Protenus

The clearest AI necessity case in the cybersecurity category. The problem is definitionally unsolvable manually: health systems generate volumes of EHR access events and medication transactions so large that compliance teams historically reviewed a tiny fraction, leaving the rest unexamined. Moving from sampling to 100 percent coverage of accesses and medication transactions is only possible with automated behavioural analysis. The method is genuinely model-driven, building profiles of both patients and accessing users from EHR, HR and dispensing cabinet data and reasoning about the appropriateness of each event. Recognised by Gartner as a Cool Vendor in Healthcare Artificial Intelligence, and the approach is protected by granted patents rather than asserted.

Detection and triage feeding human investigation, which is the correct design given the consequence of an alert is an accusation against a named employee. The system surfaces cases for compliance and pharmacy teams to review rather than taking action, and the reported outcomes are review-efficiency metrics, 70 percent time savings in case review and 86 percent decrease in case resolution time, which confirms humans remain the decision makers. The company also describes a case-based rather than report-based approach to diversion surveillance, meaning it assembles an investigable case rather than emitting raw alerts. Graded B rather than A because no false positive rate, alert precision figure or confidence threshold is published, and in a product that generates suspicion about individual staff the precision of the alerting is the number that matters most.

The mechanism is described with unusual specificity for a security vendor: named data sources spanning EHR, HR and automated dispensing cabinet systems, dual profiling of patients and of users, and the specific patient attributes used including demographics, appointment information and procedure and diagnosis histories. Patent US 11,621,065 provides publicly readable technical disclosure of the diversion detection methods, which is a genuine transparency channel few vendors offer. Graded B rather than A because no accuracy, precision or recall figures with stated methodology were located, and the index's category editorial requires named detection methodologies rather than marketing language.

The strongest third party validation of any vendor in this category. Best in KLAS 2023 in BOTH patient privacy monitoring and drug diversion surveillance, which is customer-sourced independent research and rare to win in two categories simultaneously, plus Gartner Cool Vendor recognition in Healthcare AI. Granted patents provide independent examination of novelty, though not of efficacy. Graded B rather than A because the operational metrics, 70 percent time savings in case review and 86 percent decrease in case resolution time, are vendor-reported without disclosed methodology or sample, and because no published data quantifies detection performance, meaning violations or diversion events caught that manual sampling would have missed. That is the outcome that would justify the product and it is not published.

The PHI position here is unusual and demands care rather than reassurance: to detect inappropriate access to patient records, the platform must itself hold and analyse comprehensive patient data, including demographics, appointments, procedures and diagnosis histories, plus HR records and dispensing logs. A privacy monitoring system is therefore among the most PHI-dense platforms a health system will deploy, and the correct question is who watches it. Data residency is disclosed as US-based AWS infrastructure, which is more than most vendors in this lane provide. Graded B rather than A because no published retention policy, access control description or statement on whether customer data trains models was located, and those are precisely the questions this product asks of everyone else.

HIPAA compliance is the product's entire purpose, with the platform built to automate HIPAA privacy investigations and produce audit trails for regulatory response, and the company necessarily operates as a business associate handling PHI at scale. Graded B rather than A because no BAA terms were located in published form.

No third party attestation such as SOC 2 Type II or HITRUST was retrieved at the time of review. Consistent with every other vendor in this category, and once again sharpest for the vendor holding the most sensitive data: a platform aggregating EHR access logs, HR records and dispensing data across a health system is an extremely high-value target.

Not an FDA regulated product. Compliance analytics and access monitoring sit outside Software as a Medical Device. The governing regulatory surface is substantial but different: HIPAA Privacy and Security Rules, breach notification obligations, DEA controlled substance recordkeeping requirements, and state nursing and pharmacy board reporting duties when diversion is substantiated.

No governance framework, subgroup analysis or bias evaluation located, and this is the axis where the stakes are highest across the entire cybersecurity category. This product is WORKFORCE SURVEILLANCE: it builds behavioural profiles of named clinicians and flags them for investigation over conduct that can end a career, trigger licensure board referral, or result in criminal prosecution. Any systematic tendency to flag particular roles, shift patterns, units or demographic groups more readily converts directly into disproportionate investigation of those staff. Access patterns also vary legitimately by role and specialty in ways a model may misread as anomalous. The company's own framing acknowledges the human context, noting most healthcare workers are benevolent and that diversion often intersects with clinician burnout and substance use disorder, but no published fairness evaluation, appeal mechanism or false accusation rate was located.

Integration depth is the precondition for the product working at all, and it spans three system classes that rarely sit together: electronic health records for access logs, HR systems for employee context including role, department and employment status, and automated dispensing cabinets for medication transactions. Combining those into a single view is what allows the platform to reason about whether an access was appropriate for that person in that role at that time, rather than merely that it occurred. Consolidating this into one dashboard serving compliance, security, risk management and pharmacy teams simultaneously is a genuine cross-functional achievement, since those functions typically operate from separate systems.

Cloud platform with disclosed data residency on US-based AWS infrastructure, which is more specific than most vendors in this index provide and is corroborated by independent comparison rather than only by the vendor. Graded B rather than A because US-only residency is a constraint for any non-US buyer, and no on-premise or regional hosting option was located.

No pricing published. Independent comparison reports enterprise-level pricing typically scaled by hospital size or patient volume, which is useful directional information but comes from a third party rather than the vendor. No rate, tier structure or contract minimum is disclosed publicly.

Two distinct compliance domains, patient privacy and controlled substance diversion, served from one platform across hospitals and health systems, reaching compliance, privacy, security, risk management and pharmacy functions. Serving both the privacy office and the pharmacy from a single behavioural analytics engine is a real breadth advantage and reflects the insight that both are workflow anomaly problems. Graded B rather than A because coverage is confined to provider organisations and to insider risk specifically, without extending to payers, device manufacturers or external threat detection.