Pieces

Proprietary generative AI is the product. The Pieces Intelligence Platform condenses and summarises clinical data and pre generates documentation directly inside the EHR, the company is physician led and NIH backed, and it reports more than 10 million AI generated clinical documents produced. Nothing here is a workflow layer over someone else's model, and the company built its own hallucination classification research rather than buying one.

The described oversight architecture is genuinely more developed than most of this category, and it deserves saying plainly given the enforcement history. Pieces described a closed loop: random clinical summaries are selected for review, an adversarial AI model flags any that may contain a severe hallucination using evidence drawn from the medical record, flagged summaries are referred to a physician who reviews and assesses them, corrects any severe hallucination found, and comments on the changes made.

That is sampling, automated detection, a human adjudicator and a feedback path, which is more machinery than any other vendor in this lane has described. Held at B for two reasons. The rate that loop produces is the exact figure a state regulator challenged, so the mechanism is described while its output is disputed. And no sampling fraction, no severity threshold, no adjudication methodology and no inter rater agreement is published, so a buyer cannot judge whether the loop would catch what it needs to catch.

The most instructive transparency case in this category, and the grade needs its context. Pieces did something almost nobody in this lane does: it built a risk classification system for generative AI hallucinations over several years and published quantified error figures, advertising a critical hallucination rate and a severe hallucination rate of under 0.001 percent and under 1 per 100,000.

Those specific figures then became the subject of a Texas Attorney General action alleging the supporting metrics were inaccurate, and the central remedy in the resulting agreement is clear and conspicuous disclosure of how such metrics are calculated. Pieces denies the metrics were inaccurate.

Graded C because a published number whose derivation is contested and undisclosed does not let a buyer evaluate the product: it is not clear what population was sampled, how severity was defined, or who adjudicated. No base model is named, and no updated methodology has been published since the acquisition. The lesson generalises and is not to the company's discredit: it published a rate, which invited scrutiny, and almost no competitor publishes one to be scrutinised.

A published purpose statement is doing work it cannot do, and reading it carefully is the point of this record. The overview says information is used only to deliver and improve the services and never for unrelated purposes. Improvement is precisely where model training sits, so a sentence permitting improvement is not a statement that customer data is excluded from training, and a buyer reading it as an assurance would be reading in something the words do not say.

Ask for the training exclusion in explicit terms rather than inferring it from a purpose limitation. The acquiring group's trust centre lists data privacy items covering data into the system, data out of the system and a named privacy officer, and publishes a sub processor list, which are genuine positives and are credited: their contents render client side and could not be retrieved, so what they say is unknown rather than absent and a buyer with access should read them first.

Three facts belong in the diligence conversation. Enforcement material established that several major hospitals were transmitting patient data to this product in real time, so the flow is continuous rather than batch. The estate now sits inside a platform assembled from four businesses, so ask where the data resides today and which entities within the group can reach it. And the product has been fused with a revenue cycle engine, so record content gathered to support documentation now also serves a reimbursement purpose. Establish whether a customer can decline that.

Deployment scale substituting for evidence of benefit, which this index consistently grades C. More than 10 million AI generated clinical documents and use across hospitals and health systems nationally, plus NIH funding as research backing. Deployment at four major Texas hospitals is unusually well corroborated, though by an odd route: it is established by a state attorney general's investigation rather than by a case study.

No peer reviewed outcome study, no controlled evaluation and no independently validated accuracy figure was located, and the accuracy metrics that did exist are contested.

An attribution caution matters here. The strong figures published alongside SmarterNotes, including 12 million cases analysed, 36 percent of encounters with new comorbidity opportunities, a 5 to 1 return from day one and about 2.5 million dollars in annual net new revenue per 10,000 discharges, are attributed by the vendor to the SmarterDx offering rather than to the Pieces summariser. They are not evidence about this product.

