Truveta

Access to de identified health records from 30 US health systems is what Truveta sells, and the Truveta Language Model is what turns those records into usable research data. The model maps diagnoses, medicines, laboratory results and other entries that each system records differently to standard vocabularies such as SNOMED CT, RxNorm and LOINC, and extracts concepts such as cancer stage, seizure frequency and the reason a medicine was stopped from more than 7 billion clinical notes. Truveta Intelligence adds a generative AI research assistant that answers questions in plain language and shows the code sets and methods behind each answer.

The product also carries value the model does not create: the member network that supplies records daily, the Truveta Studio research environment, linked claims and mortality data, and a services team for study design and regulatory submissions. The model is the engine of the core data product rather than the whole of what is sold.

Nothing here acts on a patient. The automated step that matters is the mapping and extraction that every study inherits, and Truveta describes how people oversee it: mappings where the model has low confidence or the clinical meaning is subtle go to manual review, low confidence note extractions are routed to human reviewers, and pipeline changes reach production only after passing validation checks (JAMIA Open, 2026). Researchers can see the code sets, definitions and methods behind results, and the Community Standard requires them to apply their own judgment to AI answers.

The confidence thresholds that send a case to a person are not published, and neither is what happens to studies already run when a mapping error is found later.

The model is described in useful detail. The Truveta Language Model started from pretrained open large language models with further training on member records, according to its 2023 launch announcement. The 2026 JAMIA Open paper describes transformer based language models with rule based postprocessing for notes, and a set of machine learning models for mapping to standard vocabularies, trained on thousands of expert curated mappings and annotated note segments. Performance is tracked against gold standard annotations with precision, recall and F1 over time to catch drift, and every pipeline change is tied to a schema version and released only after passing validation checks. A 2026 white paper behind a contact form is described as covering the model's evolution into a set of coordinated agents.

The base models are not named and no version history is published for customers, so there is no way to tell when the model behind a dataset changed.

The chain behind the core model is short. Truveta builds and trains the Truveta Language Model itself on member records, starting from open pre-trained models it does not name, and hosts it on Microsoft Azure. For the Genome Project, specimens go to the Regeneron Genetics Center for sequencing, and Illumina is an investor and sequencing technology partner.

The model behind the generative AI research assistant in Truveta Intelligence is not named. The privacy notice lists AI feature support among the unnamed service providers that receive user information, which includes assistant prompts and responses, and no subprocessor list is published.

The evidence is mostly that the data supports published research. Truveta says its data has supported hundreds of scientific publications, and its own staff describe the platform in a peer reviewed JAMIA Open paper (2026), which describes the system rather than testing its accuracy. The one direct test of the model is the cancer staging study in JCO Clinical Cancer Informatics (2026): trained and tested on 700 annotated notes from one health system, with precision of 0.77 to 1.0 by attribute, then used to extract 2.5 million staging records for about 218,000 patients. These figures come from the abstract. The company says an evaluation at three more health systems is under way.

Other claims are harder to check: a 2023 statement of above 90% accuracy across diagnoses, medications and laboratory results, with no method, and a claim that the model outperforms GPT-4 and other mapping tools, with the method in a white paper behind a contact form. A case study describing an FDA approved label expansion for an implanted device is also behind a form and names neither device nor sponsor.

The published research is led by the vendor, and none of it is independent validation. The claim that this data can replace trials and registries holds for specific regulatory uses, such as label expansions and safety studies, rather than in general.

De-identification is described in detail. Direct identifiers are removed inside each health system's own environment before anything leaves it, dates are shifted per event, patient identifiers are hashed, ZIP codes and birth dates are generalized, and patients in high re-identification risk groups are dropped; an outside statistical disclosure analysis confirms the method meets the HIPAA Expert Determination standard (JAMIA Open, 2026). Clinical notes, images and genomic data are held apart from other data with tighter access controls, and every user agrees never to try to re-identify a patient.

For the Genome Project, the FAQ says patients can decline or withdraw later, consent forms differ slightly by health system, and genomic data will get added safeguards: consent management, separate storage, tighter access and audit, and extension of existing security audits to cover it. It does not say what happens to stored specimens after a withdrawal. A genetic sequence is harder to deidentify than an ordinary record, and neither the consent form text nor any reidentification controls specific to genomic data are published.

Retention is the gap. The privacy notice keeps user data as long as reasonably necessary and says user personal data is not used to train Truveta's models; the Truveta Language Model itself is trained on member records, and no retention schedule for patient data is published. Regulatory study files are kept for the period FDA requires. No safety engineering for the research assistant is published beyond the warning that its answers may be wrong.

The business associate relationship runs to each member health system. Each member signs a business associate agreement that authorizes Truveta to store, process and de identify protected health information on its behalf, and de identification runs inside the member's environment before data leaves (JAMIA Open, 2026). Research customers receive only de identified data, which the publication guidelines say a qualified expert has attested under the HIPAA Privacy Rule. The Genome Project FAQ says its consents are aligned with HIPAA.

The agreement is not published, and the privacy notice covers website and platform users while explicitly excluding patient information. Neither the agreement's subcontractor terms nor the Expert Determination report behind a given dataset is published.

Several independent audits are named in the company's own announcements: a SOC 2 Type 2 examination by Schellman (October 2023), ISO 27001 with the 27701 and 27018 extensions renewed annually through Schellman, and HITRUST r2 certification covering Truveta Studio and Truveta Data (November 2024), which includes the NIST Cybersecurity Framework. The Genome Project FAQ says these audits will be extended to genomic data.

