TeleVox

A patient communications business of long standing with a conversational layer that is now the product it leads with. The asset built over decades is the ability to reach patients reliably across text, voice, email and physical mail, together with the content of reminders, recalls, bill pay prompts and refill notices. That is delivery infrastructure and workflow design, and it stands without a model.

The model sits in a core module. The company now sells WestCX Orchestrate, described as an AI native platform that listens to existing systems, detects patient intent and sentiment in real time, holds conversations that resolve routine needs across voice, text, chat and email, and hands off to staff when it cannot proceed. Conversation at that level does not exist without speech and language models, and the older Engage product sat in the same place.

The company is precise about which part is which, naming the conversational product rather than calling the whole platform intelligent, and the distinction is visible in the integration material, where scheduling and reminder messages are driven by record system triggers rather than by inference.

Bounded and stated, with the boundary itself left undefined. The conversational product answers patient inquiries, manages appointments and handles routine transactions such as bill pay and refill requests, and the company describes a seamless handoff between automation and live staff when needed, so the route to a person is a published part of the design rather than an afterthought. Nothing clinical is decided, and next best actions are described as guidance to the organization rather than as decisions taken on its behalf.

What is not described is the criterion. Nothing says what triggers the handoff, what happens when a patient raises a clinical concern in the middle of a billing or scheduling conversation, how out of hours contact is handled when no staff are available to receive an escalation, or whether patients are told they are speaking with a machine, which several states now require and which matters for a product operating across voice and text at this volume.

The service agreement adds one control, though it points at the customer rather than the system: the provider may insert an opt out mechanism into outbound programs or suspend the affected service where it has a contact compliance concern.

The description stays general and identifies nothing. The platform is presented as an AI native orchestration layer that listens to the organization's existing systems, detects intent and sentiment in real time, coordinates voice, SMS, RCS, email, chat and mail, learns and optimizes across interactions, and drives next best actions from journey context rather than from manual rules. Integration is described as HL7 and application programming interfaces into record systems.

Below that there is nothing to check. No model or model family is named, no provider of speech recognition, language understanding or synthesis appears, training data is not characterized, and no accuracy, containment or error figure is published for intent detection, sentiment or any conversation type. No versioning or update practice is described, which matters on a platform the company says continuously optimizes, because a buyer has no way to learn that the behavior behind its patient conversations has changed.

The suppliers behind the conversations go unnamed.

What the published material establishes: the platform is presented as an orchestration layer over the company's own delivery channels, integrating with record systems over HL7 and application programming interfaces; the service agreement states that personal data may be processed by the provider and its affiliates throughout the world, and that the provider or its suppliers retain rights in the technology, telephone numbers and systems behind the services, which is an acknowledgment that suppliers exist; the business associate agreement binds any agent or subcontractor handling protected health information to the same restrictions.

What is missing is every name. No provider of speech recognition, language understanding or synthesis appears for the conversational product, no hosting or telephony carrier is named, no print and mail partner is named for the postal channel, and no subprocessor register is published. For a conversational product in a group that also runs a sibling conversational brand, whether the model layer is built in house, shared across the group or bought in is unanswered.

Customers are now named and no result is published. The success stories index carries a story about Olmsted Medical Center, a Minnesota provider serving its region since 1949, and further stories about a children's hospital and a health network operating across 24 states that are described by size rather than by name. The partner program is described as more than two decades old.

What none of that establishes is performance. No outcome figure appears in those stories: no reminder response or no show change, no containment rate for the conversational product, no call deflection figure, no staff time saved, and no denominator or period for any of them. There is an ROI calculator, which is a model of what a buyer might save rather than a measurement of what a customer did.

No peer reviewed publication and no independent evaluation appears anywhere, and nothing establishes what the conversational product achieves relative to the reminder infrastructure the company already ran.

General assurances, one concrete permission, and no answer to the questions a conversational product raises.

What is published: the integration page says patient data is protected by a HITRUST certified data security infrastructure; the service agreement says the customer is the data controller and the provider the processor, and that personal data may be processed by the provider and its affiliates throughout the world; the business associate agreement commits the company to appropriate safeguards under the Security Rule and to mitigating harmful effects of any use or disclosure outside its terms.

