Tennr

RaeLM, a purpose built vision language model, is the product. The company's explicit thesis is that general purpose LLMs are not fit for reading scanned faxes, handwritten forms, and checkboxes against payer criteria, and that a specialized model trained on proprietary healthcare documents is required.

No escalation criteria, confidence thresholds or human review gates were located in the company's own published material.

The gap matters because autonomy is marketed. The platform is described as completing document workflows end to end and evaluating extracted data against payer criteria to flag likely denials before submission, and an autopilot capability is part of the positioning. What is missing is the boundary: at what confidence a document is processed without review, who sets that threshold, what happens to a document the model cannot read, and whether a human sees anything that was handled automatically.

The decisive number for this category is the share of documents completed without human touch, and it is not published. That figure is the honest expression of how much autonomy is actually running, and a vendor selling automation of inbound operations is better placed than anyone to report it.

The model is named and its training corpus is quantified: a reported 100 million anonymized healthcare documents, 2.3 billion data fields, and 8,000 sets of payer criteria, with the architecture described as vision language plus an orchestration engine. Held back from A because no model card, benchmark methodology, or evaluation results were published to support the accuracy claims.

This vendor publishes something most in this index do not: an explicit statement that de identified data is used for research and development of new products, to refine its algorithms and machine learning applications, and to improve the service.

Read alongside its claim that the model was trained on more than a hundred million anonymised healthcare documents, that discloses where a substantial part of the training corpus comes from, and stating it plainly rather than leaving a reader to infer it is why this sits above the middle of the scale.

What is not stated is which de identification standard applies, since the privacy policy paraphrases the concept rather than naming either the enumerated identifier method or a statistical determination, and the two produce different residual risk. The modality makes that harder than usual and it is the question to press.

The product reads scanned faxes, photographed forms and handwritten documents, so identifiers sit in handwriting, letterheads, fax transmission headers, signatures and stamps rather than in labelled fields, which means de identification here is an image and text extraction problem before it is a policy one, and a redaction process validated on structured records says nothing about performance on a smudged fax header. Ask whether the method has been validated for scanned and handwritten source documents specifically, what the residual identifier rate is, and whether a customer can decline to contribute.

Operational scale is specific and consistently reported across sources: more than 10 million documents processed monthly across over 150 healthcare organizations, with a reported 320,000 referring partners on the network. Held back from A because the decisive metric for this category, the share of documents completed without human touch, is not published, and the cited industry error rate of roughly 8 percent on eligibility checks is a vendor framing rather than an independent benchmark.

Tennr publishes something most vendors in this index do not: an explicit statement that de identified data is used for research and development of new products, to refine its algorithms and machine learning applications, and to improve the service. Read alongside the company's claim that its model was trained on more than 100 million anonymised healthcare documents, that discloses where a substantial part of the training corpus comes from. Stating it plainly is creditable and is why this sits at B rather than C.

What is not stated is which de identification standard is applied. The privacy policy paraphrases the concept rather than naming either the safe harbour method or expert determination, and the distinction matters because they produce different residual risk.

The modality makes it harder than usual and this is the question to press. The product reads scanned faxes, photographed forms and handwritten documents. Identifiers in that material sit in handwriting, letterheads, fax transmission headers, signatures and stamps rather than in labelled fields, so de identification is an image and text extraction problem before it is a policy one. Ask whether the method has been validated for scanned and handwritten source documents specifically, and whether a customer can opt out of contributing.

The company states that it processes health data pursuant to agreements with its health care provider customers and that it applies privacy and security standards to all health data it collects, naming the categories it handles: patient intake forms, referral forms, insurance forms and related documentation. That is a clearer statement of role and scope than most records here carry.

Held at B rather than A because no business associate agreement terms are published, so a buyer can see the posture but not the instrument.

One scope question follows from the network product. Referral status visibility is offered to referring providers, receiving providers and patients, which means information moves between organisations that are separate covered entities and are not party to each other's agreements with the vendor. Establish what each participant can see about a referral originating elsewhere, and under whose authority that disclosure is made.

No SOC 2, HITRUST or ISO 27001 attestation was located across two differently phrased searches, and no trust centre was found.

The company does describe controls: encryption in transit and at rest to industry standard, a combination of technical, administrative and physical safeguards, and internal access control policies. Those are stated commitments rather than audited ones, and the policy language is candid that no transmission is ever fully secure.

