Transcarent

WayFinding is genuine generative AI and the company raised a $126 million round specifically to build the capability, but the delivered product is substantially human: advocacy, expert medical opinion, virtual primary care, and staffed care experiences for cancer, surgery, and weight, most of it acquired with Accolade. The AI is the navigation surface over a large services organization. Buyers should scope which layer they are actually purchasing, since the economics of an AI interface and a staffed advocacy service differ entirely.

Agentic capabilities were added to WayFinding in January 2026, and no escalation criteria, confidence thresholds, or human review gates were retrieved for them. The consequence surface deserves attention: a member asking what is covered and what it will cost is receiving guidance with financial consequence, and one that steers toward or away from care has clinical consequence too. The company does employ large advocacy and clinical teams who represent a natural escalation path, but the criteria for routing to them are not published.

Capabilities are named and branded. The technology is not described.

What is public: a generative navigation experience launched in 2024, agentic capabilities added in January 2026 including voice scheduling and symptom checking, a memory capability that retains member history and preferences to anticipate next actions, and a personalised health path. Each is named as a product. A buyer can tell what they do.

What is absent: which models underlie any of it, whether they are the company's own or licensed from a third party, where inference runs, how the memory capability is implemented and what it stores, how versions are managed, and what evaluation exists for any component. The company describes its artificial intelligence as built for healthcare from the ground up, which is a positioning claim rather than a technical one, and nothing published distinguishes it from a general model applied to healthcare content.

That gap sits oddly beside the governance disclosure on this record, which names external frameworks, specific practices and an accountable owner. A company that has thought carefully enough about artificial intelligence governance to appoint a director for it, and that publishes the methodology behind its symptom checking safety evaluation, is well placed to say what the systems are. It has not.

Ask which models are used and whose, whether member conversations are processed by any third party model service and under what terms, how the memory engine stores and expires information, and how changes to underlying models are tested and notified.

The governance instruments are real and one accountability choice is unusual: three external certifications covering healthcare specific controls, international information security and an audited service attestation, alongside a named privacy officer who also owns artificial intelligence governance. Putting both under one accountable person is more than a policy, because it identifies who a buyer can ask.

What is unaddressed is who sits on either side of the platform, and that is the structural question here. The member is an employee, the customer is the employer paying for the benefit, and the company sits between them holding what the member says about their symptoms, their treatment, their medications and their care decisions. Privacy rules restrict what may reach a plan sponsor, and nothing published describes what an employer actually receives.

Aggregate reporting is the usual answer and it is not a complete one, because in a small employer or a small department an aggregate about a rare condition can identify a person without naming them. The memory capability sharpens it further.

The platform is described as learning each member's preferences, history and patterns to anticipate their next action, which means a persistent longitudinal profile accumulating across years and potentially across employers, and nothing states retention, what happens when a member changes employer, or whether the profile follows them. Ask what the employer sees at what granularity, the minimum cell size for reporting, and the profile's fate at termination.

Scale is not in question: more than 20 million members across more than 1,700 employer and health plan clients following the April 2025 Accolade merger. Held back from A because that scale is the combined footprint of two established benefits businesses rather than evidence for WayFinding specifically, which reached full deployment only in 2025, and no utilization, accuracy, or cost outcome data attributable to the AI layer was retrieved. This is the same distinction applied to Medable, Medidata, and Veeva: platform scale is not evidence for a recent AI capability.

Good instruments, a named accountable owner, and one structural question that matters more here than the certifications do.

The instruments are real: certification under the healthcare control framework, which is built around the privacy and security rules specifically, the international information security standard, a SOC 2 Type II, and a named privacy officer who also owns artificial intelligence governance. Stated safeguards cover privacy, bias and transparency.

The structural question is about who sits on either side of this platform. The member is an employee. The customer is the employer paying for the benefit. The company sits between them holding what the member says about their symptoms, their treatment, their medications and their care decisions. The privacy rule restricts what may reach a plan sponsor, and the company's covered entity claim implies those restrictions apply to at least part of the business, but nothing published describes what an employer actually receives. Aggregate reporting is the usual answer and it is not a complete one, because in a small employer or a small department, aggregates about a rare condition can identify a person without naming them.

The memory capability sharpens it. The platform is described as learning each member's preferences, history and patterns to anticipate their next action, which means a persistent longitudinal profile accumulating across years and employers. Nothing states retention, what happens when a member changes employer, or whether the profile follows them.

