Waystar

The second reference case for this grade, alongside Elation Health, and it is descriptive rather than critical. AltitudeCreate, AltitudePredict, and AltitudeAssist are genuine shipping AI products, but what a provider organization buys is a revenue cycle platform that clears claims; the AI accelerates workflows inside a system whose value stood before it. No organization purchases Waystar for AltitudeAI alone. That is the material fact when weighing bundled incumbent AI against a specialist tool such as Tennr or Plenful.

The autonomy claim is unusually strong and the oversight disclosure unusually thin, which is the combination this axis penalizes. The company describes AltitudeCreate as autonomously generating appeal letters, documents that are submitted to payers and constitute assertions about medical necessity and coverage. No published review step, confidence threshold, escalation path, or accuracy rate for generated appeals was retrieved.

A buyer should establish who reviews an autonomously drafted appeal before submission, what happens when one contains an error, and whether the 1,100 payer specific templates constrain the generation or merely seed it.

Unusually specific about what the models are for and what goes into them, and silent on how well they work.

The approach is a hybrid: an automated rules engine with machine learning layered over the transaction flow, using predictive scoring trained on the billions of transactions the platform carries. Applications are named individually rather than gestured at: predicting the likelihood a denied claim appeal will succeed, using patient benefits, procedure performed, payer involved and codes used; discovering missing charges; aligning claim status and escalation with expected remittance timing; prioritising work queues by expected value; predicting the likelihood a patient qualifies for charity care; and behaviour modelling applied to patient collection costs.

The data elements feeding these models are also named, and that disclosure is rare enough to credit even though its content raises questions addressed on the governance axis: demographics, geography, diagnosis and prognosis, care provider, and counterparty details.

Outcome figures are published for the generative features, including a reported increase of more than 40 percent in appeal overturn rates and 85 percent auto approval on prior authorisation submissions.

Held at B because none of it is validated. No accuracy or precision figures, no confidence thresholds, no model architecture, and no external evaluation. Naming what a model is used for and what it consumes is genuine transparency; it does not establish that the model is right.

The control environment is the strongest in this category: a healthcare security certification, an audited service attestation, payment card certification at the highest service provider tier, validated point to point encryption, named external security vendors, and a workforce located entirely in one country.

The company also publishes what its business associate agreements must contain, which is more than most peers disclose about the instrument itself and lets a counterparty prepare before negotiating. The volume sets the stakes and should be stated plainly, since transaction data spans roughly half the patients in the country. Two questions are left open and both follow from disclosures the company itself makes rather than from anything inferred.

The first is pooling: insights derived from every transaction are embedded into platform updates deployed across the entire client base, so one organisation's transaction data demonstrably improves a product used by its competitors, that is the stated design, and no opt out is described. The second concerns the patient rather than the client.

Among the named model inputs are demographics and geography, and among the named applications are predicting whether a patient qualifies for charity care and modelling patient behaviour to align collection costs. Those are determinations about individual people who are not the customer, did not choose the vendor, and have no visibility into the assessment, and nothing published describes what governs them. Ask whether pooling can be declined, and what a patient can learn about a charity care determination.

Operational figures are specific, recent, and tied to defined workflows rather than asserted generally: appeal package creation reported three times faster with about 16 minutes saved per package, a roughly 70 percent time reduction, and denial prevention recommendations compressing a three day process to approximately three minutes. Network scale is corroborated by the company's public filings at more than six billion annual transactions across a reported one million providers. Held back from A because the figures are vendor measured without published methodology or an independent comparison, and time saved is an input metric rather than a recovery outcome.

The control environment is the strongest in the revenue cycle category. HITRUST CSF certification, a SOC 2 Type II examination under SSAE 18, PCI DSS Level 1 Service Provider status, validated point to point encryption, named external security vendors, and a workforce located entirely in the United States. The company also publishes what its business associate agreements must contain, which is more than most peers disclose about the instrument itself.

The volume is extraordinary and worth stating plainly, because it sets the stakes: transaction data spanning roughly half of all patients in the United States.

Two stewardship questions are left open, and both follow from disclosures the company itself makes.

The first is pooling. Insights derived from every transaction are embedded into platform updates deployed across the entire client base, so one organisation's transaction data demonstrably improves a product used by its competitors. That is the stated design, and no opt out is described.

The second concerns the patient rather than the client. Among the named model inputs are demographics and geography, and among the named applications are predicting whether a patient qualifies for charity care and modelling patient behaviour to align collection costs. Those are determinations about individual people who are not the customer, did not choose the vendor, and have no visibility into the assessment. Nothing published describes what governs them.

