Vera Health

The product is the model and the retrieval stack around it. Vera answers a clinician's question by searching a corpus the company gives as more than 60 million peer reviewed papers, guidelines and care pathways, ranking what is relevant, applying evidence grading logic and then generating a short answer with inline citations. The company owns no authored corpus, sells no workflow tooling and ships no device, so remove the model and the retrieval layer and nothing saleable remains: the literature is public, and the act of turning it into an answer is the model's.

The features around search (differential diagnosis and treatment plan views, clinical calculators, quick curbside questions, specialty updates) are built on the same engine. The ACEP partnership places ACEP clinical policies inside the corpus, which is content, not a separate product.

The oversight structure is described and one part is missing. Every key statement in an answer links to its original source so the clinician can read the evidence, evidence grading is applied before generation, and the product describes itself as clinical decision support that the clinician uses to document their own reasoning. The home page offers separate views for differential diagnosis, treatment planning, clinical calculators and quick curbside questions, so the kind of output is chosen by the clinician.

What is missing is what the system does when the evidence is thin, absent or in conflict: no abstention behavior, no prompt for missing patient context, and no published grading rubric showing whether a weakly supported answer is visibly marked as one. The differential diagnosis and treatment plan views make that gap more consequential than it is for a literature summary.

No absolute accuracy claim is made by the company; the council chair's quote that the product stands out for its accuracy is a quality claim.

How the search works is laid out in real terms; what runs underneath it is not identified. The FAQ describes a purpose built medical search engine that searches more than 60 million peer reviewed papers, guidelines and real world care pathways, ranks what is most relevant, applies evidence grading logic the company likens to a guideline methodologist's, and only then generates a concise answer with inline citations, positioned against assistants that generate first and look for citations afterward.

No model class, model provider or version is named, no release notes say when the model or the ranking changed, and the evidence grading rubric, its scale and a worked example are not published. The home page's comparison chart names no benchmark, date or protocol.

The architecture is described and no model provider is named. The product generates answers with AI systems the company says it provides, so a clinician's question reaches a model, and neither the model nor any provider is identified on the home page, FAQ, privacy policy or business associate agreement.

The privacy policy names recipient categories rather than parties: hosting, technology and communications providers, security consultants, support vendors, advertising partners and analytics partners. It states that written agreements with all of them limit their use of personal data to the services they provide, that personal data is not used to train the company's AI systems, and that a list of processors is available on request rather than published. Services are hosted in the United States. Aggregated, de identified inputs and outputs may be shared with business partners and research organizations, a second, outward flow.

The business associate agreement binds any subcontractor with access to protected health information to the same restrictions.

Named partners and vendor reported percentages with no method, denominator or reference standard. The home page's bar chart shows the product at 62.2 percent against three unnamed comparators at 19.7, 21.3 and 37.3 percent, with no benchmark, date or protocol on the chart; the company's other materials have given 97.5 percent on USMLE questions, 84.9 percent on a New England Journal of Medicine question set and 62.2 percent on MedXpertQA, all run by the company. No peer reviewed or independent evaluation of the product appears in PubMed.

Two real third party relationships exist and neither measures the output. The American College of Emergency Physicians partnership, announced in March 2026 and quoted on the home page by ACEP's chief medical officer, places ACEP clinical policies inside the product. The clinical council of sixteen named physicians gives editorial and governance input. The council chair is quoted saying the product stands out for its accuracy, which is an endorsement rather than a measurement.

One clear commitment sits beside a disclosed use of what clinicians type. The privacy policy (last updated 15 July 2026) states that personal data is not used to train the company's AI systems, and commits to data minimization with encryption, access controls and anonymization or pseudonymization for data used in training.

The same policy says the company creates aggregated, de identified or anonymized data about physicians' use of the service, including access patterns, usage frequency and, in its words, Input and Output, which it may use or disclose for lawful business purposes, for instance sharing insights derived from it with business partners and research organizations. Advertising partners receive device and IP data, web analytics and IP based location for marketing, including interest based advertising where the user consents. Retention is stated only as long as necessary for the service or business purposes. The questions a clinician asks and the answers returned therefore become a shareable derived asset, which is a practice against the user however carefully the de identification is described.

Where a covered entity signs the business associate agreement, the agreement governs protected health information: return or destruction on termination with no copies kept, and de identified information the company creates belonging to the company. No safety engineering is published beyond retrieval first grounding: no guardrails policy and no process for handling a safety event.

The company states that it acts as a business associate, and the agreement itself is public. The privacy policy's HIPAA section says HIPAA applies to service providers like Vera Health in certain contexts and that, on request, the company will enter a business associate agreement with a covered entity or business associate. The full agreement sits at a public address, open to anyone before contracting, in a version last updated 27 October 2025. It is made with the business or person agreeing to it as a user of the services, so it is not reserved to an enterprise contract. It binds subcontractors too: the company must require any agent or subcontractor with access to protected health information to agree to the same restrictions and conditions.

The agreement also commits the company to mitigate known harmful uses or disclosures, to provide on request its most recent independent HIPAA compliance report (AT-C 315), HITRUST certification or other agreed third party audit report, and to return or destroy all protected health information on termination, including copies held by agents and subcontractors. Under one clause, deidentified information the company creates under the agreement belongs exclusively to the company, with the client free to create its own.

