Prosper AI

Conversational voice agents are the entire product. There is no non AI version of an agent that navigates a payer IVR, holds, and speaks with a representative.

The agents operate autonomously on live payer and patient calls, and the vendor's oversight mechanism is automated quality assurance review of every call for accuracy and compliance rather than human sampling. That is a real control and unusual to state.

Held back from A because escalation thresholds, failure handling, and what happens when the agent obtains incorrect benefits information are not documented publicly, and the consequences of an error on a benefits call are financial and fall on the patient.

The company names its underlying model provider, which very few vendors in this index do, and describes the quality architecture concretely: every call scored by automated review for accuracy and compliance rather than by human sampling, with dashboards and exportable transcripts so a customer can inspect the record itself.

Exportability is the part worth emphasising. A buyer who can export transcripts can audit the agent's behaviour independently rather than relying on the vendor's own scoring, which is a materially stronger position than a published metric.

Held at B rather than A because the accuracy claims are unsupported by method. A figure of 99 percent is cited for quality assurance accuracy and again for claim follow up, with no definition of what counts as an error, no denominator, no error taxonomy and no independent validation. For an agent that obtains benefits and authorisation details a practice will act on, the interesting number is not overall accuracy but the rate at which it returns confidently wrong information, and that is not published.

This is the first record in the backfill to publish not just who is in the chain but what was negotiated with them, and that distinction is the whole point of the grade. The company states a zero day data retention agreement with its underlying model provider, so protected health information is not stored by that provider and is not used to train its models, and it names the provider rather than referring vaguely to a model partner.

Naming the provider tells a buyer where data goes; naming the term tells them what happens once it arrives, and this index has recorded repeatedly that a model provider's default enterprise posture is not a commitment from the party a customer contracts with. Here the vendor has closed that gap itself.

Around it sit encryption at rest and in transit, single sign on and role based access, audit logs, retention configurable by the customer, and exportable transcripts so a customer can hold its own record of what was said. Two caveats keep this honest rather than reducing the grade.

The commitments appear in the company's own marketing and comparison content rather than in a trust centre or published processing agreement, so they should be confirmed in the contract where they become enforceable. And configurable retention describes a control rather than a period, so the buyer sets it and should set it deliberately rather than inheriting a default nobody chose.

Adoption figures are reported (more than 150,000 providers reached, 40 to 60 care organizations depending on source) and revenue growth is claimed at 5x since seed. However the operative metrics for this category, containment rate and benefits accuracy, appear only as vendor claims such as 99 percent QA accuracy, without published methodology or independent validation. The company is early: founded 2023, Series A in 2026.

The strongest PHI position found in this category, because it answers the question that matters for a language model product rather than talking around it. The company states a zero day data retention agreement with its underlying AI model provider, so protected health information is not stored by that provider and is not used to train its models. It names the provider rather than referring vaguely to a model partner.

That is the disclosure this index asks every generative AI vendor for and almost none supplies. Alongside it: encryption at rest and in transit, single sign on and role based access, audit logs, policy driven retention configurable by the customer, and exportable transcripts so a customer can hold its own record of what was said.

Two caveats keep this honest rather than reducing the grade. The commitments appear in the company's own marketing and comparison content rather than in a trust centre or a published data processing agreement, so they should be confirmed in the contract. And policy driven retention describes a control rather than a stated period, so the buyer sets it and should set it deliberately.

The company states it signs business associate agreements as standard practice and operates under the privacy and security rules, and it publicly articulates a point most vendors leave out: that compliance requires subprocessor agreements with every service touching protected health information, naming the model provider, speech to text, text to speech and the telephony carrier as examples.

Setting that expectation publicly is creditable, and unusually the company appears to meet its own test by naming those layers for its own product rather than only describing the requirement.

Held at B rather than A because no agreement text or terms are published, so a buyer can see the posture and the reasoning but not the instrument. Ask for the agreement and for the corresponding subprocessor agreements, since the company's own framing makes clear that the chain is where the exposure sits.

SOC 2 Type II attestation with the type named, described as independently audited, alongside AES 256 encryption at rest, transport encryption, single sign on, role based access control and audit logging. Business associate agreements are stated to be signed as standard.

