XpertDox

The engine is the product. Clinical documentation is extracted from the record system, a proprietary hybrid model assigns the codes, and claims are submitted, with the company describing minimal human supervision across the automated share. Nothing underneath would function without the model.

The business intelligence layer looks like a qualification and is not one. Dashboards, provider benchmarking and audit trails are substantial parts of what customers describe valuing, and they are reporting on the model's output rather than an independent product. The company also retains a manual review queue for claims the engine declines, which is the correct design for automated coding rather than a dilution of it.

Both boundary numbers are published and a review path sits behind them. More than 94 percent of claims are coded and submitted within 24 hours, which is the automated share, and the BI platform's manual review queue shows the claims flagged for a person with the reasons they were held; an audit trail records every change the engine makes. What happens to the charts the engine does not take is visible.

The home page also carries a comparison table placing competitors at lower automation, which is a claim about rivals rather than a disclosure about itself.

The routing rule is missing: nothing says what confidence level or claim type sends a chart to manual review rather than straight to submission, and no contractual commitment on automation rate, accuracy or turnaround is published. The complimentary first month lets a provider test the boundary on their own claims before relying on it.

The architecture is stated with some specificity. XpertCoding is described as hybrid AI combining ensemble models, neural networks and symbolic reasoning with payer guidelines, alongside natural language processing, and the company presents the hybrid design as its differentiator. Naming symbolic reasoning alongside neural components explains how payer specific rules can be enforced deterministically while the learned components handle the language.

Output scope covers CPT and ICD-10 with support for Category II performance codes, hierarchical condition categories for risk adjustment, and clinical documentation improvement. Turnaround is quantified: more than 94 percent of claims submitted within 24 hours and the remainder within 48. Model training period is stated at under one month.

Two gaps. No foundation model, model class or training data provenance is disclosed behind the word proprietary. And the accuracy figure has not been stable across the company's own materials: older material gives 95 percent within 12 hours and 98 percent within 24 hours, and the current home page says above 99 percent. Use the current figure with its date rather than treating it as settled.

The word proprietary is doing the work that enumeration should. The hybrid engine is described at the level of technique, ensemble models, neural networks and symbolic reasoning, and no party behind any of it is named: no foundation model provider, model class or version, no hosting arrangement, no subprocessor list, and no position on whether customer documentation contributes to model development.

One element of the architecture bears on provenance. Symbolic reasoning over payer guidelines suggests a rule layer maintained against published payer policy rather than learned from customer data, which would be a cleaner chain than a purely learned system, but the company does not say so. The privacy policy mentions service providers only for the website.

The ISO/IEC 27001 certification carries supplier and third party control requirements, so a control framework covering the chain exists even though its contents are not published.

Named customers are quoted on the home page with figures: Nao Medical reports a 15 percent increase in charge capture, a 60 percent increase in quality code capture, a 40 percent reduction in charge entry lag and a 22 percent reduction in claim denials; Quick Visit Urgent Care reports coding related denials below 1 percent; Urgent Care Pros reports a 20 percent charge capture increase; Cucamonga Valley Medical Group reports a 32 percent improvement in quality scores with one payer. The home page adds that its live figures are calculated from previously processed claims. None carries a date, baseline, period or method, so these are figures the vendor publishes from its customers rather than outcomes a buyer can test.

Third party presence is review platform and editorial listing rather than research: G2 reviews and badges, a 2024 Avia revenue cycle report and trade media company lists. No peer reviewed study or audited accuracy measurement against a gold standard is published, and nothing separates legitimate charge capture from level inflation.

The security side is specific and externally assessed, and the stewardship side is not answered. The Trust Center names ISO/IEC 27001, ISO/IEC 22301 business continuity and SOC 2 Type 2 certification, says XpertDox securely processes, maintains and stores protected health information in accordance with HIPAA, and describes access management, encryption, monthly workforce assessments, incident management and quarterly penetration testing. The privacy policy covers the website only and places protected health information under the business associate agreement signed with each client.

What is missing is what happens to clinical documentation inside the AI lifecycle: no retention schedule, no statement on whether customer documentation trains or improves the coding models, and no de identification position. Those are the questions a health system asks after the certifications are satisfied.

Business associate status is stated in plain words and supported. The privacy policy says protected health information processed through XpertDox's platform is governed exclusively by the business associate agreements executed with each client, and the Trust Center says XpertDox processes, maintains and stores protected health information in accordance with HIPAA, trains all staff on HIPAA monthly, and describes the access, encryption, incident and penetration testing controls behind it. Its SOC 2 Type 2 report is stated to cover the privacy criterion as well as security, availability and confidentiality.

The Trust Center lists HIPAA in the same row as its ISO and SOC 2 certifications; HIPAA has no certification scheme, so that entry is a compliance statement, not a credential. No business associate agreement or summary of its terms is published.

Three externally assessed credentials are stated as the company's own on a standing Trust Center linked from the navigation and footer: ISO/IEC 27001 information security management, ISO/IEC 22301 business continuity management, and SOC 2 Type 2, stated to cover security, availability, confidentiality and privacy. The page also describes the controls behind them: access management with periodic review, threat and vulnerability management, infrastructure security, incident management with designated roles, monthly workforce assessments, and quarterly penetration testing of networks and servers. Two white papers on data security and business continuity are offered for download.

