VigiLanz

The core engine evaluates configurable rules, and Inovalon describes it as flexible, rule based AI and the product as AI powered surveillance; those phrases describe rules, not a learned model. A learned component is present as an add on: Inovalon's product page offers a Bayesian dosing calculator powered by DoseMeRx, embedded in the pharmacy surveillance application since an October 2025 collaboration, and a population model updated on a patient's measured levels is a model estimated from data.

It is a feature layer on a product whose value stands without it, since surveillance, stewardship and reporting run on rules. The AI label describes the rules engine; the one learned model is licensed from DoseMe.

Alerts reach a pharmacist who reviews and intervenes, with the platform never acting on an order. Rules are customer configurable, with Inovalon's clinical experts helping build them, so the institution controls what fires, and Inovalon frames the goal as helping teams focus on preventing harm instead of reviewing endless records, which is an explicit statement that the product exists to triage attention.

That framing makes the missing measurement conspicuous: Inovalon publishes no alert burden per patient day, no override rate and no proportion of alerts resulting in a pharmacist intervention. Delivery of alerts directly into the record system is a real workflow strength, since an alert a pharmacist must leave their system to see competes for attention it may not win.

The approach and the supplier are named. VigiLanz evaluates configurable rules against premapped data from the hospital's record system, Inovalon's clinical experts help customers build the rules, and the one learned model, a Bayesian dosing calculator, is named as DoseMeRx. A hospital configuring its own alert criteria can read every criterion behind every alert.

Inovalon publishes no technical documentation of the shipped rule library, no validation methodology for supplied rules, no version or update practice, and nothing on how the DoseMeRx component behaves inside the application. The labeling works against the disclosure: describing configurable rules as rule based AI and the platform as AI powered surveillance gives a reader a less accurate picture of the mechanism than the design warrants.

The model provider is named: Inovalon offers a Bayesian dosing calculator powered by DoseMeRx inside the pharmacy surveillance application, and the rest is a configurable rules engine the hospital can read. The data terms are partly published through Inovalon's provider business associate agreement: every subcontractor handling PHI must accept the same restrictions by contract, and PHI is destroyed within twelve months of the agreement ending.

The same agreement answers the secondary use question in Inovalon's favor rather than the hospital's: it permits data aggregation and permits de identification to enable the capabilities of Inovalon's platform and services, and de identified data falls outside the agreement.

The platform ingests near real time admission, medication administration, laboratory, microbiology and medication history data, and Inovalon's acquisition rationale in 2024 cited clinical data connectivity for its wider business, so nothing in the published terms keeps de identified surveillance data out of Inovalon's data and life sciences products. No hosting provider or subprocessor list is published.

Inovalon cites VigiLanz as Best in KLAS for pharmacy surveillance eight years running, a market signal about customer satisfaction rather than evidence of clinical benefit. The product page names customers with testimonials, including Cincinnati Children's Hospital Medical Center, Freeman Health System, Holmes Regional Medical Center, Riverside University Health System and Inspira Medical Center Mullica Hill, and describes uses such as clearing penicillin allergy labels and oral corticosteroid streamlining, without figures or method.

No peer reviewed outcome study, controlled evaluation, published alert validity data or measurement of adverse drug events avoided is published. Twenty five years in market is an operational track record, not a measure of benefit, and the parent's scale in healthcare data makes the absence of published outcome analysis more notable rather than less.

Inovalon publishes categorical commitments through its provider business associate agreement without a retention schedule for the life of the service. PHI is destroyed no later than twelve months after the agreement ends, including by subcontractors; genetic information is not used for underwriting; no remuneration is taken for marketing communications without authorization; and de identification follows the federal standard.

The same agreement permits data aggregation and de identification to enable the capabilities of Inovalon's platform and services, so de identified surveillance data may be used beyond the hospital's own alerting. The platform ingests near real time admission, medication administration, laboratory, microbiology and medication history data across acute, ambulatory and other settings.

What is not published is how long data is kept while the service runs, and whether identifiable or de identified data trains any model. Nothing is published on safety engineering either: how a rule that has gone stale, or a wrong dose from the DoseMeRx add on, is detected and corrected.

The business associate agreement is published in full at an open URL, inovalon.com/provider-business-associate-agreement (July 2024), and applies to every service a customer orders from Inovalon Provider, Inc., the entity that sells the Provider Cloud products including VigiLanz, so one set of terms covers every tier. It binds subcontractors: section 2.4 requires every subcontractor that receives the customer's PHI to accept the same restrictions by contract.

It also sets breach and security incident notification under the federal breach rule, access, amendment and accounting obligations, and destruction of PHI no later than twelve months after the agreement ends. Two clauses carry weight: section 3.6 permits Inovalon to use PHI for data aggregation services, and section 3.8 permits it to deidentify PHI to enable the capabilities of its platform and services, after which the data is no longer PHI. The ONC certification listing names VigiLanz Corporation alongside Inovalon, and the agreement covers only services ordered from Inovalon Provider, Inc.

