TailorMed

AI assists a workflow platform rather than constituting it. The core product is a financial navigation system that centralizes roughly 6,000 assistance program resources, verifies benefits through a clearinghouse, calculates remaining deductible and cost exposure, and manages enrollment.

The AI layer is real but bounded: the company describes surfacing assistance programs using automation and AI, intelligently matching patients to opportunities, and an in context generative AI assistant built for navigators. A separate service arm explicitly combines AI, automation, and human expert teams. Buyers should size this as workflow software with AI matching, not an autonomous system.

A human navigator is the actor throughout and the design says so. The platform populates work queues, prioritizes patients by assistance opportunity, pre fills program forms from live EHR data, and tracks application status, with the navigator reviewing and submitting. That is the appropriate structure given the outputs are benefit enrollments with financial and eligibility consequences for the patient. The generative AI assistant is positioned as helping navigators search programs and surface eligible patients rather than acting for them.

No model, architecture or matching methodology disclosure was located. The AI is described functionally as matching, surfacing and assisting, with no account of how eligibility is computed or evaluated.

That matters more here than in most administrative products, because the failure mode is silent. A missed match means a patient does not receive assistance they qualified for, and nobody involved ever learns it happened: not the patient, who was never told the programme existed, and not the navigator, who saw no result to question. A false negative in this system is invisible by construction, which makes a published recall figure the single most useful number the company could disclose. None exists.

Nothing identifies any party in the vendor's own chain: no model, hosting arrangement or sub processor list was located, and no retention period, de identification posture or training position was published. An audited attestation exists and covers confidentiality and privacy criteria as a matter of the framework, and a report a buyer cannot read is not a published stewardship position.

The data combination is unusually sensitive because the function requires it: determining assistance eligibility means holding clinical treatment plans alongside patient financial circumstances and insurance status, and the platform pulls live records from the record system to populate programme forms. What makes this record distinctive is that the onward disclosure is the product rather than a side effect.

Forms are filed with third party foundations, manufacturers and assistance programmes, each with its own retention practices and none of them party to the health system's agreement with the vendor, so a patient applying for help has their diagnosis, treatment and financial position disclosed to organisations they may never have heard of. A manufacturer running a patient assistance programme also has a commercial interest in who is taking its drug.

A buyer should map that onward flow explicitly rather than assume the vendor agreement covers it. Ask which programmes receive what fields, what each retains, what the patient is told before submission, and for a sub processor list.

Evidence is customer case studies at named institutions rather than measured study. The company publishes case studies with a large not for profit health system, a regional health system, and a named oncology group covering standardization of financial navigation and program optimization, and describes serving health systems, oncology practices, infusion centers, and pharmacies.

What is absent from public materials is quantified outcome data, meaning dollars of assistance secured per patient, enrollment rates versus baseline, or effect on treatment abandonment, which is the outcome that actually matters in medication affordability.

No published retention period, no de identification posture and no statement on whether customer data trains or improves models was located. The SOC 2 Type II examination covers confidentiality and privacy criteria as a matter of the framework, but a report a buyer cannot read is not a published stewardship position.

The data combination here is unusually sensitive and the note names it plainly. The platform processes clinical treatment plans alongside patient financial circumstances and insurance status, because determining assistance eligibility requires both, and it pulls live records from the electronic health record to populate programme forms.

The stewardship question that matters most is where that data goes on submission. Forms are filed with third party foundations, manufacturers and assistance programmes, each with its own retention practices and none of them party to the health system's agreement with the vendor. A buyer should map that onward flow explicitly rather than assume it is covered, because a patient who applies for assistance has their diagnosis, treatment and financial position disclosed to organisations they may never have heard of.

No business associate agreement terms and no HIPAA specific posture statement were located. Business associate status is structurally required given deep integration with health systems and oncology practices.

What exists is adjacent rather than direct. The company's SOC 2 Type II announcement states the examination was intended to validate controls against standards including the health privacy rule, and that the results suggest a compliant security framework is in place. That is an assurance about the security programme, not a statement of the contractual instrument, and the hedged phrasing is the company's own.

The contracting question here is unusually layered and deserves a direct answer. The platform pulls live records from the health system, and then submits patient information onward to third party foundations, manufacturers and assistance programmes that are not covered entities and are not parties to the health system's agreement. Establish what governs the data once it leaves for a programme application, since that is the point where the covered entity's chain of obligations runs out.

TailorMed completed a SOC 2 Type II examination conducted by an independent third party assessor, and it names the type rather than leaving it ambiguous, which is the test a number of vendors in this index fail. The company also has a named chief security officer, which is uncommon at this size and is a real signal about where the function sits.

