Surescripts

A national transaction network with models applied at several points inside it, and the company describes the relationship between the two accurately.

The network is the business. Thirty and a half billion transactions passed through it in 2025, carrying prescriptions, medication histories, eligibility checks, formulary data, benefit responses and prior authorisation requests between electronic health record vendors, pharmacies, benefit managers and health plans. That is routing, standards work and connectivity built over two decades, and it would function with no model in it at all.

The models are applied to make the traffic better rather than to make the traffic. Sig IQ translates free text directions into a standardised structure. A semantic network drives the prior authorisation workflow engine. Record Locator and Exchange and the Specialty Medications Gateway use models to decompose clinical documents and identify clinical attributes. Each is real and each improves a transaction the network was already carrying.

The company's own framing is the honest one and worth quoting in substance: its network holds a data set unique in size, scope, clinical relevance and quality, and artificial intelligence helps it process that data better. That is a description of models as an enhancement layer on an asset, not as the asset.

Graded C, one band below DrFirst on the neighbouring record. Both run sig translation models, and DrFirst's current commercial argument is built on the intelligence where this company's is built on the network the intelligence improves.

Human review is built into the model pipeline itself, and the commitment to it is published at board level language with a named accountable executive.

The structural element is the strongest available. Sig IQ is described as using the industry standard and a pharmacist review process to translate free text directions into a standardised format. So a pharmacist sits inside the translation pipeline rather than downstream of it, at a product operating on billions of transactions where the economics would obviously favour full automation. That is the same architecture iRhythm uses for rhythm strips and Octagos for device transmissions, applied at far greater volume, and retaining it is a deliberate and expensive choice.

The policy element matches the design. The published artificial intelligence commitment states under accountability that the company recognises its responsibilities for the technology it deploys and its impact, and will prioritise appropriate human oversight. The ethical use principle names autonomy explicitly among the considerations. A chief data and analytics officer, a physician, publishes under her own name on keeping the human in the loop in healthcare artificial intelligence.

The function itself is also correctly bounded. Sig IQ standardises an instruction rather than deciding a clinical question, so its output feeds the record system's own safety checking rather than substituting for clinical judgement.

What would complete this is disclosure of how often the pharmacist review overturns the model and whether those corrections feed back into training. Neither is published, and the design and the stated commitments are strong enough to carry the grade without it.

Graded A.

The company enumerates where artificial intelligence sits across its product line, which is exactly what its own transparency principle promises, and stops above the technical detail.

The enumeration is specific and product by product. A semantic network underpins the workflow engine in the electronic prior authorisation portal. Record Locator and Exchange and the Specialty Medications Gateway use models to break down clinical document architectures and identify unique clinical attributes in patient records. Sig IQ applies machine learning to translate free text directions, anchored to a named industry standard and paired with a pharmacist review process. Most vendors describe themselves as artificial intelligence powered without saying which product does what; this one lists them.

The development disclosure goes a step further. The company states it used artificial intelligence to parse text sigs and that this work informed the machine learning techniques built into Sig IQ, which describes how the capability was bootstrapped rather than only what it does.

Quantified output is published with a comparative baseline, 4.1 billion structured sigs in 2024 against 1.9 billion in 2023, and the deployment history is dated: medication history in 2022, prescribing transactions in late 2023.

What is missing is everything below the product level. No architecture, no training corpus description, no accuracy figure, no error analysis, no versioning and no update cadence. On a capability operating at billions of transactions annually, a silent model change alters what enters charts nationally and nothing describes how participants would learn of it.

Graded B.

Where the models sit is disclosed product by product, the standard they target is named, and the components they are built from are not.

The disclosure of placement is genuinely useful and is the company's own transparency principle in action. Models are identified in the prior authorisation workflow engine as a semantic network, in Record Locator and Exchange and the Specialty Medications Gateway for clinical document decomposition, and in Sig IQ for sig translation. A participant can therefore establish which transactions passing through the network have been touched by a model and which have not.

The standards dependency is named and it matters more here than a vendor name would. Sig IQ targets the NCPDP structured and codified sig format, so the output specification is owned by an industry body rather than by the company, which constrains what the model is permitted to produce and gives participants an external reference for correctness.

The development lineage is partly disclosed, with the company stating that earlier artificial intelligence work parsing text sigs informed the machine learning built into Sig IQ, which implies in house development building on its own prior work.