Which subcontractors those are is not published; the privacy policy offers the processor list on request.

The company names a recognized certification without publishing the artifact. The home page carries a SOC 2 Type II certified mark alongside HIPAA, GDPR and NIST AI RMF marks and links a trust center at trust.verahealth.ai. The business associate agreement commits the company to provide, on request, its most recent independent HIPAA compliance report (AT-C 315), HITRUST certification or other agreed third party audit report.

The trust center itself may show which reports exist, with their dates, auditor and scope, and whether they are released self serve or on approval. No penetration testing cadence or vulnerability disclosure program is published.

No device claim is made and no regulatory position is published, beside features that sit closer to the line than a literature summary. The FAQ calls Vera a clinical decision support search engine, and the home page offers differential diagnosis and treatment plan views alongside search and calculators. Generating a differential is a different act from reporting what the literature says.

The basis of each answer is reviewable: every key statement links to its source, which is what the clinical decision support exclusion in the 21st Century Cures Act turns on, and it keeps this at C with the gap named. No clearance, submission or analysis of where the differential and treatment plan features sit is published.

A governance framework with named process behind it, and no measurement. The home page carries a NIST AI Risk Management Framework mark alongside HIPAA, GDPR and SOC 2 Type II marks, and names an international clinical council of sixteen physicians chaired by Scott M. Silvers, formerly chair of emergency medicine at Mayo Clinic and chief medical officer for knowledge management at Optum Health, now chair of the ACEP Clinical Policies Committee. The FAQ describes transparent evidence grading logic applied before an answer is generated. A data processing addendum, a named data protection officer and an EU representative are published.

What is not published: the NIST risk assessment or any document showing what the alignment covers, a bias evaluation, subgroup results by specialty, population or question type, an error taxonomy, or an external audit. The evidence grading rubric is asserted and not shown. The one comparative figure on the home page is the company's own and carries no method.

Grounding to the published literature inherits that literature's coverage gaps, which fall along the population lines a bias evaluation would test. The chair and several council members carry the FACEP designation of the American College of Emergency Physicians, so the direction of the evidence grading comes substantially from one specialty.

Mechanisms exist that let a clinician challenge an answer, and nothing stands behind the output. The FAQ says every key statement is linked to its original source so a clinician can read the evidence and document their reasoning, and describes the retrieval first order (search, rank, grade, then generate) as the design meant to prevent citations gathered after the fact from hiding an error. That makes an answer checkable against its sources.

No accuracy or error rate with a method is published, and no warranty, indemnity or correction commitment attaching to an answer appears on the home page, FAQ, privacy policy or business associate agreement. The home page's bar chart places the product at 62.2 percent against three unnamed comparators at 19.7, 21.3 and 37.3 percent with no benchmark, date or protocol, and elsewhere the company has cited MedXpertQA for the 62.2 figure; a comparison no reader can reproduce is not an error rate. The business associate agreement's breach notification and mitigation duties protect patient data, not the correctness of an answer.

No integration evidence is published. The company's home page, FAQ, privacy policy and business associate agreement name no record system, marketplace listing, FHIR or HL7 conformance, or public API, and make no integration claim. The product is delivered on the web and as mobile apps and is used alongside the record rather than inside it; the privacy policy mentions third party integrations only in general terms.

Third party directories describe enterprise integrations with Epic, Cerner and MEDITECH at custom prices, but those listings come from aggregators, and nothing from the company says whether any integration exists or whether a customer is live on one.

A single hosted option with its data location committed. The privacy policy (last updated 15 July 2026) states that the services are hosted and operated in the United States by the company and its service providers and that personal data will be hosted on servers located there, with onward transfers outside the European Economic Area resting on adequacy decisions or standard contractual clauses. An EU representative and a data processing addendum are published, and the product runs on the web and as mobile apps.

Neither the hosting provider nor the cloud region is published, and nothing describes tenant isolation or any deployment inside a customer's own environment. The list of processors is not published either; the policy says it is available on request.

The clinician facing price is published and it is zero. The FAQ states that Vera is free for licensed clinicians and trainees, with unlimited searches and ongoing updates at no charge, on signing up with professional credentials. A clinician can see the full cost of the product they will use, and start, without speaking to anyone.

No institutional tier, pricing mechanism, rate card or implementation fee is published, so the tier a health system would buy is not priced publicly.

No revenue model is published. The privacy policy names advertising partners and interest based advertising for marketing, and allows aggregated, de identified inputs and outputs to be shared with business partners and research organizations. That is marketing analytics and derived data rather than advertising placed inside a clinical answer, though it leaves open who pays for a free tool that clinicians type into.

Coverage is named broadly, with depth concentrated in one specialty. The corpus is given as more than 60 million papers, guidelines and care pathways, with calculators, differential diagnosis and treatment plan views, and the home page's example questions span endocrinology, family medicine, oncology and emergency medicine. The FAQ describes use at the bedside or in clinic.

What stands behind part of that scope is emergency medicine: ACEP's clinical policies are in the corpus under the March 2026 partnership, the council chair chairs ACEP's Clinical Policies Committee, and the chair and several other council members carry the FACEP fellowship designation of the American College of Emergency Physicians. No evaluation by specialty, setting or question type is published, so availability across settings is established and demonstrated usefulness outside emergency medicine is not.