The clearest HIPAA disclosure in this index, and it takes the hardest of the three routes to a top grade: publishing both roles and the switch between them.

The company states that it is a covered entity when providing clearinghouse services and a business associate, or a subcontractor to one, when providing software solutions to providers and revenue cycle companies. Most vendors state one role or neither. Getting this right matters practically, because a covered entity carries direct regulatory obligations while a business associate's flow through contract, and a buyer needs to know which applies to which service it is purchasing.

It goes further and publishes what the agreements must contain: written assurances on how protected health information will be used and disclosed, implementation of administrative, physical and technical safeguards, equivalent agreements with agents and subcontractors, reporting of security incidents and improper disclosures, and assistance to the client with its own HIPAA duties.

The surrounding regulatory disclosure is equally specific, covering breach notification timelines, the substance use confidentiality rule at 42 CFR Part 2, the reproductive health privacy rule and its attestation requirement, and the online tracking technology guidance.

One caveat kept in view. This is compelled disclosure under securities law rather than voluntary publication, and the same facts would be far harder to obtain from a private competitor.

A broad certification set appropriate to a company processing payment data as well as clinical data, and all of it stated by the company itself in its annual report on Form 10-K rather than inferred from directory listings.

HITRUST CSF certification, received in 2021, with the assessor named as Coalfire in the company's own announcement. A SOC 2 Type II examination under SSAE 18, with the type specified rather than left ambiguous, which is the disclosure most vendors in this index get wrong. PCI DSS Level 1 Service Provider status, the highest tier of that standard, together with validated point to point encryption covering the card payments the platform initiates. External security auditors and vendors are named rather than referred to generically.

The source is worth noting because it is unusual. A filed annual report is a legally attested statement rather than marketing copy, so it carries more weight than a trust centre page, not less.

Two limits keep this honest. The HITRUST level is not specified, and the difference between the entry tier and the risk based tier is material enough that a buyer should ask. And there is no public trust centre, so current certificates, audit dates and scope cannot be self served; they have to be requested.

Grade corrected on 26 July 2026. The previous note recorded these certifications as reported only by third party listings and held the grade back for that reason. The company states them directly in its own filings, so the stated basis for the deduction was mistaken.

Graded against the regimes that actually govern healthcare payments, since the FDA has no jurisdiction. On that basis this is the strongest regulatory position in the revenue cycle category, and it rests on a status difference rather than on paperwork.

Waystar is directly regulated rather than merely contractually bound. It states that it is a covered entity under HIPAA when providing clearinghouse services, and a business associate or subcontractor to one when providing software to providers. Most vendors in this category are business associates only, which means their obligations flow through a contract with a customer. A covered entity answers to the regulator itself.

It also operates under the HIPAA electronic transaction standards, which mandate the formats used to submit claims to any payer, government or private, and it holds PCI DSS Level 1 Service Provider status with validated point to point encryption for the card payments it processes.

The published regulatory self assessment is the most complete in this index for a non clinical vendor, mapping exposure across the Anti Kickback Statute, the False Claims Act, the Civil Monetary Penalties Law, the Stark Law, state fraud and abuse laws, corporate practice of medicine and fee splitting rules, and consumer protection statutes including the Fair Debt Collection Practices Act, which it identifies as applying because it assists clients in collecting amounts owed by patients.

One honest caveat. This detail exists because securities law requires it of a listed company, not because the company chose to volunteer it.

No bias evaluation, subgroup analysis, model validation methodology, independent audit or governance framework is published. In most records that is an ordinary gap. Here it sits directly against two disclosures the company makes about its own models, which is what holds the grade at C rather than higher.

The first is the input set. Demographics and geography are named among the data elements feeding the predictive models.

The second is the application. The models are used, among other things, to predict the likelihood that a patient qualifies for charity care in order to drive pre service financial intervention, and to perform behaviour modelling that aligns patient collection costs.

Read together, that describes a system using demographic and geographic signals to make consequential determinations about how individual patients are approached financially.

The direction matters and should not be assumed. Identifying a patient who qualifies for financial assistance earlier is a real benefit, and getting help to people who would otherwise never apply is a good outcome. The same prediction pointed the other way sorts patients by expected recovery and allocates collection effort accordingly. Geography in the United States is a close proxy for race and income, so a model that performs unevenly across groups would distribute both the benefit and the burden unevenly.

Nothing published says which direction the intervention runs, whether accuracy varies across groups, or whether anyone has looked. Those are the questions to ask.

