Spring Health

Precision Mental Healthcare is the core: machine learning matches members to modality and provider, and Compass turns every interaction into recommended provider actions. AI is the mechanism of the platform, not an add on.

Advisory to licensed clinicians by design: models surface matches and real time provider feedback and cues, and a human clinician delivers care. Oversight is inherent to the model but not formalized in a published governance document beyond VERA-MH.

No model card, named model family, published accuracy figure or evaluation methodology was retrieved, and the vendor describes its matching technology as clinically validated without the validation being reachable in this pass.

The reason to press rather than accept that is unusual: the evidence very likely exists in the open literature. The company originated as a university research spin out, one founder is an active academic in machine learning applied to psychiatry, and the business is described as publishing peer reviewed evidence continuously and tying outcome monitoring to commercial contracts. A vendor of this profile can normally supply a bibliography rather than a marketing claim.

So the ask is specific and low cost. Request the peer reviewed publications underpinning the matching model, what outcome it was validated against, in what population, and whether the deployed system is the one that was studied. That last question matters for any model retrained since publication.

One separate category of claim should be handled differently. The vendor publishes commercial outcome figures including multiples of return on investment and percentage savings on mental healthcare spend. Those are financial claims made to employers rather than clinical ones, and a third party review notes they appear without independent verification. They should not be read as evidence about model performance.

Ask for the publications, and keep clinical validation and commercial return claims separate.

Nothing identifies any party in the chain: no model or model family, no foundation model provider, no hosting arrangement and no sub processor list was located in two passes, and no statement was found on whether clinical content is used to train models. The structural feature that makes this axis unusual here is who the parties are. The paying customer is an employer, the person receiving care is that employer's employee, and the subject of the data is therefore not the customer.

The vendor operates an analytics platform giving benefits managers insights and return on investment forecasting, so an employer facing reporting flow exists by design and is part of what is being bought. Aggregate and de identified reporting is the correct arrangement and is presumably what is provided, and the question is granularity rather than intent: in a small team or a single site, utilisation and outcome aggregates can identify individuals without naming them, and an employee has no way to know what their employer can infer. Ask for the minimum group size below which no figure is reported, what dimensions can be crossed in a report, the retention schedule, and a sub processor list.

Strongest evidence in the index so far: a peer reviewed JAMA Network Open study reporting an average time to remission of 5.9 weeks and roughly 70 percent of participants reliably improving, plus 30+ publications cited. Graded on the existence and venue of peer reviewed evidence; this index does not re verify the underlying study.

The vendor publishes more on this than almost any record in this index, and the structure of its business is why it matters.

What is stated: both members and providers must consent to AI assisted care, members have transparency into how their data is used and can opt in or out of sharing, and an internal AI governance board oversees the tools. Dual consent is rare and is the right design here, because a therapist has their own professional stake in whether a session is processed by software and a member has theirs. Most vendors in this index obtain neither.

What holds it short of the top grade is the structural question the disclosures do not reach, and it is the central one for this model. The paying customer is an employer; the person receiving care is that employer's employee. The subject of the data is not the customer.

The vendor operates an analytics platform giving benefits managers insights and return on investment forecasting, so employer facing reporting exists by design. Aggregate and de identified reporting is the correct arrangement and is presumably what is provided. The question is granularity. In a small team or a single site, utilisation and outcome aggregates can identify individuals without naming them.

Ask for the minimum group size before any figure is reported, the retention schedule, and whether clinical content trains models.

HIPAA compliance is stated on the member FAQ. BAA availability and execution terms are not published; expected given employer and health plan contracts but not evidenced on the site.

The vendor states that its technology infrastructure holds SOC 2 certification and HITRUST alongside health privacy and European data protection compliance, and presents these together on its own materials rather than through third parties.

Holding both examined frameworks is the substantive point. They test different things. SOC 2 evaluates controls an organisation itself defines against trust criteria, so its rigour depends partly on what was scoped in. HITRUST is prescriptive: an assessor evaluates against a defined control set built for healthcare, and certification means meeting that external standard rather than one the company chose. A vendor holding both has been assessed on its own control design and against a healthcare specific benchmark.

Two details are missing and both are ordinary asks. The SOC 2 report type is not stated, and this index has repeatedly found that distinction blurred: a Type II tests operating effectiveness across a period, a Type I assesses design at a point. And the HITRUST assessment level is not stated, which matters because the framework offers tiers of very different depth, with the highest requiring validation against a substantially larger control set.

No dates or scope statement were located either, and scope is a real question for a company operating a provider network, its own record system and an employer analytics platform.

