Surescripts

A national transaction network with models applied at several points inside it, and the company describes the relationship between the two accurately. The network is the business: 30.5 billion transactions passed through it in 2025, carrying prescriptions, medication histories, eligibility checks, formulary data, benefit responses and prior authorization requests between electronic health record vendors, pharmacies, benefit managers and health plans.

That is routing, standards work and connectivity built over two decades, and it would function with no model in it at all. The models improve traffic the network already carries: Sig IQ translates free text directions into a standardized structure, a semantic network drives the prior authorization workflow engine, and Record Locator and Exchange and the Specialty Medications Gateway use models to decompose clinical documents.

The company's own framing is that its network holds a data set unique in size, scope, clinical relevance and quality, and artificial intelligence helps it process that data better: models as an enhancement layer on an asset, not as the asset.

The oversight structure is described. Surescripts says Sig IQ uses the NCPDP standard along with clinical review by pharmacists to ensure response accuracy and that codification meets network standards, and describes the output as a quality controlled, clinically validated structured sig.

The function is bounded: Sig IQ standardizes an instruction rather than deciding a clinical question, and the structured sig lands in the prescriber's or reconciling clinician's workflow, where it feeds the record system's own safety checking. The company's AI commitment states under accountability that it will prioritize appropriate human oversight, and its physician chief data and analytics officer publishes on keeping humans in the loop.

What is not published is how the pharmacist review works at a volume of billions of sigs a year: whether it validates the model and its rules or reviews individual translations, which translations are routed to a pharmacist, and what happens when a translated sig is found wrong.

The company enumerates where artificial intelligence sits across its product line, which is what its own transparency principle promises, and stops above the technical detail. A semantic network underpins the workflow engine in the electronic prior authorization portal. Record Locator and Exchange and the Specialty Medications Gateway use models to break down clinical document architectures and identify unique clinical attributes in patient records.

Sig IQ applies machine learning to translate free text directions, anchored to the NCPDP standard and paired with clinical review by pharmacists. The company also states it used artificial intelligence to parse text sigs and that this work informed the machine learning built into Sig IQ, which describes how the capability was bootstrapped. Output is quantified with a baseline, 4.1 billion structured sigs in 2024 against 1.9 billion in 2023, and the deployment history is dated.

Missing is everything below the product level: no architecture, training corpus description, accuracy figure, error analysis, versioning or update cadence, and nothing describes how participants would learn that a model changed what enters charts nationally.

Where the models sit is disclosed product by product, the standard they target is named, and the components they are built from are not.

The disclosure of placement is useful, and it is the company's own transparency principle in action. Models are identified in the prior authorization workflow engine as a semantic network, in Record Locator and Exchange and the Specialty Medications Gateway for clinical document decomposition, and in Sig IQ for sig translation. A participant can therefore establish which transactions passing through the network have been touched by a model and which have not.

The standards dependency is named. Sig IQ targets the NCPDP structured and codified sig format, so the output specification is owned by an industry body rather than by the company, which constrains what the model is permitted to produce and gives participants an external reference for correctness.

The development lineage is partly disclosed, with the company stating that earlier artificial intelligence work parsing text sigs informed the machine learning built into Sig IQ, which implies in house development building on its own prior work.

What is absent is components. No framework, no third party or pretrained model, no external natural language processing service and no infrastructure provider is named or ruled out for any of the four applications, and no bill of materials is published. For a network processing national prescription data, nothing published says whether any of that text reaches a party other than the company.

An independent peer reviewed literature about the products, cited by the company on the product pages themselves, alongside scale figures with year over year comparison.

The company cites work it did not author on the pages selling the products those studies examine: an assessment of real time prescription benefit effects on patient out of pocket costs in JAMA Internal Medicine, a comparison of electronic pharmacy prescription records against manually collected medication histories in an emergency department in Annals of Emergency Medicine, observed changes to medication discontinuation workflows following prescription cancellation implementation in a pharmacy practice journal, and an association between electronic prescribing with decision support and improved medication adherence. Citing outside research beside a sales claim invites a reader to check it.

The operational figures are specific and comparative rather than absolute. Sig IQ delivered 4.1 billion structured sigs in 2024 against 1.9 billion in 2023, and augmented more than two million renewal transactions in its first six months on that transaction type. A year over year figure showing growth of a particular capability is more informative than a cumulative total, and the annual impact report publishes this on a recurring cadence with page level citation.