Nothing is retrievable as evidence: no certificate, report, audit period, auditor or certification body is published, and no request process for the SOC 2 report is described.

No device pathway applies and none is claimed. Assigning billing codes from documentation is an administrative determination rather than a clinical one, so the absence of a clearance is correct and is not a gap.

The exposure sits in claims submission, where codes are representations to a payer and the framework for error is federal false claims enforcement, landing on the billing provider rather than the vendor. The company's payer specific claim scrubber and rule alignment are aimed squarely at that risk, which is the right posture.

One feature carries a regulatory dimension the company does not address. Proactive charge recovery identifies and recovers missed charges on claims already submitted, which means generating corrected or additional claims against past encounters. Rebilling prior periods sits closer to payer audit and overpayment rules than forward coding does, and nothing published describes the controls, documentation standard or provider approval governing it. Otherwise the regulatory position is correctly represented.

The drift instrument exists and is described in enough detail to see what it reports. Daily reporting covers level of billing, claim volume and provider performance, the analytics suite benchmarks provider and clinic performance against each other, and average billing trends with provider score comparisons are named dashboard components. Distribution of assigned billing levels across providers is precisely the aggregate view that makes systematic upcoding or downcoding visible, and it is a standing report rather than something produced on request during an audit.

A multi step quality control process and an audit trail sit alongside it at the individual claim level, so the population view and the case view are both covered.

The governance question this raises is one the disclosure itself invites. Multiple published customer outcomes describe charge capture rising by 15 to 20 percent and billing levels moving after implementation, which is the intended commercial effect and is also, structurally, what a drift problem would look like from the outside. Nothing published distinguishes recovered legitimate revenue from level inflation: no distribution against an expected benchmark, no external audit of coded output, no bias or fairness testing, and no validation methodology. The instrument is real and no result from it is published.

A stated performance level exists to hold the vendor to. The home page publishes coding accuracy above 99 percent and more than 94 percent of claims submitted within 24 hours, the rest within 48, and named customers report coding related denials below 1 percent (Quick Visit Urgent Care) and below 2 percent (Urgent Care Pros), the nearest thing here to a published reversal rate even though it comes from customers rather than the vendor.

Two mechanisms sit between the claim and the buyer's risk. Risk free implementation offers zero upfront fees and a complimentary first month, which lets a provider check coding quality on their own claims before relying on it. And the BI platform keeps an audit trail of every change the engine makes and a manual review queue showing why flagged claims were held.

None of it is recourse. No service level agreement, warranty, indemnity or remediation commitment is published, no confidence threshold governing autonomous handling is disclosed, and no accuracy breakdown by coding element exists, which matters because evaluation and management level assignment is both harder and more often challenged on audit than procedure code selection. The provider carries the false claims exposure regardless.

Named, listed and running in both directions. XpertDox links from its home page to its own listings on the Epic Showroom and the athenahealth Marketplace, both openable by a buyer. The connection layer is enumerated: robotic process automation, API integration, HL7 ADT messaging and SMART on FHIR, used to extract documentation inbound and to post coded claims back. Named customers across federally qualified health centers, urgent care and pediatrics report claims submitted within 24 to 48 hours, which is evidence the round trip runs in production.

The listings are vendor written and do not say which modules run on which system, and robotic process automation behaves differently from an interface when a record system changes its screens.

Nothing published says where clinical documentation is processed or stored. The Trust Center describes security controls and an ISO/IEC 22301 certified business continuity system, the privacy policy covers the website only and sends protected health information to the business associate agreement with each client, and neither names a hosting provider, region, tenancy model or customer controlled deployment option.

Business continuity certification answers a different question: that recovery and availability are externally assessed, not where the data rests. The product reads documentation out of the customer's record system by API, HL7 or robotic process automation and posts claims back, so the processing location is XpertDox's, and a buyer cannot learn it before a sales conversation.

A pricing basis and entry terms are published. The home page states a flexible pricing model with transparent per claim pricing, which shows how cost scales with volume, and risk free implementation with zero upfront fees and a complimentary first month, which turns the evaluation from a paid pilot into a free one. The company also states that no client side technical support is required and that model training runs under one month.

No rate or range is published, so the unit is known and the price is not, and total cost cannot be modeled without contacting sales. The comparison table framing much of this positions competitors as offering none of these terms, which is a marketing claim about others rather than a disclosure about itself.

Deep in ambulatory outpatient, and the published customer roster corroborates it: named federally qualified health centers (CHP Berkshires, Lone Star Circle of Care), urgent care (Quick Visit, Urgent Care Pros, Urgent Care for Children), pediatrics (Blue Fish Pediatrics, PM Pediatric Care), primary and behavioral care (Kai Shin Clinic), multi specialty groups and a billing company.

The value based care tie is sold on its own estate. The BI platform includes a Risk Adjustment (HCC) Dashboard to improve HCC coding accuracy, optimize RAF scores and stay compliant with CMS risk adjustment models, and a Quality Measures Dashboard for outpatient quality measures; the coding engine assigns HCCs and Category II performance codes, and a named FQHC customer credits the HCC recapture dashboards and automated Category II coding with higher quality scores. That is risk adjustment and quality coding, which is why the record sits on this page.

No inpatient, emergency department or surgical coverage is described, and nothing addresses coding regimes outside the United States.