xCures

The models drive the core module, and the platform carries other value. The Clinical Clarity Engine uses two large language model approaches, schema based extraction and checklist based assertion with retrieval augmented generation, to turn retrieved records into structured data and answers to clinical questions (trust page). That structuring does not exist without the models.

Record retrieval itself, through health information exchanges, national networks, direct record connections and traditional record requests, is a service with value of its own, and the retrieved source documents are delivered alongside the structured output. Remove the models and a record retrieval service remains.

A completeness claim about the product's own output. The site's provider line promises "the full patient history for every case", while the trust page's own known limitations say retrieval reads the top ranked documents and not the rest, so relevant information in lower ranked documents can be missed. A buyer who takes the line at its word has no reason to look for what the Engine left out, and source links cannot show an omission.

The structure around the output is otherwise described: a deployment threshold (accuracy and precision of 95 percent or more before an extractor or checklist enters production), human review of extractions against source documents with a third reviewer for disagreements, real time monitoring, version control with rollback, and a source link on every output. What is not published is the point at which an individual answer is withheld or routed to a person.

The approach is named in detail and the models are not. The trust page describes schema based extraction (named entity recognition and relation extraction, normalized to FHIR R4 and OHDSI vocabularies) and checklist based assertion (retrieval augmented generation with an evidence hierarchy, such as a pathology report over a clinic note for staging), a performance table, a deployment threshold, version control with rollback and A/B testing across prompts, models and settings, and known limitations. No language model, model family or version is named, and the training or tuning data is not characterized, so a buyer cannot tell which model produced an answer or when it changed.

The host is named and the model provider is not. The trust page names AWS as the infrastructure and Datadog for audit logging, and describes two large language model approaches with A/B testing across models, without naming the model provider or providers. No subprocessor list is published, and nothing states the retention and training terms that govern record text once it reaches a model.

Published research short of independent validation. The extraction method is reported in a medRxiv preprint, "A Scalable Method for Validated Data Extraction from Electronic Health Records with Large Language Models" (Stuhlmiller et al., posted February 2025), whose authors are all xCures employees or paid consultants: on a validation cohort of 34 patients and 5,789 medications the medication schema reached about 95 percent accuracy and F1 across seven fields, and a deployment cohort of 11,115 patients yielded 2.6 million medication records.

The trust page reports four extractors at 95.7 to 98.2 percent accuracy from a random 10 percent audit, described as retrospective. The peer reviewed items on the research page are clinical analyses that use xCures data, not evaluations of the Engine.

Retention is stated and the use of de identified data is unbounded. The Privacy and Security Notice (effective 1 September 2026) says xCures keeps de identified information in perpetuity, may use and disclose it for any purpose, and may transfer it outside the United States; identifiable information is kept as long as needed to provide the services and comply with law, and xCures says it will never sell identifiable information or share it for marketing without consent.

However clearly it is worded, that is a grant to use and share data derived from patients' records. Nothing states whether record text sent to a language model is kept or used for training by the model provider. On safety engineering, the trust page publishes its hallucination scoring rule and two known limitations, extraction errors from poor scans and documents missed by semantic search; no account of how a safety event is handled is published.

Business associate status is stated and supported by a substantive privacy document, and the agreement is not published. The trust page says xCures operates as the customer's business associate and conducts an annual HIPAA evaluation, with further assessment through its HITRUST certification program.

The Privacy and Security Notice (effective 1 September 2026) says xCures acts as a business associate on behalf of health care providers, and that protected health information it receives that way is used and disclosed as those providers' notices, its business associate agreements and HIPAA allow. The agreement, its tier and whether it binds subcontractors are not published.

A recognized certification is named without the artifact. The trust page says the Engine received HITRUST i1 certification in 2026, and lists encryption in transit and at rest, role based access with least privilege, multi factor authentication and single sign on, and immutable audit logging through AWS and Datadog with security monitoring.

The HITRUST r2, ISO 27001:2022 and SOC 2 Type 2 marks on the page belong to AWS, the hosting provider, and xCures says its own certification inherits selected AWS controls; those marks are the host's own, not the company's. No certification letter, scope or date beyond the year is published.

No device claim is made and no regulatory position is stated. The Engine structures records and answers clinical questions, such as cancer stage at initial pathological diagnosis, for clinicians and other users, and every answer cites the documents it rests on and the rule used to resolve conflicts, so a reader can check the basis. That is the kind of reviewable basis clinical decision support outside device regulation relies on, and the company does not state that reasoning. The Terms of Service (effective 1 June 2021) describe an earlier service that helped patients with advanced cancer and their physicians discover treatment options.

A governance process is published with named steps, and no results by group. The trust page sets out the lifecycle every extractor follows: independent review by clinically trained reviewers against source documents, classification of each field as a true or false positive or negative, arbitration by a third reviewer with clinical experts, a scoring rule that counts an extraction as correct when the source states it explicitly, edge cases fed back into prompts and retrieval, and version control with A/B testing across prompts, models and settings.

It also publishes known limitations. No accuracy is reported by patient group, care setting, document source or record quality, although the published scan quality limitation points at where it would differ: faxed and scanned records are more common in smaller practices.

A published error rate with its method and denominator. The trust page cites the company's preprint (Stuhlmiller et al., medRxiv, 2025), which reports about 95 percent accuracy for the medication schema on a validation cohort of 34 patients and 5,789 medications, and the page adds a four extractor table from a random 10 percent audit with third reviewer arbitration, stating that the figures are retrospective and do not guarantee future performance.

Every extracted element links to its source document, which lets a user challenge an output. The Terms of Service (effective 1 June 2021) disclaim any warranty of accuracy or completeness and have users indemnify xCures. No commitment attaches to the output itself.

Named networks with read access, not bidirectional record system integration. xCures retrieves records through health information exchanges, qualified health information networks, direct record connections and traditional record requests, and returns structured data as FHIR R4 through a public API. The Privacy and Security Notice says that for exchange through TEFCA xCures does not provide bidirectional services. No named record system integration writing back into the chart, and no marketplace listing, is published.

Options and residency are stated, with isolation left open. The Engine is offered as a platform with a secure web portal or embedded through the public API, and runs on AWS. The Privacy and Security Notice commits that identifiable information is stored in data centers located in the United States, and says de identified information may be transferred outside the United States. Tenant isolation, and whether record text reaches a language model outside xCures's own AWS environment, are not published.

No price is published, and the posture is discoverable. xCures sells the Clinical Clarity Engine as a platform and portal or embedded through its API, to providers, diagnostics laboratories, value based care organizations and channel partners, and licenses de identified real world data separately; the API documentation is public, so an integrator can size the work before a sales call. No price, tier or unit of charge is published.

Coverage is named with validation behind part of it. The site sells to providers, diagnostics laboratories, value based care organizations and channel partners, and describes the Engine as working across conditions. The published validation is oncology shaped: medications, surgical procedures, cancer diagnosis and lines of therapy, with oncology data aligned to the HL7 mCODE profile. Performance in other specialties is not published.