No retention period, no de identification standard and no training use position was located on any published surface. The acquiring group's trust centre lists data privacy items covering data into the system, data out of the system and a data privacy officer, and publishes a subprocessor list. Those are genuine positives and are credited here. Their contents render client side and could not be retrieved, so what those items say is unknown rather than absent, and a buyer with trust centre access should read them first.

What is published is a purpose statement, and it does not answer the question. The overview says information is used only to deliver and improve the services and never for unrelated purposes. Improvement is precisely where model training sits, so a sentence permitting improvement is not a statement that customer data is excluded from training. Ask for that in explicit terms rather than reading it into the purpose limitation.

Three facts belong in the diligence conversation. The Texas enforcement action established that at least four major Texas hospitals were transmitting patient data to this product in real time, so the flow is continuous rather than batch. The estate now sits inside a private equity backed platform assembled from four businesses, so ask where that data resides today and which entities within the group can reach it. And the product has been fused with a revenue cycle engine to form SmarterNotes, which means record content originally gathered to support documentation now also serves a reimbursement purpose. Establish whether data collected under the original use case is used for the revenue product, and whether a customer can decline that.

HIPAA compliance is named on the acquiring group's trust centre, with a HIPAA report and workforce HIPAA training listed as separate items. That is a materially stronger assertion than a marketing line and it lifts this row off an unretrieved absence. No business associate agreement terms are published, and nothing states whether an agreement is included, negotiated or separately priced, which is the standard middle rung on this axis.

Two questions specific to this record stay open, and the trust centre answers neither.

The first is the counterparty. A health system that contracted with Pieces signed with a company that no longer exists independently. Establish which entity holds that agreement now, whether it was assigned or novated at the September 2025 transaction, whether the health system was asked to consent, and whether the terms survived unchanged. An agreement that moves by operation of a transaction rather than by a fresh signature is still the document a buyer will be held to.

The second is scope. The trust centre's own overview identifies SmarterDx as its subject rather than the group or this product, so confirm that the posture described there extends to the systems this product runs on and is not describing a sibling business under the same brand.

The acquiring group publishes a genuine trust centre at trust.smartertech.com, hosted on SafeBase, and it sits well above the norm for this category. Named compliance covers HIPAA, SOC 2 Type 2 and TX-RAMP Level 2. Access controlled documents include the SOC 2 report, a penetration test report, a HIPAA report and cyber insurance. Published alongside them are a subprocessor list, an information security policy, business continuity and incident response policies, recovery time and recovery point objectives, a software bill of materials, a standardised information gathering self assessment, a forensic retainer, and Amazon Web Services named as the infrastructure provider with a separate production environment.

TX-RAMP Level 2 is worth drawing out because it is externally validated and unusually apt here. It is the Texas state authorisation programme for cloud services handling confidential data on behalf of state agencies and public institutions, and this product originated in Texas, served Texas hospitals and was the subject of a Texas enforcement action.

Held at B rather than A on a scope question the buyer has to resolve. The trust centre carries the group brand, but its own overview is written in the first person about SmarterDx, one of the constituent businesses, and nothing on the page names Pieces or the SmarterNotes product it was folded into. Smarter Technologies was assembled in May 2025 from three businesses and acquired this one in September 2025. Assurance published at a group domain does not by itself establish that an acquired product estate sits inside the audit boundary. Ask for the scope section of the SOC 2 report and confirm in writing that it names the systems this product runs on.

An unusual entry on this axis and the distinction matters. No FDA clearance, device authorisation or clinical decision support exemption analysis was located for a product that summarises a patient's condition and treatment for clinical staff.

What does exist is a regulatory instrument of an entirely different kind: a five year Assurance of Voluntary Compliance entered with the Texas Attorney General on 18 September 2024 under the Texas Deceptive Trade Practices Consumer Protection Act, carrying obligations on marketing disclosures, prohibitions on misrepresentation including as to the independence of endorsers and reviewers, and a requirement to respond to the Attorney General's information requests within 30 days.