Two limits are written into this grade rather than glossed. The examination is described as mapped to the HITRUST assessment. Mapping a SOC 2 to HITRUST criteria is not holding a HITRUST certification, and the two should not be read as equivalent. And the announcement dates from April 2022. A SOC 2 Type II report covers a defined period and is renewed, so a four year old announcement establishes that an examination happened, not that a current report exists.

Held at B rather than A on those two points plus the absence of a trust centre, so a buyer cannot self serve the report or see its scope. Ask for the current report, its observation period, and which systems are in scope. The company's own phrasing that the results suggest a compliant framework is softer than a plain statement and is worth noting alongside.

No FDA pathway applies. The platform operates on financial assistance, benefits and enrolment workflow with no clinical decision surface.

Graded C because the compliance surface that does govern here is substantial and the company publishes no position on it. Copay assistance and manufacturer programme rules carry federal anti kickback and beneficiary inducement constraints that determine which patients may lawfully receive which forms of assistance, and those rules differ sharply between commercially insured and federally insured patients. A platform that automates matching and enrolment at scale is operating inside those constraints on every transaction. A buyer should ask how the eligibility logic encodes them and who is accountable when a match is wrong.

No governance framework or bias evaluation was located, and the equity question here is direct rather than abstract.

A system that prioritises patients by assistance opportunity is allocating a scarce navigator's time. If prioritisation favours higher dollar opportunities, it may systematically underserve patients whose barrier is smaller in absolute terms but just as decisive to whether they start or stay on treatment. A few hundred dollars is the difference between filling a prescription and abandoning it for many people, and it will never rank above a five figure infusion in a queue sorted by recoverable value.

Nothing published addresses how prioritisation is weighted or whether the outcome is measured across patient groups. This is the question to put first, because the answer determines whether the platform closes an access gap or reproduces it at speed.

Two passes located no model, architecture or matching methodology, no evaluation, no accuracy figure and no warranty, indemnity or remediation commitment, with the capability described functionally as matching, surfacing and assisting and no account of how eligibility is computed. That matters more here than in most administrative products because of the shape of the failure.

A missed match means a patient does not receive financial assistance they qualified for, and nobody involved ever learns it happened: not the patient, who was never told the programme existed, and not the navigator, who saw no result to question and has nothing to investigate. A false negative in this system is invisible by construction, which makes a published recall figure the single most useful number the company could disclose, and none exists. The distributional consequence follows.

Patients least able to navigate assistance programmes unaided are the ones a matching system is supposed to help most, so a recall gap concentrates on exactly the people the product exists for, and it will show up as an absence of assistance rather than as an error anyone can point to. Volume of assistance secured, which is the figure this category tends to report, says nothing about the share missed. Ask for recall against a manually reviewed sample, what proportion of eligible patients the system surfaces, and how a navigator can check for programmes it did not return.

Integration is substantive and is what distinguishes the platform from a program database. The company states it is deeply integrated with health system IT, uses live EHR data to instantly populate program forms and eliminate manual entry, verifies benefits through a clearinghouse, and updates the pharmacy module automatically based on the patient's treatment plan and treatment status. Pulling the treatment plan to time drug availability is a real clinical data dependency rather than a demographic feed. No named EHR integrations or standards were located.

No hosting provider, region, tenancy model or data residency commitment was located, and no subprocessor list was found.

The SOC 2 Type II examination implies infrastructure controls were assessed, but the report is not public and an examination is not a residency disclosure. A buyer learns nothing about where the platform runs or whether any isolation exists between customers.

The question has extra weight for this product because the company describes itself as building a national network spanning patients, providers, pharmacies and life science companies. A network model implies data moving between participants by design, which makes the tenancy and separation question more consequential than it would be for a single tenant application. Ask what is shared across the network, what stays within a single provider's instance, and where each sits.

No published pricing across any of the product lines.

The commercial structure is worth understanding before contracting, because the company monetises on several sides at once: a care team platform sold to providers, a patient facing product, a tech enabled service arm, and separately digital solutions sold to life sciences companies to improve access and time to therapy across its network. A provider is buying from a company that is also selling to the manufacturers whose assistance programmes the platform matches patients into.

There is a legitimate reading of that, since the same network effect is what makes the matching work at all. But a provider should establish what manufacturer relationships exist alongside their own deployment, and whether programme presentation order is influenced by any of them.

Broad across the medication access surface, spanning health systems, oncology practices, infusion centers, and pharmacies, with life sciences companies as a separate customer class. Functional coverage runs from identifying financially at risk patients through enrollment, free and replacement drug inventory management, and adherence support. Oncology and infusion are the evident center of gravity given the case studies and the treatment plan driven pharmacy workflow, which is where high cost specialty medications concentrate.