The outside check published is a certification of the software's features. Inovalon's product page lists VigiLanz's ONC Health IT certification (Drummond Group, certificate 15.04.04.2953.Dyna.17.01.0.230623, certified June 2023, active), which includes the privacy and security criteria for authentication, auditable events, audit reports, end user device encryption, credential encryption and multi factor authentication, with real world testing plans and results published for 2022 to 2025.

That certification tests what the software can do, not how Inovalon operates it. No SOC 2 report, HITRUST certification, ISO 27001, trust center, penetration testing cadence or vulnerability disclosure program is published for VigiLanz or for Inovalon as its operator. The HITRUST certification quoted in the DoseMe collaboration announcement belongs to DoseMe's own dosing platform, not to VigiLanz.

No device clearance is claimed and none would be expected for rules based surveillance alerting, which sits within the statutory exclusion for non device clinical decision support because a clinician can inspect the criteria that produced the alert. That reviewability argument is strong for a configurable rules engine.

The complication arrives with the DoseMeRx dosing add on, since computing an antibiotic dose is a different regulatory act from raising an alert and is the function regulators have treated as a device function for some dosing software. Which entity carries regulatory responsibility for that integrated component, and on what basis, is not addressed publicly by Inovalon.

Inovalon publishes no performance reporting by patient characteristic, no bias assessment, no rule validation methodology and no post deployment monitoring statement for VigiLanz. The governance exposure in configurable rules is easy to underrate because the rules are transparent.

Rules encode thresholds, thresholds drawn from one population applied to another produce systematically different alerting, and a rule that has become wrong as resistance patterns, formularies or practice changed keeps firing with the authority of the institution that wrote it. Nothing published describes tooling for identifying rules that fire frequently without ever changing care, or how the DoseMeRx dosing add on is evaluated across patient groups inside the application.

Alerts reach a pharmacist who reviews and intervenes, and the platform never acts on an order. That review before commit is where the protection sits, and a hospital configuring its own alert criteria can read every criterion behind every alert. Nothing stands behind the output from the vendor's side.

No validation methodology for the shipped rule library is published, no account of how supplied rules were tested before distribution, no accuracy figure for the DoseMeRx dosing add on is cited by Inovalon, and no warranty, indemnity or remediation commitment is published. The AI labeling matters here in a practical way: a buyer who believes a component learns will test it for drift and ask about training data, while a buyer who knows it evaluates rules will audit the rules.

Interoperability is the platform's core competence. It ingests near real time admission, medication administration, laboratory, microbiology and medication history data regardless of which record system a hospital runs, with data premapped so clinical criteria can be applied without the hospital building the mappings, and pharmacy alerts appear directly in the record system for acknowledgment.

Standards conformance has external checks: VigiLanz is ONC certified for electronic health information export and for antimicrobial use and resistance reporting to the national surveillance network, is a validated NHSN reporting vendor, and publishes its annual real world testing plans and results. Named customers include Cincinnati Children's, Freeman Health System and Riverside University Health System. No record system is named as an integration partner, and no FHIR conformance statement or public interface documentation is published.

Delivery is cloud based software as a service within Inovalon's Provider Cloud, serving acute, post acute and ambulatory facilities from a United States company to United States customers, so the location is implied rather than committed. Inovalon publishes no hosting provider, cloud region, data residency commitment or description of degraded behavior when feeds are interrupted, which matters for a system whose value is continuous monitoring.

The DoseMeRx add on is DoseMe's platform embedded in the application, and where it processes dosing data is not stated. The 2024 acquisition adds a practical question for existing customers: whether the platform runs on its original infrastructure or is being consolidated into Inovalon's, and what that means for interface stability.

How VigiLanz is sold and what drives the cost can be established before contact, though no price is published. Inovalon's product page sets out tiers by facility type: a Starter tier for small and critical access hospitals, the standard and Pro tiers for acute care, and a separate Ambulatory Surveillance product, with add ons including the DoseMeRx dosing calculator and the NINJA pediatric kidney injury program.

The ONC certification disclosure on the same page states that the certified product requires a one time implementation fee and an annual licensing fee. No figure, unit rate or contract term is published.

Setting coverage spans acute, post acute and ambulatory care, reflected in Inovalon's product tiers: a Starter tier for small and critical access hospitals, standard and Pro tiers for acute care, and a separate Ambulatory Surveillance product for outpatient populations. Pediatric use is supported by the NINJA add on for nephrotoxic kidney injury monitoring, developed with Cincinnati Children's.

Functional coverage spans pharmacy surveillance, infection prevention and control, antimicrobial stewardship, quality improvement and patient safety event reporting, with intravenous to oral conversion, transitions of care and antibiogram trending. Coverage is United States only and depends on the tier purchased, and ambulatory and post acute use are described more thoroughly than they are evidenced in named customers.