One phrase belongs on the compliance language watchlist. The company states it uses compliant products and services for health data storage and processing, which describes the posture of its infrastructure suppliers rather than an attestation of its own. That is the cloud inheritance pattern this index tracks: a vendor can run on compliant infrastructure and still have no independent examination of how it configures and operates it.

For a company processing a reported 10 million documents a month for over 150 organisations, its own attestation and scope should be an early request.

No FDA pathway applies and none is claimed. Reading inbound documents, extracting data and checking it against payer criteria is administrative work with no diagnostic or treatment decision surface.

Graded C because regimes do reach the functions sold and no position is published on any of them. Prior authorisation work sits under the CMS interoperability and prior authorisation requirements and the state laws now conditioning AI involvement in coverage decisions. The voice capability added in 2026 reaches the consumer telephone consent framework where calls are outbound, following the FCC ruling that AI generated voices are artificial voices requiring prior express consent.

One scoping point worth naming. Evaluating a referral against payer criteria to predict a denial is not itself a coverage determination, and the note does not treat it as one. But it shapes what gets submitted and in what form, which sits closer to the coverage process than pure document handling does. A buyer should establish whether any workflow can cause a referral to be abandoned rather than corrected, since that would be a practical denial made without a payer involved.

No AI governance framework, model monitoring disclosure or bias evaluation was located.

Two mechanisms make this concrete rather than abstract for this product. Extraction accuracy on scanned and handwritten material is not uniform: it varies with fax quality, form design, handwriting legibility and whether a practice sends clean digital output or a photographed page. Those correlate with the resourcing of the sending practice, so an accuracy gradient by document quality is an accuracy gradient by where the referral came from, and the patients affected are those referred from the least resourced settings.

The second is the criteria evaluation. Flagging documents likely to be denied shapes which referrals proceed smoothly and which stall, before any payer has decided anything. Nothing published addresses whether flag rates or extraction accuracy are reported by sending organisation type, payer or document source.

The model is named and its training corpus is quantified across three dimensions, covering a stated document count, a data field count and a number of payer criteria sets, with the architecture described as a vision language model plus an orchestration engine.

Quantifying a corpus along more than one axis is more informative than a single headline number, because document count speaks to volume while field count speaks to the density of extraction and criteria sets speak to breadth of payer coverage, and a reader can judge whether the three are consistent. Naming the architecture as vision language also tells a buyer the correct failure mode to test for, which is misreading rather than misreasoning. Held at C because nothing is measured.

No model card, benchmark methodology or evaluation results were published to support the accuracy claims, and no warranty, indemnity or remediation commitment attaches. For a document extraction product the useful figures are per field accuracy on realistic source material and the behaviour on low confidence extractions, because the characteristic failure is a plausible value in the right field that nobody checks, and a downstream system will treat it as read. Ask for accuracy by field type and by source quality band, what happens when confidence is low, and whether an extracted value is flagged as machine derived when it reaches a human.

Ingests from more than 50 types of e-fax, phone, email, and portal sources and structures output for EHR and pharmacy management systems. Breadth of intake is the strength; depth of write back into specific named EHRs was not documented.

No hosting provider, region, tenancy model or data residency commitment was located, and no subprocessor list is published. The company states it uses third party products and services for health data storage and processing, which establishes that subprocessors exist without naming any of them.

That omission is more consequential here than for most products because of the ingest surface. The platform receives material from more than fifty types of electronic fax, phone, email and portal source, and telephony and fax transport are frequently operated by third parties rather than the vendor. Documents therefore pass through infrastructure the customer has not assessed before they reach the platform at all.

Ask for the full subprocessor list including fax and telephony carriage, where each processes and stores content, and how long documents persist at each hop.

No public pricing. Contact the vendor. Enterprise agreements with referral receiving operators and device manufacturers; no published rate card.

Scope is broad but enumerated by function rather than vaguely claimed. Named workflows cover referral intake, patient intake and registration, eligibility verification, order processing and prior authorisation, with a referral network product spanning referring providers, receiving providers and patients, and voice capability for referral phone workflows added in 2026. Buyer types are named across ambulatory practices, hospitals and health systems, health plans and digital health providers.

Held at B rather than A because the span crosses provider and payer sides and the maturity is unlikely to be uniform across them. The company's own reported scale is concentrated in referral receiving operations, so a buyer outside that core should establish what is production proven in a comparable setting rather than assuming the whole list is equally deployed.