Synthpop

The agents are the product. Synthpop describes itself as an API first multi agent system combining document intelligence, payer aware reasoning, conversational voice agents and an orchestration layer, and there is no underlying workflow application, clearinghouse or data network that would retain value without the models. The company positions explicitly against point solutions, arguing that operational bottlenecks require a coordinated system rather than a tool per function.

The most autonomous claim in this category paired with the least disclosed oversight. Synthpop states that its system automates up to 80 percent of the healthcare business processes it handles, across referrals, prior authorisation, eligibility verification and claims follow up. No escalation path, confidence threshold, exception queue behaviour, human review gate or abstention rule is published anywhere located.

That combination, a high headline automation rate with no described oversight architecture, is what this index grades C. The consequence is concrete rather than theoretical: an incorrectly abandoned prior authorisation or a mishandled eligibility check delays care for a patient who has no visibility into the process, and nothing published states who catches that.

More mechanism disclosed than most of this category. Synthpop states that it fine tunes large language models on medical data, has named GPT 4 among the models it augments, and describes a proprietary de identification method that allows fine tuning without exposing protected health information.

It names the four architectural components of the platform, and its engineering provenance is verifiable: the team behind FastStream and FastAgency, contributors to Microsoft's AutoGen framework, joined the company. Held at B rather than A because there is no model card, no published evaluation methodology, no accuracy figure tied to a stated test set, and no statement of which components are learned versus rule driven.

Patient information handling is a stated part of the architecture rather than an afterthought, which is rare enough in this segment to carry the grade. The chief technology officer describes a proprietary method for de identifying medical records specifically so that language models can be fine tuned without risking exposure, and that directly addresses the question most vendors here leave open: whether customer clinical data reaches a model and in what form.

It also answers it in a structurally useful way, since de identification before fine tuning means the training path and the identifiable data path are separated by design rather than by policy, and a design can be inspected. Held below the top grade because the detail a security review would ask for is absent.

Nothing states which de identification standard is met, whether re identification risk has been assessed and by whom, whether customer data trains models used for other customers, or what retention applies to the source records once a fine tune is complete. That last one is worth pressing, because the source records have no further purpose once the de identified derivative exists, so retaining them is a choice.

The method itself is described as proprietary, which means the claim rests on the company's own account of a process nobody outside has evaluated, and for a control this load bearing an external assessment would be worth more than the description. Ask for the standard, the assessment, the cross customer boundary and retention on source records.

All figures are vendor generated and no customer is named. Synthpop reports processing more than 2 million patients and integrating eight major EHR systems, and publishes an unattributed customer statement that referrals are now processed in under a minute. No named reference site, no case study with an identified organisation, no baseline, no denominator for the 80 percent automation claim, and no third party or peer reviewed evaluation was located.

Graded C on this index's standing precedent that deployment scale does not substitute for evidence of benefit. The Google Cloud Agent Gallery placement is a distribution and partnership fact rather than an assessment, and is not credited here.

Unusually, PHI handling is a stated part of the architecture rather than an afterthought. The company's chief technology officer describes a proprietary method for de identifying medical records specifically so that large language models can be fine tuned without risking exposure, which directly addresses the question most vendors in this space leave open: whether customer clinical data reaches a model and in what form.

That is a substantive answer and it earns B. What is still missing is the detail a security review would ask for: what de identification standard is met, whether re identification risk has been assessed, whether customer data trains models used for other customers, and what retention applies to the source records.

Described in company materials as fully HIPAA compliant. No business associate agreement is published and no terms are described. Middle rung of this index's HIPAA ladder, where compliance is claimed and the instrument is unpublished.

Company materials state that Synthpop is SOC 2 audited, which is better wording than the SOC 2 compliant and SOC 2 certified formulations common in this market because audited at least implies a report exists. The type is not stated, and Type I versus Type II is the question this index asks of every SOC 2 claim.

The website separately uses the phrase enterprise grade security built in, which is a marketing adjective rather than an attestation and belongs on this index's watchlist alongside similar formulations. No trust centre, no report request path and no other named certification such as HITRUST or ISO 27001 was located.

No device pathway applies and none is claimed, since these are administrative rather than clinical determinations. The live regulatory surface is different and no position on it is published. CMS interoperability and prior authorisation requirements took effect in January 2026, mandating electronic prior authorisation submission and faster turnaround, which is the rule set that makes this product commercially timely.

A buyer should establish whether Synthpop's prior authorisation workflows are built to those requirements and how the company handles the payer side counterpart, since several states have moved to restrict AI driven coverage decisions. Note the asymmetry that keeps this on the provider side of that debate: Synthpop submits authorisations rather than adjudicating them.

No fairness, subgroup, error rate or performance variation disclosure of any kind was located, against a stated automation rate of up to 80 percent across workflows that gate patient access to care. Prior authorisation, eligibility verification and referral intake determine whether and how quickly a patient is seen, so a systematic failure concentrated in one population would show up as delayed access rather than as a visible error. No audit mechanism, exception reporting or quality monitoring approach is described.

More mechanism is disclosed here than in most of this category, and one form of evidence is unusual enough to name. The company states that it fine tunes language models on medical data, names a frontier model among those it augments, describes a de identification method that allows fine tuning without exposing patient information, and names the four architectural components of the platform, so a reader can tell which layer does what.

Beyond that, its engineering provenance is verifiable in a way a biography is not: the team behind several published open source frameworks, and contributors to a widely used agent framework, joined the company, and their work is public code anyone can read and judge. That is a stronger signal than a list of prior employers, because the artefacts are inspectable and the community that uses them has already formed a view. Held below the top grade because nothing is measured.

There is no model card, no published evaluation methodology, no accuracy figure tied to a stated test set, no statement of which components are learned versus rule driven, and no warranty, indemnity or remediation commitment. The last of those matters for a document platform, because knowing which stage is deterministic tells a buyer which failures are reproducible and which are not. Ask which components are learned, for accuracy on your own document mix, and what the system does at low confidence.

Reports integration with eight major EHR systems alongside billing and electronic prescribing platforms, and is architected API first, which suits an orchestration layer that must reach several systems at once. Multi channel intake is a genuine strength within the scope: the product is built for referrals arriving as fax packets as well as structured feeds, which is where most referral volume actually is. Held at B because the eight systems are counted but not named anywhere located, so a buyer cannot confirm their own platform is among them, and no integration depth is described per system.

Cloud delivered and API first. One concrete deployment channel is documented: the agent is available through the Agent Gallery inside Google Cloud's Gemini Enterprise, where organisations can request access within their existing Gemini Enterprise environment.

Beyond that nothing is disclosed on hosting, region, data residency, tenancy model or single tenant options, and the Gemini Enterprise route raises a question a buyer should ask directly, namely which processing occurs in the customer's own Google Cloud environment and which occurs in Synthpop's.

No price, tier or pricing unit is published, and all commercial paths route through a contact form. The unit question matters for an orchestration platform: pricing per workflow, per transaction, per integrated system or per enterprise produces very different economics for an organisation whose referral or authorisation volume is growing. Availability through the Gemini Enterprise Agent Gallery may introduce a separate commercial route with its own terms, which a buyer already on Google Cloud should establish.

Positioned across payer, provider and patient operations rather than for one setting, and the company states an intention to expand into further healthcare verticals. Early materials and trade coverage indicate real traction in specific verticals including sleep medicine, dental sleep medicine, cardiology and durable and home medical equipment, which is a narrower and more credible footprint than the horizontal positioning suggests. Held at B: the breadth is claimed at platform level while the evidenced deployments cluster in document heavy, authorisation heavy specialties, which is where referral packet intake pays off most.