The concrete permission runs the other way. The business associate agreement expressly allows the company to de identify and aggregate protected health information in compliance with HIPAA. Nothing then says what the de identified material is used for, so whether patient conversations, transcripts or message content inform model development is unaddressed in either direction. For a platform whose conversational layer is described as learning and continuously optimizing, that is the central open question.

No retention schedule is published for message content, call recordings or transcripts, no deletion process is described, and the privacy policy linked in the site footer returns a not found error, so no privacy notice is reachable.

All four elements are published and reachable from the site.

Business associate status is stated in the service agreement: where the customer is a covered entity and provides protected health information to Televox, Inc. as a business associate, the business associate agreement is incorporated by reference. The agreement itself is published in full at a linked address, so a buyer reads it before contracting rather than requesting it, and its incorporation into the standard service agreement makes the tier clear, since it attaches to every customer that sends protected health information rather than to a premium plan.

Subcontractors are covered: the agreement requires any agent or subcontractor that creates, maintains or transmits protected health information on the company's behalf to accept the same restrictions and conditions, and requires the company to cure or terminate where it learns of a material breach of those obligations. The agreement also sets response times that a buyer can hold it to: reporting an unpermitted use or disclosure within fifteen business days, access to a designated record set within seven, amendments within seven, and accounting information within fifteen.

Two points remain open. The agreement permits de identification and aggregation of protected health information, and nothing says what the de identified material is used for. And the contracting entity has changed hands more than once; which entity signs, and what happens to the agreement on a change of control, is not addressed.

HITRUST certification is named in the company's own material without the artifact behind it. The company announced HITRUST risk based two year certification in December 2023, at the framework's highest assurance tier, and the integration page still tells buyers their data is protected by a HITRUST certified data security infrastructure. That is an independently validated assessment against a control library covering health privacy rules, federal and state regulation and several information security standards.

Two gaps remain, both about scope and clock. The announcement names a specific product, the patient engagement platform, rather than the company or the conversational product, so which systems sit inside the assessed scope is unclear. And a two year credential announced in December 2023 has run its term on its face; no renewal announcement, no certificate, no scope letter and no trust portal appear on the site, and the current claim is a marketing sentence on an integration page rather than a retrievable artifact.

Nothing else independent appears: no SOC 2 report, no penetration testing statement, no vulnerability disclosure policy and no security documentation offered under agreement.

No clearance is claimed and none is required. Reminders, scheduling, billing prompts, refill notices and conversational handling of those requests are administrative, and the company makes no clinical claim for them.

The regime that bites here is telecommunications rather than device law, because automated outbound contact with patients turns on the consent a patient gave to be contacted that way, and that exposure grows rather than shrinks as a reminder becomes a conversation. The company addresses it in its contract rather than on its marketing pages: the service agreement places responsibility for the content, timing, recipients and nature of outbound programs on the customer, and reserves the right to insert an interactive opt out mechanism, pass the resulting data back, or suspend the affected service where it has a compliance concern. The site's HIPAA page performs a related function, reproducing the federal guidance that appointment reminders are part of treatment and need no separate authorization.

What is absent is the vendor's own position on the newer question: several states now require disclosure when a caller is interacting with an artificial agent, and nothing published says whether the conversational product identifies itself. Nor is it described how consent status is checked before an automated conversation begins.

Nothing published shows how the model's behavior is tested. The only governance language on the site is a marketing line describing fully governed, audit ready AI built for regulated environments, with no framework named, no evaluation method, no monitored metric and no independent review behind it.

The risk this product carries is well documented. A conversational agent working across voice and text is the front door to appointments, billing and refills, and speech recognition performance varies with accent, dialect, age and speech impairment: research across five commercial systems found error rates roughly twice as high for Black speakers as for white speakers (Koenecke and colleagues, PNAS, 2020). The company markets real time intent detection and sentiment awareness as strengths and publishes no performance by language, accent or speaker group, and a patient the agent fails to understand simply gives up, leaving no complaint and no record.

A second exposure sits in the same place. Company material has claimed that a patient can write in their own language and the system will translate it for the clinician with great accuracy, with no language list, no measurement and no human review requirement published. Machine translation errors cluster in negation, symptom description and dosage, and a fluent wrong translation carries no signal that it is wrong. Nothing says what a clinician is shown about translation uncertainty.