What is absent is components. No framework, no third party or pretrained model, no external natural language processing service and no infrastructure provider is named or ruled out for any of the four applications, and no bill of materials exists. For a network processing national prescription data, whether any of that text reaches a party other than the company is a fair question and is unaddressed.

Graded C.

An independent peer reviewed literature about the products, cited by the company on the product pages themselves, alongside scale figures with year over year comparison.

The independent element is what earns the grade. The company cites work it did not author on the pages selling the products those studies examine: an assessment of real time prescription benefit effects on patient out of pocket costs in JAMA Internal Medicine, a comparison of electronic pharmacy prescription records against manually collected medication histories in an emergency department in Annals of Emergency Medicine, observed changes to medication discontinuation workflows following prescription cancellation implementation in a pharmacy practice journal, and an association between electronic prescribing with decision support and improved medication adherence. Citing outside research beside a sales claim invites a reader to check it, which is the opposite of the usual pattern.

The operational figures are specific and comparative rather than absolute. Sig IQ delivered 4.1 billion structured sigs in 2024 against 1.9 billion in 2023, and augmented more than two million renewal transactions in its first six months on that transaction type. A year over year figure showing growth of a particular capability is more informative than a cumulative total, and the annual impact report publishes this on a recurring cadence with page level citation.

Named prior authorisation automation work with a large integrated system, a major academic medical centre and a national benefit manager adds institutional evidence.

What is absent is accuracy for the models themselves. Volume delivered is not the same as correctly translated, and no sensitivity, error rate or misclassification analysis for Sig IQ was located.

Graded A on the strength and independence of the surrounding literature.

One development disclosure is unusually candid, one product line raises the secondary use question directly, and the two are not reconciled anywhere published.

The candid disclosure is this: the company states it used artificial intelligence to parse text sigs, and that work informed the machine learning techniques built into Sig IQ. That is a description of how the model was developed, and the material it was developed from is necessarily real prescription directions written for real patients and carried across the network. Very few vendors describe their development pipeline at all, and stating it invites the question it does not then answer, which is on what basis network data became training material.

The secondary use question is not hypothetical here because the company sells it as a product. Medication History for Populations is marketed to healthcare analytics vendors and life sciences companies to improve adherence, close care gaps and reach at risk populations, and separate material describes understanding a new member's treated disease burden before the first claim arrives. That is prescription data serving purposes beyond the treatment encounter that generated it. The reconciliation product carries an explicit treatment purposes limitation; the population products carry no equivalent published statement of permitted use, de identification standard or consent basis.

The artificial intelligence commitment includes a privacy and security principle undertaking to protect the privacy of individuals' data processed by these technologies, which is a stated intention rather than a described control.

Graded C: real disclosure of development method and product scope, no published governance over either.

A stated use limitation on the most sensitive product, a dedicated privacy function, and no published contractual terms.

The use limitation is the substantive element and it is unusually specific. The company states that medication history data is sensitive personal information forming part of a patient's record, and that it is provided solely for treatment purposes in compliance with the health privacy statute, describing the clinicians who view it and the reconciliation purpose they view it for. A vendor naming the permitted purpose and confining a product to it, in the product documentation rather than in a legal annexe, is doing more than asserting compliance.

A dedicated privacy office exists with its own published presence, and a certifications and accreditations function is maintained separately, so the organisational apparatus for this is visible even where its contents are not enumerated here.

The data position is enormous. A network processing 30.5 billion transactions holds prescription and medication data at effectively national scale, operates a master patient index to identify patients across sources, and performs deduplication across records, all of which require identity resolution on identifiable data.

What is absent is the contract. No business associate agreement terms are published, no retention position is stated for medication history, and the treatment purposes limitation stated for the reconciliation product is not paralleled by any equivalent statement for the population and analytics products sold to life sciences and analytics customers, where the permitted use is necessarily different and is not described.

Graded B.

The apparatus exists and its contents were not established, which is the honest position on the evidence examined.

What is visible is organisational rather than documentary. A dedicated certifications and accreditations page is maintained and presented as industry recognition for a secure, trusted, high value network, which indicates formal external assessment has been sought and obtained. A separate privacy office exists with its own published presence. The company also publishes commentary on cyber resilience in healthcare. Together those show a company that treats security assurance as a function with a public face, which is more apparatus than most records in this index carry.

