XCaliber Health

The models run the assistants, and the company also sells the data layer beneath them. Merlin deploys role-based AI assistants (Patient Navigator, Care Coordinator, Practice Navigator, Quality and Risk Analyst, AI Nurse) that converse with patients, schedule, route refills, execute referrals, submit prior authorizations and surface care gaps.

They sit on the XCaliber platform, whose Health Data Gateway provides read and write access to record data through FHIR and document extraction across Epic, Cerner, athenahealth and eClinicalWorks and is sold as an enterprise platform in its own right. With the models removed, the integration and data layer remains a product.

The Care Coordinator is sold on a promise of no omissions: it automates 'referral routing, post-visit follow-ups, chronic disease outreach, and waitlist recovery so nothing falls through the cracks'. That is a claim that the system misses nothing, and no review arrangement can make it true of software.

Some oversight is described: refill renewals are prepared and 'routed for provider approval with EHR write-back', the AI Nurse escalates 'to licensed staff within strict clinical guardrails', and 'every assistant action' is auditable. Other agents act on their own: prior authorization 'detects when auth is required, assembles clinical documentation, submits to the payer, and tracks status', and scheduling books by 'checking urgency'. The guardrails, escalation thresholds and which actions run without a person are not published.

The architecture is described in outline and no model is named. The platform is API-first and microservices-based, with the Health Data Gateway handling FHIR and document extraction and Merlin's assistants built on it; the home page says Merlin 'learns once and applies everywhere' as a single AI employee whose skills transfer across workflows, and the company has described blending generative AI with traditional machine learning and deterministic services. No foundation model or provider, version, evaluation method or accuracy figure for any assistant is published.

No party in the chain is named. The platform and Merlin pages describe the assistants, the Health Data Gateway and cloud, self-hosted and hybrid deployment, and the privacy policy mentions unnamed third-party vendors and service providers, but no model or model provider, hosting provider, speech or messaging service, or subprocessor list is published, and no retention or training terms for any provider are stated. The assistants speak with patients by phone and SMS and read and write record content, so several outside services are likely to handle patient data.

Scale figures are published without a named customer or method. The company has reported processing more than 8 million chart updates and generating more than 160,000 record updates a day across more than 700,000 patients, with its navigator saving providers an average of six hours a day on refills, and outcome figures including 80 percent less chart review time, prior authorization turnaround cut from 14 days to under 24 hours and 30 percent fewer no-shows.

The home page shows customer logos without results, and the Merlin page's statistics describe the industry problem rather than the product. No deployment is named against any figure, and no baseline or period is given.

General assurances only. The platform describes 'clean, enriched, and governed data', a trust architecture that is 'observable, auditable', and document intelligence that extracts content from labs, imaging, notes and attachments. The privacy policy covers site visitors and account holders, excludes customer content, and says personal information may be shared once de-identified or aggregated.

Nothing published states how long patient data or assistant transcripts are kept, whether customer data trains or improves the assistants, or whether entries the assistants write into the chart are marked as machine-authored.

HIPAA compliance is claimed and business associate status is not stated. The platform page lists HIPAA among its certifications and says each deployment model supports HIPAA compliance. The privacy policy (last updated 6 March 2024) says the company processes customer content 'solely on behalf of the customer' under the customer's agreement and excludes that content from the policy, which points to a processor role without naming it or the agreement. The assistants read and write patient records at scale, schedule, route refills and give foundational medical guidance to patients.

Certifications are claimed as the company's own and nothing can be retrieved to confirm them. The platform page lists 'HIPAA, SOC 2, and HITRUST certification' among the platform's features, and both the platform and Merlin pages say each deployment model 'supports enterprise-grade security, performance, and compliance (HIPAA, SOC 2)'; the Merlin page adds that every assistant action is auditable.

No trust center, SOC 2 report type or period, HITRUST level or certificate is published, and the two phrasings leave open whether the attestations cover the hosted service, the self-hosted software or both.

Symptom assessment and medical guidance are sold with no regulatory position stated. The Merlin page describes the AI Nurse as providing 'clinical triage support, device troubleshooting, and answers foundational medical questions all within strict clinical guardrails and immediate escalation to licensed staff', and lists Clinical Triage Support as a use case that 'assesses symptoms, provides foundational medical guidance, and escalates to licensed staff'; scheduling books appointments by 'checking urgency'.

No triage protocol is named, and nothing shows a clinician deciding the calls the assistant does not escalate, while the assistant itself gives patients medical guidance. The administrative assistants (scheduling, refills routed for approval, referrals, prior authorization, intake) raise no device question on their own.

Governance is stated as principle, with no framework, monitoring results or bias evaluation behind it. The Merlin page says every product and workflow 'operates within a unified trust architecture. Observable, auditable', that IT and compliance teams can trace every assistant action, and that the AI Nurse works 'within strict clinical guardrails'.

Several functions allocate attention among patients: outreach campaigns define cohorts and identify qualifying patients, the Quality and Risk Analyst surfaces care gaps and value-based care metrics, and the AI Nurse assesses symptoms. Nothing published says how those selections perform across patient groups, who reviews the guardrails, or what monitoring catches an assistant drifting from its scope; patients can be supported in preferred languages with no results by language.

Mechanisms exist to trace what an assistant did, and nothing stands behind its output. The Merlin page says IT and compliance teams 'can trace every assistant action with full visibility and guardrails', and refill renewals go to a provider for approval before they are written back. No error rate, confidence threshold or evaluation method is published for any assistant, and no warranty, indemnity or remediation commitment is described.

The assistants write into the record at volume (the company has reported more than 160,000 record updates a day), submit prior authorizations and give patients medical guidance, so a wrong entry or answer persists and is relied on.

Named two-way integrations with the major record systems, documented where a buyer can open them. The platform page states 'proven integrations with Epic, Cerner, athena, eCW, and payer systems' and describes the Health Data Gateway as giving 'complete read/write access' to record data and clinical documents; a public FHIR Resource Catalog lists the resources supported per record system (athenahealth among them); the Merlin page says the assistants operate within athenahealth, with refill renewals written back to the record. The company is listed on the athenahealth and AVIA marketplaces, and reports generating more than 160,000 record updates a day.

Deployment options are stated; where the hosted option runs is not. The platform and Merlin pages offer cloud-native SaaS, self-hosted and hybrid deployments. Under a self hosted deployment, the record data stays inside the customer's own infrastructure, which settles residency for that option. For the hosted service, no provider, region, tenancy or subprocessor is named, and the privacy policy says authorized users may use the service from anywhere in the world. Nothing says where language model inference runs under each option, which decides whether chart content leaves a self-hosted site.

No price is published, and the shape of the offer is discoverable. XCaliber sells Merlin's role-based assistants and the underlying platform and Health Data Gateway to health systems, practices and health technology companies through a demo, with cloud, self-hosted and hybrid deployment options. The privacy policy refers to a self-service sign-up for the software-as-a-service offering, but no plan or price is shown. The company announced a $6.5 million seed round in May 2026 to expand its sales motion.

The work centers on patient access and practice operations. It spans scheduling and rescheduling against live record availability, refill coordination routed for provider approval, referral execution, patient registration and intake, prior authorization detection and submission, and after hours handling of routine requests.

Coverage is claimed broadly, across ambulatory practices, health systems and health technology companies and five assistant roles from front desk to nursing and quality, with care settings described as 'every care setting'. Nothing validates it by setting: no customer is named against a workflow or result on the vendor's pages.