No report or certificate can be retrieved: there is no public trust portal, and the security white paper that lists the audits is behind a contact form.

Truveta makes no device claim and needs none: this is research data and analysis software that works at population level and does not inform care for an individual patient. The regulatory question is whether evidence built on the data is accepted in submissions. Truveta says its data practices align with FDA's final guidance on real-world data, backed by a quality management system, more than 70 process controls and 30 standard operating procedures (June 2024), with study files kept for the period FDA requires and read-only regulatory exports for audit. A consultant who spent more than 40 years at FDA is quoted in support. These are the company's statements: regulatory grade is a standard it aims to meet, not a status FDA confers.

A label expansion case study for an implanted device is behind a contact form and names neither product nor sponsor. The Genome Project falls under research consent rules at the contributing health systems.

Truveta publishes a good deal about the limits of its data, so a researcher can see where the dataset may be skewed. Its publication guidelines tell authors to state that the data come from community health systems only, with nothing from immigration detention, correctional, military or Indian Health Service facilities, and that de-identification removes patients in groups with a high risk of re-identification, such as people with rare diseases or from small ethnic groups. Each dataset comes with a datasheet whose representativeness section compares the cohort to the US population. Governance sits with the member health systems: a Board of Governors has committees for ethics, security and privacy, data integration and research. The ethics policy is offered only as a download behind a contact form, so its text is not public.

A peer-reviewed paper by Truveta staff in JAMIA Open (2026) says the mapping models are benchmarked against expert-curated gold standards, monitored for drift and checked with quantitative bias analyses, but the results of those bias analyses are not published. The one published model evaluation, for cancer staging (JCO Clinical Cancer Informatics, 2026), reports precision ranges across five cancer types from a single health system, with no results by patient demographics and no comparison across contributing systems.

Truveta has published an error rate with its method. Its cancer staging model, a version of the Truveta Language Model, was trained and tested on 700 clinical notes annotated by hand, and the study reports relation-level precision of 0.77 to 1.0 across six staging attributes for bladder, cervical and colorectal cancer, and 0.83 to 1.0 for breast and prostate cancer, which the model had not been trained on (JCO Clinical Cancer Informatics, 2026, all authors from Truveta). Only the abstract could be read, because the publisher's site returned a bot check. The company also says each concept delivered to customers comes with its definition, modeling method and extraction precision and recall.

Outputs can be traced and checked. Studies can be saved as read-only regulatory records with audit logs, data points trace back to their clinical source, and researchers can inspect the code sets and methods behind an AI answer.

Nothing stands behind the output. The Truveta Community Standard (May 2026), which every Studio user accepts, says generative AI output may be inaccurate and must not be relied on for any consequential decision; for users outside a sponsoring organization it disclaims all warranties and caps Truveta's liability at $10. Terms for sponsored customers sit in their contracts and are not public.

Member health systems' record systems feed Truveta every day. Member analysts pull from Epic Clarity and Caboodle, Oracle Health Data Intelligence or their own data warehouses into a landing zone inside the Embassy, and files are checked for completeness and integrity at onboarding and on each refresh (JAMIA Open, 2026). The Truveta Data Model builds on HL7 FHIR, and data maps to SNOMED CT, ICD, CPT, RxNorm, NDC, LOINC and CVX. The paper gives one worked example: when one member supplied far fewer vital signs than its peers, Truveta traced the gap to a flowsheet left out of the feed, and coverage rose from about 50% to over 80% once it was added.

Data flows one way, from care into research. Nothing is written back into a record, and a customer's own systems connect only through exports to SAS, Excel and similar tools.

The processing path is described. Each member health system runs an Embassy service inside its own secure environment, where records are normalized, indexed and de identified before any data leaves; only de identified data reaches the central platform, and members can also run studies on their own identifiable data in a separate PHI Embassy (JAMIA Open, 2026). The platform runs on Microsoft Azure, named as the exclusive cloud provider in 2021 and again for the Genome Project, and Microsoft is also an investor. Customers work in the hosted Truveta Studio or export data to their own tools.

No Azure region or residency commitment is published for patient data. The privacy notice covers user account data only, stored in the United States and possibly processed elsewhere by service providers. Stored Genome Project specimens raise a physical storage question the documents do not answer.

No prices are published, but how the product is sold can be established before contacting the company. Drug and device makers, public health agencies and researchers buy subscriptions to Truveta Studio and Truveta Intelligence with access to row-level de-identified data, and Truveta Evidence Services sells study design, analysis and regulatory submission support. Live Link, which joins a customer's own data to Truveta Data, includes the Expert Determination review at no extra cost.

The ownership structure shapes where the money goes. The 30 member health systems own the company, and Truveta says members are paid when their de-identified data is used in other organizations' research. Seventeen health systems, Regeneron and Illumina invested $320 million in preferred equity in January 2025.

Coverage is broad and confined to research. Data comes from more than 900 hospitals and 20,000 clinics across 30 US health systems, in all care settings, with notes, images, device records and more than a million linked mother and child pairs. Customers are drug and device makers, public health agencies, academic researchers and the member health systems, and published work covers cardiology, neurology, oncology, metabolic disease and public health surveillance.

Validation covers only part of this: the one published model evaluation is cancer staging in five cancers at one health system. Coverage is US only, and the publication guidelines name the settings left out: immigration detention, correctional, military and Indian Health Service facilities.