Human + AI Medical Record Review in 2026: The Compliance Rules and the 10 Best Platforms

Disclosure: SoftSnoop may earn a commission from some links on this page. This never affects our rankings or our assessments — see How We Evaluated.

Key takeaways

• “Human + AI record review” is no longer a philosophy — it’s a legal requirement. At least nine states now restrict AI in medical necessity decisions, and California’s SB 1120 flatly prohibits an algorithm from denying, delaying, or modifying care on medical-necessity grounds.
• The federal picture is looser than most vendors imply. CMS declined to finalize its proposed AI guardrails for Medicare Advantage in April 2025. The operative federal guidance is still a February 2024 FAQ.
• Accuracy claims in this market are effectively unfalsifiable. Vendors advertise 97–99.8% accuracy with no published methodology. Peer-reviewed research on LLM clinical summarization found hallucinations in 42% of emergency department summaries in one 2025 study.
• Almost nobody publishes pricing. Of roughly 20 vendors we checked, only three publish real rates. Verified per-page pricing now starts around $0.15–$0.40 per page for AI-assisted chronologies.
• The buying decision splits three ways: software you license, an outsourced service priced per case, or a hybrid that sells you both. For payers and IME programs, the hybrid model is where the market is consolidating.

Quick verdict: our top 4

---

Full comparison: 10 AI medical record review platforms

Pricing verified from vendor sites, August 2026. “Contact sales” means the vendor publishes no rates — assume enterprise negotiation.

What “human + AI record review” actually means

Strip away the marketing, and there are only three architectures on the market.

Fully automated. The AI ingests the record set and produces a chronology or summary. No clinician touches it before delivery. Fast and cheap. In a utilization management context,t it is, in most states, now illegal to base a medical necessity denial on this output.

AI-assisted, human-verified. The AI does the reading and drafting; a licensed nurse, physician, or trained analyst reviews and signs off before the deliverable ships. This is what most vendors mean by “human in the loop,” and it is the architecture the regulatory environment is converging on.

Human-led, AI-accelerated. A clinician runs the review and uses AI to compress the mechanical work — indexing, deduplication, sorting, page reduction. The clinician’s judgment is the product; the AI is a speed multiplier.

The distinction matters commercially, not just legally. A fully automated summary is cheaper per page. It is also the one most likely to fall apart under cross-examination or in an appeal, because nobody can testify to having reviewed it.

One vendor put the defensibility argument more bluntly than the rest. LevelShift states on its own site: “We do not offer an AI platform; we deliver trusted, expert-led services powered by AI.” That is a positioning choice, and for IME and defense work, it is a defensible one.

The compliance rules you’re actually buying against

This is the section most vendors skip, and it’s the one that should drive your shortlist.

Federal: looser than you’d think

The widely repeated claim that “CMS banned AI from denying claims” is not accurate. Here is what actually exists.

The February 6, 2024 CMS FAQ (HPMS memo on CMS-4201-F) addresses Medicare Advantage. Its actual position is narrower than the headlines:

“An algorithm or software tool can be used to assist MA plans in making coverage determinations, but it is the responsibility of the MA organization to ensure that the algorithm or artificial intelligence complies with all applicable rules for how coverage determinations by MA organizations are made.”

The specific prohibitions are targeted:

• An algorithm that determines coverage from a population dataset rather than the individual patient’s history, physician recommendations, and clinical notes is non-compliant with 42 CFR § 422.101(c).
• For post-acute care, “a prediction alone cannot be used as the basis to terminate post-acute care services.”
• For inpatient admissions, “algorithms or artificial intelligence alone cannot be used as the basis to deny admission or downgrade to an observation stay.”

The human-review requirement comes from a separate and much older rule – 42 CFR § 422.566(d) – which requires that an adverse medical necessity determination be reviewed by a physician or appropriate health care professional with relevant expertise before the organization’s determination is issued.

Critically: CMS declined to codify AI-specific guardrails. In the CY 2026 MA final rule (CMS-4208-F, April 4, 2025), CMS explicitly did not finalize its proposed “Guardrails for Artificial Intelligence” provision. As of August 2026, there is still no codified federal AI regulation for Medicare Advantage utilization management. The 2024 FAQ remains the operative guidance.

The WISeR model: AI-assisted prior auth in Original Medicare

If you work in fee-for-service Medicare, this is the development that matters. CMS’s WISeR model (Wasteful and Inappropriate Service Reduction, CMS-5056-N, 90 FR 28749) launched January 1, 2026, and runs through 2031 in six states: New Jersey, Ohio, Oklahoma, Texas, Arizona, and Washington.

Verified specifics:

• Applies to Original Medicare only. CMS is explicit: “WISeR does not apply to people with Medicare Advantage.”
• Covers a defined list of services – nerve stimulators, epidural steroid injections, cervical fusion, skin substitutes, and others.
• The human-decision requirement is written into the model: “All recommendations for non-payment are determined by appropriately licensed clinicians who will apply standardized, transparent, and evidence-based procedures to their review.”
• Participants are paid “a percentage of the expenditures associated with averted wasteful, inappropriate care” – a shared-savings-on-denials structure that drew significant criticism.
• Six named participants: Cohere Health (TX), Genzeon (NJ), Humata Health (OK), Innovaccer (OH), Virtix Health (WA), Zyter (AZ).

A Congressional Review Act resolution to overturn WISeR (S.J.Res. 198) failed on a Senate procedural vote in July 2026. The model remains in place.

State law: this is where the real constraints live

At least nine states had enacted laws restricting AI in prior authorization or claims review as of April 28, 2026, per KFF’s tracker, with Georgia and additional Maryland provisions following in May 2026.