What this assessment did not establish is which certifications are actually held. The specific credentials, their scope across a large product catalogue, their audit periods and the process by which a participant obtains supporting documentation were not enumerated in the material examined, and no service organisation control report, information security certification, penetration testing statement, vulnerability disclosure policy or subprocessor list was located.

The stakes argue for more than a page. This network is a single point through which a very large share of national prescription traffic passes, holding identity resolution across sources and prescription histories at population scale, which makes it an unusually valuable target and its assurance posture a matter of interest beyond its direct customers.

Graded C: real apparatus, contents unverified here, and a buyer should request the certification list and scope directly rather than infer it.

No device clearance is required and the company sits inside the regulatory machinery of prescribing rather than beside it.

On devices the position is straightforward. Transaction routing, medication history, eligibility, formulary and benefit checking carry no diagnostic claim, and sig standardisation converts an instruction into a structured form rather than issuing a clinical determination. Nothing here approaches a device question.

The regime that governs the company is prescribing regulation, and its involvement is structural rather than compliance driven. Sig IQ is anchored to the NCPDP industry standard for structured and codified sigs, so the company is implementing a standard rather than inventing a format, which is the correct behaviour for a network whose whole purpose is interoperability and which materially reduces the risk of a proprietary structure diverging from the industry. Controlled substance prescribing operates under federal identity proofing and audit requirements. Electronic prior authorisation sits inside active federal rulemaking on turnaround and electronic processing.

A dedicated certifications and accreditations function is maintained and presented as industry recognition for a secure and trusted network, indicating formal external assessment even though the specific credentials were not enumerated in what was examined here.

What is not addressed is where sig translation sits relative to clinical decision support regulation. Rendering a free text instruction into a structured value that a record system then acts on is closer to that boundary than routing is, and the company publishes no analysis of it.

Graded B.

A published governance framework that names bias explicitly, which is rare in this index, with no performance or subgroup data behind it.

The framework is real and it is worth crediting precisely. Published in August 2024 under four named principles, it commits to ethical use with benefits outweighing risks and accounting for stakeholder wellbeing, potential biases, autonomy, privacy and safety; to privacy and security; to being appropriately transparent about where artificial intelligence is incorporated; and to accountability with prioritised human oversight. Naming potential biases as a standing consideration, in a public commitment attached to an author and a date, is more than almost any vendor in this index publishes. The company also employs a physician chief data and analytics officer who writes publicly on the subject.

What the framework is not is evidence. A commitment to account for bias is a statement of intent, and this axis assesses disclosure of analysis. No model card, no training population description, no accuracy breakdown for Sig IQ by drug class, sig complexity, source system or prescriber type, and no subgroup analysis of any kind were located.

The mechanism worth naming is the same one identified on the DrFirst record and it applies at greater scale here. A sig parser will resolve common, well formatted instructions from high volume sources better than complex tapering regimens, uncommon formulations or records from smaller and less standardised pharmacy systems, and the patients whose instructions are hardest to parse are disproportionately elderly, on polypharmacy or on specialty therapy.

Graded C: the best published framework in this lane, and no data.

No contractual terms are published, and one sentence in the artificial intelligence commitment is the closest thing to a stated liability position anywhere in this index.

That sentence, under the accountability principle, is that the company recognises its responsibilities for the artificial intelligence technology it deploys and its impact, and will prioritise appropriate human oversight. It is a values statement rather than an indemnity, and it is a public acceptance of responsibility for model outputs, which is more than the silence on this axis in most records here. The commitment closes by undertaking to ensure outcomes are fair, appropriate, valid, effective and safe.

The exposure it speaks to is real and enormous by volume. Sig IQ translated 4.1 billion sigs in a single year, and a translation error places a wrong dose, route or frequency into a medication record that a record system then runs its interaction and allergy checking against. At that scale a small error rate is a large absolute number of affected prescriptions, and the error is silent because the receiving clinician sees a clean structured field rather than the ambiguous free text it came from.

The pharmacist review process in the pipeline is a genuine mitigation and is the strongest practical answer available, since a qualified professional is inside the translation rather than downstream of it.

What is absent is everything contractual: no accuracy commitment, no indemnity, no limitation, no error reporting route, and no description of how responsibility divides between the network, the record vendor that enabled the enrichment and the clinician who relied on the result.

Graded C.

This company is the interoperability layer for United States prescribing, so the axis is close to tautological, and the specifics still bear examination.