Held at B rather than A on two grounds. This is a single confirmed framework: HITRUST CSF appears in one of the company's own articles but is not repeated across its other material, so it is recorded as claimed rather than credited, and a buyer should establish whether a HITRUST certification exists and at what level. And no trust centre or self serve report access was located, so obtaining the report still requires a request.

The control set described is coherent and specific for a company at this stage, which is why the absence of a central place to verify it is the main thing standing between this and a higher grade.

No FDA pathway applies and none is claimed. Voice automation of scheduling, eligibility, authorisation and billing calls sits well outside Software as a Medical Device.

Graded C on a specific and consequential silence. This product runs artificial voice calls in both directions: to payers, which is business to business and outside the consumer telephone consent framework, and to patients, which is not. The FCC ruled in February 2024 that AI generated voices are artificial voices under the Telephone Consumer Protection Act, requiring prior express consent and identification of the entity responsible for the call. Outbound patient contact for balance collection and proactive re engagement sits squarely inside that.

Recording consent is a second exposure, since all party consent statutes in several states cover business calls as well as consumer ones, and this product generates recordings of both.

The silence is notable rather than routine here, because the company publishes detailed and accurate guidance on health privacy compliance and subprocessor chains. It writes authoritatively about one regime while saying nothing about the one governing its own outbound dialling.

No AI governance framework, bias evaluation or subgroup performance disclosure was located.

The automated quality assurance review of every call is a real control and is credited on the autonomy axis, but it measures accuracy and compliance rather than equity, and scoring every call does not by itself reveal whether performance varies across callers.

The mechanism is well documented in speech systems generally: recognition accuracy varies with accent, dialect, speech rate, and conditions like hearing impairment or a speech difference. On the patient facing side that determines who can complete a scheduling or billing call without being transferred, and repeated failure to be understood by an automated system is a real access barrier for the people most likely to encounter it.

The company holds the data to answer this. It scores every call already, so reporting containment and comprehension by language and caller characteristics is an analysis it is better placed to run than almost anyone. Nothing published indicates it does.

Two properties here give a customer the means to hold the vendor to account themselves, which is a stronger position than any published metric. Every call is scored by automated review for accuracy and compliance rather than by human sampling, so the measurement covers the population rather than a sample and an unusual failure cannot fall outside the sampled set.

And transcripts are exportable, which is the part worth emphasising: a buyer who can export transcripts can audit the agent's behaviour independently, build their own error taxonomy, and check the vendor's scoring against their own reading. That inverts the usual dependence, where a customer can only know what the vendor reports. Held below the top grade because the published figures have no method behind them.

A high accuracy figure is cited for two different things, with no definition of what counts as an error, no denominator, no error taxonomy and no independent validation, and no warranty, indemnity or remediation commitment attaches.

The interesting number for an agent obtaining benefits and authorisation details a practice will act on is not overall accuracy but the rate at which it returns confidently wrong information, because a wrong benefit check produces a decision made on false footing rather than a visible failure. Ask for that rate, the error definition behind the headline figure, and what the automated scorer itself misses.

API first integration with practice management and EHR systems, with the agents reading from and writing back to those systems rather than operating alongside them, and a reported three week implementation. Named EHR marketplace listings or certifications were not verified.

Unusually complete for a voice product, and it addresses the two layers this index has found most often unstated. Deployment is offered in the cloud or on premise. The underlying model provider is named, with a zero day retention agreement attached. And the telephony layer is named rather than left implicit, with connections to established contact centre and carrier platforms alongside payer portal access by interface or batch transfer.

That matters because voice products carry a subprocessor chain most buyers never see: the model provider, speech to text, text to speech and the telephony carrier each touch call content. Naming them is the first step to assessing them.

Held at B rather than A because no hosting region or data residency commitment was located, and because the naming appears across comparison content rather than in a maintained subprocessor register a buyer can rely on. Ask for that register, with each subprocessor's role and retention terms, and ask to be notified when it changes.

No public pricing. Contact the vendor. Sold through enterprise agreements with provider groups and billing organizations; no published rate card.

Clearly scoped to outpatient groups, medical billing organizations, and health system patient access and revenue cycle functions, spanning scheduling, intake, benefits verification, prior authorization, claim follow up, and billing. Clear operational scope; no clinical claims made, which is appropriate.