Ask for the report type, the HITRUST level and validity dates, and what each covers.

No clearance is claimed and no device pathway attaches to care navigation and matching. This axis does not read as an absence, because a substantial regulatory structure governs this business and the vendor engages with parts of it visibly.

What governs is a combination. Mental health parity requirements shape how employer sponsored behavioural benefits must be designed relative to medical coverage. Clinician licensure is state by state, and a network operating in all fifty states plus internationally is managing licensure and cross border practice rules continuously. And the vendor holds accreditation from the recognised behavioural health accrediting body, which examines clinical quality and crisis care and is a genuine external assessment rather than a self claim.

The vendor also publishes a named framework for validated and responsible AI in mental health, which is self governance rather than regulation and is more than most peers offer.

One classification question deserves asking rather than assuming, and it concerns the matching technology itself. A system that directs a person toward therapy, medication management or coaching is making a recommendation about treatment modality. Where such software informs a clinical choice, the decision support analysis applies and turns on whether the professional can review the basis independently.

Ask how the company has assessed the matching algorithm's regulatory position, and to see it written down.

The company published VERA-MH (Validated, Ethical, Responsible AI for Mental Health), a named responsible AI framework, which is rare in this field and the emptiest axis across the index. Held back from A because independent audit results against the framework were not retrieved.

Two mechanisms here are genuinely uncommon and both address the affected person rather than the buyer, which is what this axis exists to reward. Dual consent is the first: both members and providers must consent to artificial intelligence assisted care. That is the right design for this setting, because a therapist has a professional stake in whether a session is processed by software and a member has a personal one, and most vendors in this index obtain neither.

Members also have stated transparency into how their data is used and can opt in or out of sharing, which is a live control rather than a disclosure. The second is an internal governance board overseeing the tools, which is weaker than an external body but is a named accountable function rather than a policy. Held at C because nothing measures the models and nothing stands behind them.

The matching technology is described as clinically validated without the validation being reachable, no accuracy figure or evaluation methodology was located, and no warranty, indemnity or remediation commitment exists. One reading discipline belongs on this record.

The vendor publishes commercial outcome figures including return on investment multiples and percentage savings on mental healthcare spend, and those are financial claims made to employers rather than evidence about model performance. Keep the two apart. Ask for the publications behind the matching model, and whether the deployed system is the one that was studied.

The vendor operates its own record system, described as an exclusive global electronic health record supporting documentation and measurement based care for its provider network, alongside calendar integrations maintaining real time availability across all fifty states.

Owning the record system solves internal integration completely and creates an external question the vendor does not address. A member's therapy notes, medication management and outcome measures sit in a system their primary care physician cannot see, and their medical record sits somewhere this platform does not reach.

That separation should not be treated automatically as a failing, and this is the honest reading. Behavioural health records carry consequences other clinical records do not, many people deliberately keep mental health treatment out of their general medical chart, and a benefit accessed through an employer is one people use partly because it sits apart. Separation is protective as well as fragmenting.

But the choice should be the member's rather than an artefact of architecture. The relevant questions are whether a member can direct that a summary be shared with their own physician, whether medication management is visible to whoever else prescribes for them, and what happens at the interface where it matters most, which is prescribing interactions.

Ask what interoperability exists outward, what a member can request, and how prescribing information reaches a member's other clinicians.

No hosting model, region, tenancy or residency commitment was located. Delivery is a cloud platform serving members, providers and employer administrators, with the vendor's own record system beneath it.

Residency is a live question here rather than a formality, because of reach. The company describes serving members across a very large number of countries and claims European data protection compliance alongside the United States privacy rule. Those two regimes impose different obligations, and the European one treats mental health information as a special category with conditions on processing and on transfer outside the region.

So the questions are concrete. Where is a European member's clinical record held, and if it leaves the region, under what transfer mechanism. Whether the vendor participates in the current transatlantic framework or relies on contractual clauses. And whether residency can be committed by contract for a multinational employer, which is the buyer most likely to need it.

The employer analytics layer adds a second dimension. Aggregated reporting crossing borders is still derived from clinical data, and a multinational employer receiving one consolidated view is receiving something assembled from records held under several regimes.

Ask for the hosting regions, the transfer mechanism, whether regional residency is available, and the subprocessor list including any model service processing clinical content.

No public pricing. Contact the vendor. Enterprise benefit contracts with employers and health plans; member cost varies by plan. No published rate card.

Clearly bounded: behavioral and mental health across therapy, coaching, medication management, and self guided care, delivered to employer and health plan populations. Explicit scope.