intake data informs the messaging shown to patients, is a stewardship question as much as a governance one and is unanswered.

Rests on something checkable rather than on a claim. HITRUST r2 maps a certifiable control set onto health privacy requirements and is assessed by an external party, and the company holds it alongside SOC 2 Type 2.

No business associate agreement posture was located publicly, which is the usual gap. For a vendor operating across more than four thousand organisations the agreements are plainly standardised, and the terms are not published.

The strongest security disclosure pattern in this index, earned the same way Infermedica and Medsender earned theirs: the tiers are named.

HITRUST is stated at r2, which is the full risk based assessment rather than the entry or curated levels, and this index has already noted that treating a HITRUST badge as one thing obscures four different things. SOC 2 is stated as Type 2, describing controls operating over a period rather than at a point. Payment card compliance is stated at Level 1, the tier applying to the highest transaction volumes.

Three independent attestations, each with its tier specified, from a company that also carries securities level scrutiny of its cybersecurity governance. A buyer can check all of it.

No device pathway applies and none is claimed. Intake, payment and consent are administrative.

The regulatory surface that does apply is unusual for this index and worth naming. As a listed company it carries securities disclosure obligations, and in May 2026 class actions were filed in Delaware concerning statements about fiscal 2027 guidance and the durability of its messaging segment. That is investor litigation about disclosure, not about patient harm or product performance, and it is recorded here as a fact a diligent buyer would find rather than as a judgement.

Separately, the messaging business sits close to rules governing promotional communication about medicines, and the company itself cites regulatory policy as affecting what its life sciences clients will spend.

Nothing published on evaluation, monitoring or performance variation for any model, including the voice product, where the equity exposure is the familiar one: automated telephone handling performs unevenly across accent, dialect and speech difference, and the caller who is misunderstood at the front door is the one who does not get the appointment.

The larger unanswered question is not about a model at all. The company delivers messaging funded by pharmaceutical manufacturers to patients during intake, and it simultaneously collects clinical and screening information from those same patients in that same flow. Whether the first is targeted using the second is the question any reader will ask, and no public material located here answers it either way. It should be put to the company directly rather than inferred, and a provider organisation should establish what its own patients are shown and on what basis before it signs.

Two passes located no model, architecture, containment or accuracy figure, no statement of which languages the voice product handles, no evaluation methodology and no warranty, indemnity or remediation commitment, while the product's tasks are enumerated clearly. The contrast inside this one company is the finding, and it is the third instance of the same pattern in this backfill.

Securities disclosure obliges this business to publish client counts, visit volumes and segment revenue that most vendors here withhold, so a reader gets an exceptionally clear picture of the business and almost none of the system. The company is demonstrably capable of precise, audited, consequential public reporting, and applies it where an external obligation exists and not otherwise.

That is worth stating because it disposes of the usual explanation: a firm that reports to an exchange has the discipline, the legal review and the internal measurement to publish an error rate, and the absence is a choice about what is required rather than about what is possible. The voice product answers patient calls, so the missing containment and escalation figures are the ones that describe what happens to a patient who rang about something the system could not handle. Ask for containment and escalation rates, accuracy of intent recognition, the language list, and what the system does when a caller says something clinically urgent.

Among the strongest integration positions in this index. Independent analysis describes the broadest record system connector library in its category, and the company holds a listing in the dominant vendor's own connection marketplace, which requires meeting that vendor's technical requirements rather than building around them.

That matters because intake is only useful if what the patient enters lands in the chart and the ledger without rekeying. Held at B rather than A because no interface standard, certification level or write back mechanism is described publicly, and the connector count is characterised by others rather than published by the company.

Not described publicly. The historical model put a dedicated device in the waiting room; the current one spans that, patient owned devices and the telephone, which is a wider surface than most records here.

No hosting model, region or retention position was located, and for a platform carrying both clinical intake and card payment data those are two distinct residency questions rather than one.

No published price list, and considerably more visibility than a private vendor offers, because listing forces it. Segment revenue is disclosed, and the company reports revenue per average healthcare services client as a headline metric, which lets an outside reader derive a rough annual spend per organisation and watch it move.

That is the same pattern this index recorded on listed diagnostics vendors: the obligation to inform shareholders produces information buyers can use. What it does not produce is a rate card. A buyer should establish how the three revenue lines apply to them, since subscription, payment processing and the messaging business have entirely different structures, and should ask specifically whether any part of the commercial arrangement depends on their patients receiving sponsored content.

Very broad by reach and confined to one moment in the journey. More than four thousand five hundred client organisations and over 180 million patient visits a year span independent practices, ambulatory groups and health systems, and the platform is specialty agnostic because every patient checks in.

Functional coverage now runs from scheduling and intake through eligibility, consent and screening to payment and financing, which is wider than intake alone and is what the company means by front of cycle. Held at B because it stops where care begins: nothing addresses the clinical encounter, the record, or anything after the visit except the bill. United States only.