The published agreement settles it: nothing stands behind the output. The service agreement says the provider will maintain the services in a workmanlike manner customary for the industry and expressly does not warrant or guarantee the results, disclaims merchantability and fitness for purpose, and supplies the licensed materials as is. The indemnities run one way on substance: the customer indemnifies the provider for its programs and content, while the provider's indemnity is limited to intellectual property infringement. No uptime commitment, service credit, accuracy warranty for any conversation type, or remediation obligation appears, and the business associate agreement's breach reporting within fifteen business days is the only published obligation that runs anywhere.

The failures this product can produce are ordinary and frequent rather than dramatic: a reminder sent to the wrong patient or the wrong number, an appointment canceled or moved on a misheard instruction, a bill pay prompt for an amount already paid, a refill request that never reaches the clinical team. Volume is what makes them consequential, and no error rate is published for any of it.

The patient is outside the contract entirely. Nothing describes how a patient reports that an automated conversation got something wrong, and the route back is the practice rather than the vendor.

Named record systems, described as two way, on the vendor's own account.

The integration page names Epic and describes reading from and writing back to it through application programming interfaces, including scheduled appointments, status updates and documentation, and naming the Epic modules the workflows touch: Cadence, MyChart and OpTime. Oracle Cerner is named with secure interfaces and closed loop workflows, with two way communications documented in the record in real time and no manual data entry. NextGen, athenahealth and Allscripts are named alongside them, and HL7 is named as the transport for event based triggers that fire reminder, scheduling and billing messages without staff intervention.

Verification is the gap: every claim is the company's own, no marketplace or validated listing is cited, no interface documentation is published for a customer to read, and no named customer deployment is tied to a named record system.

One sentence in the contract is the only statement about where anything runs, and it points outward rather than at a region. The service agreement says personal data may be processed by the provider and its affiliates throughout the world, with the customer as data controller and Televox as processor. That is a processing path disclosure, and it is the opposite of a residency commitment: a buyer is told the data may travel, not where it rests.

Nothing else is described. No hosting provider or region, no residency option, no tenancy or segregation model, no backup, continuity or recovery position, and no uptime or availability statement appears, and the privacy policy the footer links returns a not found error.

The question is concrete for this product. A platform sending reminders, bill pay prompts and conversational messages across voice, SMS, email and physical mail holds message content, call recordings and patient contact data, and how long any of it is held after a message is sent is unanswered. The mail channel adds a print and postal path that is not described at all.

The standard service agreement is published, so how the product is sold is clear even though no price is.

The agreement sets out the terms before any contact: services are bought on a statement of work or order form under a master agreement with Televox, Inc.; subscriptions run for a term set in the order form, start at the earlier of thirty days after system access or go live, renew automatically, and require ninety days' written notice before expiry to stop; charges are invoiced with stated payment and late fee terms; and the provider may raise prices on renewal. There is an ROI calculator on the site, which models savings rather than cost. No rate, unit of charge, tier or minimum appears anywhere, and third party coverage records only that quotes are custom.

The unit of charge is the gap that matters on a communications platform, where the candidates diverge sharply: per message, per minute, per patient, per provider or per location, with physical mail priced separately by definition. Nor is it said whether conversational interactions are priced differently from one way reminders.

Broad across organization type, channel and function, with one customer now named behind it.

Buyers span hospitals and health systems, physician practices, payers and pharmaceutical organizations, each with its own page. Channels cover voice, SMS, RCS, email, chat and physical mail, and keeping postal delivery is a real reach advantage for older and rural populations that digital only platforms miss. Functionally it runs from appointment reminders, recalls and self scheduling through bill pay, refills, referrals, pre and post procedure messaging and event triggered outreach from the record system. It is not tied to a clinical specialty, and the market is the United States.

Validation is thin but no longer absent: Olmsted Medical Center is named in a customer story, with a children's hospital and a 24 state health network described by size rather than name. Nothing ties a channel or a function to a measured result at any of them, and nothing states where the conversational product is deployed as against the older one way messaging.