This record is unusually specific about what the models are for and what goes into them, and silent on how well they work. The applications are named individually rather than gestured at, covering prediction of whether a denied claim appeal will succeed, discovery of missing charges, alignment of claim status with expected remittance timing, work queue prioritisation by expected value, prediction of whether a patient qualifies for charity care, and behaviour modelling applied to patient collection costs.

The data elements feeding them are also named, covering demographics, geography, diagnosis and prognosis, care provider and counterparty details. Naming inputs and purposes together is rare and is genuinely useful, because it lets an affected party reason about a determination: a patient told they did not qualify for charity care can at least ask whether geography and demographics contributed. Held at C because none of it is validated.

No accuracy or precision figures, no confidence thresholds, no architecture and no external evaluation, and no warranty, indemnity or remediation commitment. Published outcome figures describe appeal overturn improvements and auto approval rates, which measure throughput rather than correctness. Naming what a model is used for and what it consumes is genuine transparency; it does not establish that the model is right. Ask for precision on the charity care model specifically, and what recourse a patient has against its output.

Reach is the defining asset. The payments network is reported to process more than six billion transactions annually for approximately one million providers, touching roughly half of US patients, which gives the predictive models a data advantage a point solution cannot assemble. Integration spans provider systems and payer connections rather than a single EHR.

The first vendor in this category to actually name where the data sits. Infrastructure spans co located data centres together with Microsoft Azure, Amazon Web Services and Google Cloud Platform environments. The architecture is single instance and multi tenant, built on an event driven microservices design developed in house, with fully virtualised hosting, multiple layers of redundancy and a published availability figure above 99.9 percent. All employees are located in the United States, which is a data handling fact as much as an employment one.

One architectural point matters for comparison and cuts against some peers. This is a multi tenant platform whose value depends on pooling. The company states that every transaction processed generates insights across providers, patients and payers which are then embedded in updates deployed across the whole client base. That is the opposite of the per customer model boundaries other vendors in this category advertise, and it is a deliberate design rather than an oversight, since the network effect is the product.

Held at B because naming three cloud providers is not the same as stating residency. Which workloads run where, in which regions, is not published, and there is no subprocessor list. A buyer should also establish what pooling means for its own data specifically, and whether any opt out exists.

The most complete commercial disclosure in the revenue cycle category, and it exists for a structural reason worth understanding before reading it as virtue: Waystar is listed on Nasdaq, and securities law requires what private competitors are free to withhold. Same mechanism that makes Artrya the benchmark on this axis.

The pricing mechanism is published. Contracts generally combine a subscription fee with a volume based component, though some carry only one, with the subscription providing fixed recurring revenue and the volume element rising as a client sees more patients. More than 99 percent of revenue is either recurring subscription or based on predictable volumes.

The contract terms are published too, and this is the part that is almost never available elsewhere. Initial terms run two or three years. Renewal is automatic for successive one year terms, and those renewals carry standard price escalators. Billing is monthly. Clients may terminate with limited notice.

An escalator on automatic renewal is exactly the clause that surprises buyers in this category, and here it can be read before negotiation rather than discovered during it.

Concentration is disclosed as well: the top ten clients accounted for 11.2 percent of 2024 revenue, 98 percent of that revenue came from clients already under contract at the start of the year, and net revenue retention was 110.1 percent. The published market sizing even states its own method, applying average pricing by product across provider settings.

What is still absent is the rate. No price list, no per transaction figure, no subscription tier. A buyer can model the shape of the deal precisely and still cannot tell what it will pay.

The broadest reach of any vendor in the revenue cycle category and among the broadest in this index. More than 30,000 client organisations representing over one million distinct providers, spanning physician practices, clinics, surgical centres, laboratories, hospitals and health systems, and including 16 of the top 20 hospitals in the US News rankings.

Scale is disclosed with a denominator rather than asserted. More than six billion transactions in 2024 carrying over $1.8 trillion in gross claims value, covering roughly half of all US patients. Revenue splits approximately 30 percent hospitals and health systems to 70 percent ambulatory and alternate sites, which tells a buyer where the product is actually proven rather than where it is sold.

Functional coverage runs the full payments workflow, from pre service eligibility and prior authorisation through claims submission, remittance, denial recovery and patient collection. Integration breadth supports it, with more than 500 electronic health record and practice management systems and over 200 channel partners.

One scoping note for comparison against the rest of this index. This record covers the AltitudeAI capabilities rather than the underlying payments platform, under the product scoping rule, but the coverage above is what those capabilities are deployed across.