Named prior authorization automation work with a large integrated system, a major academic medical center and a national benefit manager adds institutional evidence.

What is absent is accuracy for the models themselves. Volume delivered is not the same as correctly translated, and no sensitivity, error rate or misclassification analysis for Sig IQ is published.

One development disclosure is candid, one product line raises the secondary use question directly, and the two are not reconciled anywhere published. The company states it used artificial intelligence to parse text sigs and that this work informed the machine learning built into Sig IQ; the material it was developed from is necessarily real prescription directions carried across the network, and nothing states on what basis network data became training material.

The secondary use question is concrete because the company sells it as a product: Medication History for Populations is marketed to analytics vendors and life sciences companies for adherence, care gaps and at risk populations. The reconciliation product carries an explicit treatment purposes limitation; the population products carry no published statement of permitted use, de identification standard or consent basis.

Two controls are published: a patient opt out from medication history, Record Locator and Exchange and Interconnect through the privacy office, and an AI commitment to protect the privacy of individuals' data processed by these technologies. There are no retention, training or de identification terms behind those general assurances and the opt out. No safety engineering is published beyond the pharmacist clinical review described for Sig IQ.

Business associate status is stated on the privacy office page: as a business associate, Surescripts transmits personal health information in accordance with federal and state law and the privacy and security requirements in its contracts.

The page is backed by a published health information exchange privacy policy, a privacy office with its own contact, a patient opt out process for medication history, Record Locator and Exchange and Interconnect, and a commitment to notify patients of a breach. Medication history documentation adds a use limitation: the data is provided solely for treatment purposes in compliance with HIPAA.

The gap is the contract: no business associate agreement is published, no retention position is stated for medication history, and the treatment purposes limitation stated for the reconciliation product is not paralleled by any published statement of permitted use for the population and analytics products sold to life sciences and analytics customers.

Surescripts names its certifications on a dedicated certifications and accreditations page. HITRUST r2 certified status covers key platforms and their supporting infrastructure; the April 2025 announcement lists them as including clinical direct messaging, directories, e-prescribing and electronic prescribing of controlled substances. An annual SOC 2 Type II report from an independent AICPA audit firm covers the security, availability and confidentiality principles.

Surescripts also holds EHNAC accreditation and DirectTrust accreditation for its health information service provider, registration authority, certificate authority and privacy and security operations, and publishes its Certification Practice Statement as a certificate authority under WebTrust. Each is named in the company's own material, and none comes with an artifact that can be opened without asking.

Three scope questions for a buyer: which platforms sit outside the r2 scope, since the list is of key platforms and says 'not limited to'; the SOC 2 report period; and whether the population and analytics products are covered. No vulnerability disclosure policy or subprocessor list is published.

Surescripts makes no device claim for any product, and it positions itself inside the regulatory and standards machinery of prescribing. Sig IQ is anchored to the NCPDP standard for structured and codified sigs, so the company is implementing an industry standard rather than inventing a format.

Its electronic prescribing of controlled substances platform is within its HITRUST r2 scope, it is accredited by EHNAC and DirectTrust, and it operates as a certificate authority under WebTrust with a public Certification Practice Statement, which is engagement with the regimes that govern prescription transport and identity. Electronic prior authorization sits inside active federal rulemaking on turnaround and electronic processing.

What is not addressed is where sig translation sits relative to clinical decision support regulation: rendering a free text instruction into a structured value that a record system then acts on is closer to that boundary than routing is, and the company publishes no analysis of it.

A published governance commitment that names bias explicitly, with no performance or subgroup data behind it. Published in August 2024 under four named principles, it commits to ethical use with benefits outweighing risks and accounting for stakeholder wellbeing, potential biases, autonomy, privacy and safety; to privacy and security; to being appropriately transparent about where artificial intelligence is incorporated; and to accountability with prioritized human oversight.

The company's physician chief data and analytics officer writes publicly on the subject. Those are principles attached to a date and an author rather than a governance framework with named process: no responsible body, evaluation method or monitored metrics are published. No model card, training population description, accuracy breakdown for Sig IQ by drug class, sig complexity, source system or prescriber type, or subgroup analysis is published.

The distribution question is concrete for a sig parser: well formatted instructions from high volume sources are easier to resolve than tapering regimens, uncommon formulations or records from smaller pharmacy systems, and patients with complex instructions are often elderly, on polypharmacy or on specialty therapy.