Ask what the employer sees at what granularity, the minimum cell size for reporting, and what happens to a member profile at termination.

The company publishes a role statement rather than leaving its position to be inferred, which is uncommon and useful, and the statement needs unpacking rather than accepting at face value.

It states that it acts as a covered entity under the health privacy rule. That is a stronger position than the business associate status most vendors in this segment occupy, because obligations attach directly and are enforceable against the company by the regulator rather than flowing through a contract with a customer. It is also plausible on the facts: the company operates affiliated medical groups delivering virtual care, and provider status follows from that.

What the statement does not resolve is the rest of the business. Benefits navigation performed for a self insured employer's plan looks like work done on behalf of that plan, which is business associate territory. Pharmacy benefit administration is different again. An organisation that is a covered entity for some functions and a business associate for others is a hybrid entity, and the mechanism that makes that workable is a formal designation identifying which components are which, with information barriers between them. Nothing published describes that designation.

The practical consequence for an employer is specific. Data held by the covered components is subject to the privacy rule and may not flow freely to the plan sponsor, while data held elsewhere in the same organisation is governed differently. Which side of the line a given data flow sits on determines what the employer may lawfully receive.

Ask for the hybrid entity designation, which components are covered, and what separates them.

Three real certifications, described with unusual precision about what each covers.

The company states that its information protection programme is certified under the healthcare control framework at its current major revision, that its information security programme is certified to the international information security management standard, and that it holds a SOC 2 Type II. Naming which internal programme is certified against which standard is more informative than the usual list, because it tells a reader what was actually in scope rather than leaving scope to be assumed.

One detail rewards close reading and is generally worth checking. The SOC 2 is described as covering security, availability and confidentiality. Those criteria are selectable, and privacy is a separate criterion that is not named here. Confidentiality and privacy are not the same thing: confidentiality concerns protecting information designated as confidential, while the privacy criterion examines how personal information is collected, used, retained, disclosed and disposed of against the entity's own commitments. For a company that describes itself as a covered entity and holds member health information, the privacy criterion is the more directly relevant one, and another vendor assessed in this same lane includes it.

What is missing is a trust centre or documented request path, penetration testing disclosure, and any statement of scope boundaries across a business that combines a navigation platform, affiliated medical groups and a pharmacy benefit.

Ask which entities and systems fall inside each certification, and whether the privacy criterion can be added.

No device pathway is claimed and the reasoning that keeps this outside device regulation is available, but the strongest form of that reasoning does not apply to a patient facing product and a buyer should understand why.

The platform now includes symptom checking that gives conversational information and guidance toward appropriate care options, alongside agents that schedule appointments. Scheduling is administrative. Symptom assessment that directs a person toward or away from care is the function where the boundary sits.

The exemption that keeps most clinical decision support outside device regulation turns on a specific condition: that a health care professional can independently review the basis for the recommendation rather than relying primarily on it. That condition is satisfiable for a clinician facing tool. It is not straightforwardly satisfiable for a tool speaking directly to a member, because the person receiving the guidance is not a health care professional and has no way to review the basis. The reasoning that protects clinician facing triage software therefore does not transfer, and a patient facing symptom checker has to rest on different ground, typically that it provides general information rather than a patient specific assessment.

The company's mitigations are real and worth crediting. Safety evaluation is grounded in millions of real patient physician interactions from its own medical groups, licensed clinicians and advocates are available for escalation, and the product routes toward care rather than substituting for it.

Ask for the published regulatory rationale, what the symptom checker will not answer, and how it behaves when a member describes an emergency.

One of the better governance disclosures in this index, and it stops short of results.

What is published. The company names the external frameworks its governance model follows, the intergovernmental artificial intelligence principles and the national risk management framework for AI, rather than referring to responsible AI in the abstract. It names the practices it applies, human in the loop testing, code review, and regular audits and monitoring, directed at preventing bias and protecting privacy. It names an accountable individual, a privacy officer who also holds the artificial intelligence governance brief, which matters because a named owner is what distinguishes a governance function from a governance statement. And it participates in an industry data and trusted AI alliance working on standards.

One product specific disclosure is more substantial than the framework references. The company states that safety evaluations for its symptom checking capability are based on a dataset of millions of interactions between patients and doctors in its own affiliated medical groups. Grounding a triage safety evaluation in real clinical encounters rather than synthetic cases or clinician review alone is the right design, and having the medical groups makes it possible.