Read it for what it is. It is a consumer protection instrument governing how the product may be described, not a device authorisation, not a safety assessment and not a finding that the product caused harm. It is graded here rather than ignored because it is a live regulatory obligation a buyer should know about, and because it is the only formal regulatory engagement this category has yet produced.

The grade describes disclosure and incentive structure, not wrongdoing, and the facts should be read carefully in both directions. On 18 September 2024 the Texas Attorney General announced the first state enforcement settlement in the United States involving a healthcare generative AI product, alleging that Pieces made false, misleading or deceptive claims about the accuracy of products used by at least four major Texas hospitals to summarise patient conditions and treatment.

The matter resolved by Assurance of Voluntary Compliance. There was NO monetary penalty, NO admission of liability and NO adjudicated finding of wrongdoing. Pieces publicly denied wrongdoing, disputed that it had misrepresented its hallucination rate, and stated that the Attorney General's press release misrepresented the agreement and was inconsistent with it, noting the order does not address product safety.

The company also said it supports additional oversight and regulation of clinical generative AI and signed the agreement to advance that conversation. A second and separate governance consideration now applies: since the September 2025 acquisition the documentation product is marketed as generating notes optimised for reimbursement from the start and identifying missed revenue opportunities, which places it on the coding gradient this index tracks, in the tight loop shape where documentation and revenue sit inside one platform with no vendor boundary between them. No fairness, subgroup or demographic performance disclosure of any kind was located.

This is the most instructive record in the category and the context must come first, because the grade would be misread without it. The company did something almost nobody in this lane does: it built a risk classification system for generative artificial intelligence hallucinations over several years and published quantified error figures, advertising a critical hallucination rate and a severe hallucination rate at very low stated levels.

Those figures then became the subject of a state attorney general action alleging the supporting metrics were inaccurate, and the central remedy in the resulting agreement is clear and conspicuous disclosure of how such metrics are calculated. The company denies the metrics were inaccurate. The lesson generalises and is not to this company's discredit: it published a rate, which invited scrutiny, and almost no competitor publishes one to be scrutinised.

A market where publishing a number attracts enforcement and publishing nothing does not is a market that selects for silence, and this index should say so. The grade is C because a published number whose derivation is contested and undisclosed does not let a buyer evaluate the product: what population was sampled, how severity was defined and who adjudicated are all unclear. Note also that the remedy is a disclosure requirement, which is precisely what this axis asks for. No base model is named and no updated methodology has been published since the acquisition. Ask for the calculation method.

The right architectural shape with the naming gap this index consistently calls out. The platform is described as operating directly within the electronic health record, condensing and summarising clinical data in place and pre generating progress notes, discharge summaries and multidisciplinary care plans, and it reaches three separate role types inside the same system.

Deployment at multiple large hospital systems corroborates that this is real embedded delivery rather than copy and paste. Held at B because no EHR vendor is named on any retrieved surface and no integration mechanism, standard or certification is described, so an organisation cannot confirm its own system is supported without asking.

The platform is described as cloud hosted, which establishes a single hosted delivery model with no on premise option offered. Beyond that nothing is published: no cloud provider, no region, no residency commitment and no customer choice over where clinical data is processed. The acquisition adds a question that did not exist before, since the hosting arrangement and the corporate entity behind it both changed in September 2025 without any published statement about what moved where.

No pricing, tier, mechanism or contracting detail is published for the Pieces product or for SmarterNotes.

The commercial surface is harder to assess than it was before the acquisition, because the summarisation capability is now sold inside a broader revenue cycle platform and it is not stated whether it can be licensed separately.

Inpatient acute care, and distinctive for who it serves rather than for which specialties. This is the only product in this category so far that explicitly addresses case managers alongside physicians and nurses, generates multidisciplinary care plans as a first class output, and has tracked barriers to discharge as a named capability.

Most of this category assumes a physician reading a chart before a visit. This one reaches the discharge planning and care coordination workflow, which is a different job with a different failure cost.

Graded B rather than A because the breadth is by role and document type rather than by demonstrated specialty specific behaviour, and no specialty level depth was located.