The scale is the evidence: 30.5 billion transactions exchanged in 2025 across a network connecting electronic health record vendors, pharmacies, benefit managers, health plans, health systems and specialty and post acute providers. Interoperability here is not a feature the company built, it is the entity itself.

The technical substance is standards based rather than proprietary. Sig IQ targets the NCPDP structured and codified sig format, an industry standard, so enriched data lands in a form every participant can consume rather than in a format that binds them to this vendor. A master patient index performs identity resolution across sources and deduplication returns a single accurate record per medication, which is the hard part of assembling a medication history from many pharmacies and benefit managers.

A dedicated interconnect product addresses network to network exchange, and a certification programme exists for partners consuming the population medication history product, with third party platforms publicly announcing completion of it. A vendor that certifies others to consume its data is operating an ecosystem rather than a pipe.

The practical limit worth recording is that enrichment is conditional. Structured sigs are delivered to Sig IQ enabled customers, so what a given clinician sees depends on whether their record vendor has enabled it.

Graded A.

Nothing published on hosting, region or residency, for infrastructure carrying a substantial share of United States prescription traffic.

The deployment model itself is not in question. This is a national network, not software a customer installs, so participants connect to it and the company processes and holds the data in transit. Medication history is assembled from pharmacy fill data and benefit manager claims, resolved against a master patient index, deduplicated and returned within about 24 hours of a fill. All of that happens on the company's own infrastructure.

What is absent is every specific. No hosting arrangement, no region, no residency position, no subprocessor list, no retention period for medication history or transaction records, and no export or exit terms were located.

Availability is the omission that matters most on this record and it is unaddressed. When a network carrying 30.5 billion transactions a year is unavailable, prescriptions do not route, medication histories do not return at admission, and eligibility and benefit checks fail at the point of prescribing, simultaneously and nationally. That is critical infrastructure by any reasonable definition, and no uptime commitment, status history, continuity position or disaster recovery description is published. The company does publish commentary on cyber resilience, which addresses the topic in the abstract rather than committing to anything.

A dedicated certifications and accreditations function exists and may well cover availability and resilience assurance; its contents were not established here.

Graded D on the absence rather than on any evidence of a problem.

Nothing is published. No transaction fee, no unit of charge, no product pricing, no contract term and no minimum was located in vendor or third party material. The only route is a contact sales form.

The commercial model is unusual enough that the absence matters in a particular way. This is a network, so the paying parties are electronic health record vendors, pharmacies, pharmacy benefit managers, health plans and analytics vendors rather than the clinicians who use it, and fees attach to transactions of various types. A health system evaluating a medication history capability is often buying it through its record vendor rather than directly, so the price it eventually pays is embedded in someone else's contract and shaped by terms it never sees.

That structure makes published rates more valuable than usual rather than less, because the buyer furthest from the negotiation is the one carrying the cost. Nothing indicates per transaction rates, whether Sig IQ enrichment carries a premium over base medication history, or how the population and analytics products are priced against the clinical ones.

One structural point a buyer should hold. The company describes Sig IQ delivery as available to Sig IQ enabled customers, which implies it is an option rather than a default on the network. Whether a given health system is receiving enhanced sigs therefore depends on a commercial decision made by its record vendor, and that is worth establishing directly.

Graded D.

The widest coverage of any record in this index, and it is structural rather than commercial: this is the layer nearly every United States prescription passes through.

Participant coverage spans eleven named constituencies: electronic health record vendors, health plans, health systems, healthcare analytics vendors, life sciences companies, long term and post acute care, patient access vendors, pharmacy benefit managers, pharmacies, pharmacy technology vendors and specialty pharmacies. Serving both sides of every medication transaction, prescriber and dispenser, payer and provider, is what makes the network work and it means no segment of the medication pathway sits outside it.

Transaction coverage runs across prescribing, controlled substance prescribing, medication history in three distinct product forms for reconciliation, ambulatory and population use, eligibility, formulary, real time benefit, prior authorisation, benefit coordination, clinical messaging and prescription transfer between pharmacies. Long term and post acute care is addressed with its own material, which is a setting most vendors in this index ignore and where medication complexity is highest.

Clinical coverage is universal by construction. Every prescriber prescribes and every patient with a medication has a history, so there is no specialty in or out of scope.

The volume figure makes the coverage claim concrete: 30.5 billion transactions in a single year.

Graded A.