What is absent is any result. No evaluation output, no error rate, no subgroup analysis, no model documentation, and no statement of where the system should not be relied upon. The symptom checking evaluation is described but not quantified, so a buyer knows the method and not the finding.

Ask for the safety evaluation results, performance across member populations and languages, and the applicability boundary.

One published artefact carries this and the gap beside it is conspicuous rather than ordinary. The company publishes the methodology behind its symptom checking safety evaluation, which is the right thing to evaluate and the right thing to publish: symptom checking is where a consumer facing product can most directly harm someone by under triaging, and a published methodology lets a reader assess whether the evaluation was designed to find that failure or to pass.

Governance is named too, with external frameworks, stated safeguards covering bias and transparency, and an accountable owner. What is absent is any technical description or result. No model is named for any capability, no evaluation results are published including for the symptom checker whose methodology is public, and the claim that the artificial intelligence is built for healthcare from the ground up is a positioning statement rather than a technical one, with nothing distinguishing it from a general model applied to healthcare content.

That gap sits oddly beside the governance disclosure. A company that has thought carefully enough to appoint a director for artificial intelligence governance, and to publish an evaluation methodology, is well placed to say what the systems are and how they scored. It has not. Ask for the symptom checker's results against its own published methodology, which models are used and whose, and whether member conversations reach any third party model service.

The True Health Actions platform acquired with Accolade draws on employer data, health plan data, and electronic health records to generate targeted guidance, which is a broader data foundation than benefits eligibility alone and is what makes personalization more than plan document lookup. Held back from A because named EHR integrations and data acquisition methods were not retrieved.

No hosting location, region, tenancy model, retention schedule or subprocessor list was located.

The combined business makes the tenancy question more consequential than usual. Following the 2025 merger the organisation spans a navigation platform, health advocacy, expert medical opinion, virtual primary care, staffed care experiences and a pharmacy benefit, serving more than twenty million members across more than seventeen hundred employer and health plan clients. That is a large number of distinct customer populations inside one estate, and several of those customers are health plans that compete with one another. How one client's member data is separated from another's is a commercial question as much as a security one.

A second question follows from the merger itself. Two established businesses were combined, each with its own infrastructure, and integration of that kind takes years. Whether a member's data now sits in one environment or two, and whether the certifications cited cover both, is not addressed publicly and is exactly the sort of thing that remains unresolved longer than anyone expects.

A third follows from the voice capability added in 2026. Voice scheduling means audio moving through telephony infrastructure, which introduces carriers and providers the company does not own into the data path.

Ask where member data is held, the isolation model between clients, whether the merged estates have been consolidated and which certifications cover which, retention for conversations and voice recordings, and the subprocessor register.

Converted from Not Rated. This was the last of the five commercial rows this index deliberately held open pending a check on whether the pricing statement was published by the vendor. It was not, and the grade follows.

No pricing, rate structure, minimum, contract term or illustrative figure was located on the company's own materials. The per member per month structure is the category convention and can be stated as such, but a convention is not a disclosure: it is what a knowledgeable buyer would assume rather than something this company has committed to.

The grade is not the useful part of this row. Two structural points are.

The 2025 merger bundled two previously separate purchases, a navigation platform and a large advocacy and clinical services organisation. An employer evaluating the combined offer is being quoted for capabilities it may have bought elsewhere or may not need, and the components price very differently: a software interface and a staffed advocacy service with clinicians answering calls have different cost structures, different scaling behaviour and different renewal dynamics. Ask for the components separately even if the intention is to buy the whole.

Second, this is a category where outcome based pricing is common, with fees contingent on measured savings or engagement. Where such terms exist, the definitions do the work: what counts as a saving, against what baseline, measured by whom, and who arbitrates. Ask for those definitions in writing rather than the headline arrangement.

For calibration, another vendor assessed in this pass published its member facing terms plainly and sits a grade higher for that reason alone.

Bounded to the employer and health plan benefits context rather than clinical settings, spanning benefits navigation, pharmacy benefit, and staffed care experiences in cancer, surgery, and weight health, extended by the merger into advocacy, expert medical opinion, virtual primary care, and partner mental health services. Held back from A because the range spans navigation, clinical delivery, and benefits administration, and maturity across those is unlikely to be uniform.