No contractual terms are published. The closest thing to a liability position is one sentence in the August 2024 AI commitment: under accountability, the company recognizes its responsibilities for the artificial intelligence it deploys and its impact, and will prioritize appropriate human oversight, and it closes by undertaking to ensure outcomes are fair, appropriate, valid, effective and safe. That is a values statement rather than an indemnity.

The exposure it speaks to is large by volume. Sig IQ delivered 4.1 billion structured sigs in medication history in 2024, and a translation error places a wrong dose, route or frequency into a medication record that a record system then runs its interaction and allergy checking against, silently, because the receiving clinician sees a clean structured field.

The mechanism that lets someone catch an error is the clinical review by pharmacists the company describes within Sig IQ's quality control, together with the clinician's own review at reconciliation. What is absent is everything contractual: no accuracy commitment, indemnity, error reporting route, or description of how responsibility divides between the network, the record vendor that enabled the enrichment and the clinician who relied on the result.

This company is the interoperability layer for United States prescribing.

The scale is the evidence: 30.5 billion transactions exchanged in 2025 across a network connecting electronic health record vendors, pharmacies, benefit managers, health plans, health systems and specialty and post acute providers. Interoperability here is not a feature the company built, it is the entity itself.

The technical substance is standards based rather than proprietary. Sig IQ targets the NCPDP structured and codified sig format, an industry standard, so enriched data lands in a form every participant can consume rather than in a format that binds them to this vendor. A master patient index performs identity resolution across sources and deduplication returns a single accurate record per medication, which is the hard part of assembling a medication history from many pharmacies and benefit managers.

A dedicated interconnect product addresses network to network exchange, and a certification program exists for partners consuming the population medication history product, with third party platforms publicly announcing completion of it. A vendor that certifies others to consume its data is operating an ecosystem rather than a pipe.

Enrichment is conditional. Structured sigs are delivered to Sig IQ enabled customers, so what a given clinician sees depends on whether their record vendor has enabled it.

Surescripts operates the network participants connect to; nothing is installed at the customer, and the company processes and holds the data in transit on its own platforms, which its SOC 2 Type II report covers for availability as well as security and confidentiality. Medication history is assembled from pharmacy fill data and benefit manager claims, resolved against a master patient index and deduplicated. It is a single hosted option, with the location implied rather than committed.

No hosting arrangement, region, residency position, subprocessor list, retention period for medication history or transaction records, or export or exit terms are published. Availability is the omission that matters most: when a network carrying 30.5 billion transactions a year is unavailable, prescriptions do not route and medication histories do not return at admission, nationally and at once, and no uptime commitment, status history, continuity position or disaster recovery description is published beyond the availability principle in the SOC 2 scope.

No fee schedule, unit of charge, product pricing, contract term or minimum is published, and the route to buy is a contact form. The commercial facts Surescripts does publish are structural: electronic health record vendors and health systems contract directly with it, and structured sigs are delivered to Sig IQ enabled customers, so enrichment is an option rather than a default.

Nothing published states what a participant pays, whether per transaction, per bed or per license, whether Sig IQ carries a charge over base medication history, or how the population and analytics products are priced against the clinical ones. The cost cannot be sized before contact.

The structure makes that absence matter in a particular way: a health system buying medication history is often buying it through its record vendor, so the price it pays is embedded in someone else's contract, and whether it receives enhanced sigs at all depends on a commercial decision that vendor made.

Coverage is structural rather than commercial: this is the layer a large share of United States prescriptions pass through. Participant coverage spans eleven named constituencies: electronic health record vendors, health plans, health systems, healthcare analytics vendors, life sciences companies, long term and post acute care, patient access vendors, pharmacy benefit managers, pharmacies, pharmacy technology vendors and specialty pharmacies.

Serving both sides of every medication transaction, prescriber and dispenser, payer and provider, means no segment of the medication pathway sits outside it. Transaction coverage runs across prescribing, controlled substance prescribing, medication history in three product forms for reconciliation, ambulatory and population use, eligibility, formulary, real time benefit, prior authorization, benefit coordination, clinical messaging and prescription transfer between pharmacies.

Long term and post acute care, where medication complexity is highest, is addressed with its own material. Clinical coverage is universal by construction, and the volume figure makes it concrete: 30.5 billion transactions in a single year.