California’s SB 1120 is the model most other states are copying, and two of its provisions are routinely missed by buyers:

It reaches your vendors. The statute applies to a plan that uses an AI tool “or that contracts with or otherwise works through an entity that uses” one. Delegating review to a vendor does not delegate the compliance obligation.

It restricts what happens to the data. § 1367.01(k)(1)(J) requires that patient data “not be used beyond its intended and stated purpose.” In practice, this is currently the strongest legal constraint in the United States on an AI vendor training models on your members’ PHI—because, as covered below, HIPAA itself says nothing about it.

One caveat worth planning for: ERISA preempts state insurance law for self-funded employer plans. Most people with employer-sponsored coverage sit outside every protection in that table.

Accreditation: NCQA and URAC

NCQA’s current position is that its UM standards do not permit AI to make medical necessity denial decisions or any appeal decisions. Software may apply the organization’s own criteria; the denial itself must come from a clinician.

NCQA’s proposed 2027 Health Plan Accreditation AI standards go further, adding four new standards (AI 1–4) covering program structure, governance, pre-deployment evaluation, and ongoing monitoring. The operative language:

“Policies and procedures specify when it is permissible for AI technology to complete a covered function independently… At a minimum, the organization includes the following as impermissible: Denial decisions for medical necessity reviews. – Denial decisions must be made by an appropriate clinician. Appeal decisions that require same-or-similar specialist review.”

Public comment closed December 5, 2025. These standards were still proposed, not final, as of August 2026 — confirm status before building a compliance program around them.

URAC launched the first Health Care AI Accreditation program in September 2025. Adoption is early: the first three accredited organizations – Guidehealth, RediMinds, and SandsRx – were announced on August 3, 2026. Illinois HB 2472 gives URAC and NCQA standards indirect force of law by requiring UR programs to align with them.

HIPAA: a notable silence

There is no OCR guidance specific to artificial intelligence under HIPAA as of August 2026. That is the finding, not a research gap.

What is settled: an AI vendor performing utilization review on your behalf is a business associate. CMS confirmed this directly in the WISeR notice, stating participants “will be serving as business associates (see 45 CFR 160.103)” under BAAs complying with 45 CFR 164.502(e) and 164.504(e).

What is not settled, and what buyers get wrong: HIPAA does not require your BAA to prohibit the vendor from training models on your PHI. No provision says this. It is enforceable only if you write it into the contract. Do that.

What the research actually says about AI accuracy

Every vendor in this market advertises an accuracy figure. None publishes a methodology. Here is the peer-reviewed picture instead — and it is genuinely mixed.

The optimistic number. A study in npj Digital Medicine (May 2025) built a clinical safety framework across 18 experimental configurations and 12,999 clinician-annotated sentences. It found a 1.47% hallucination rate and 3.45% omission rate, and noted that with refined prompts and workflows, major errors dropped below previously reported human note-taking rates. The same paper observes that human-generated clinical notes carry, on average, at least one error and four omissions.

The sobering number. A cross-sectional study in PLOS Digital Health (June 2025) evaluated GPT-4 summaries of 100 real emergency department encounters at UCSF. Results:

• 33% of GPT-4 summaries were entirely error-free
• 42% exhibited hallucinations
• 47% omitted clinically relevant information
• Mean potential-harm score was low – 0.57 out of 7 – with only three errors rated as carrying potential for permanent harm

Why the gap? These are not contradictory. The first counts errors per sentence inside a tuned pipeline. The second counts summaries containing at least one hallucination in an open-ended real-world task. The honest reading is that error rates are highly dependent on task constraints and workflow design — which is exactly the argument for a human verification layer.

What does not exist: there is no published, peer-reviewed evidence establishing LLM parity with human abstractors for the specific task of medical record review supporting a coverage determination. If a vendor tells you otherwise, ask for the citation.

The 10 best AI medical record review platforms

1. Wisedocs – Best for insurance carriers and TPAs at scale

The review. Wisedocs is the most insurance-native platform in this list. It handles indexing, deduplication, chronologies, medical summaries, and custom reports, with an API for embedding into existing claims workflows. The 2.0 release added a “Decision Intelligence” layer.

What separates it from the startups is operational proof rather than benchmark claims. Wisedocs says its models are trained on over 100 million documents, and its case studies report roughly 60% cost savings per page and $1.2 million in annual savings for one client. Note the framing: these are outcome claims from named deployments, not accuracy percentages. That is a more honest posture than a 99% figure with no methodology behind it, and it is the reason Wisedocs takes the top spot for payer-side buyers.

The clinician QA layer is explicit, which matters if your deliverables need to survive an appeal or a deposition.

Pros

• Deepest insurance-specific feature set of any platform here
• SOC 2 Type II with a public trust center
• API-first, so it fits into existing claims infrastructure
• Explicit human oversight on outputs

Cons

• No published pricing at all – expect a full enterprise sales cycle
• No free trial, demo only
• Publishes no precision or recall figures

Best for: carriers and TPAs with enough volume to justify enterprise procurement. Skip it if you’re a solo evaluator or handling under a few thousand pages a month.

2. LevelShift – Best for IME/QME programs and QC on your existing AI

The review. LevelShift offers three engagement tiers: fully manual review, AI-hybrid, and — uniquely in this market — QC-only, where they audit the output of AI you’re already running. For a payer or IME program that has bought a platform but can’t defend its output, that third tier solves a real and underserved problem.

Their scale is documented rather than claimed: one case study covers 230,000 pages at 3,500 pages per day with a 24-hour turnaround. Service coverage is unusually specific to this audience – EOR segmentation, sub-rosa surveillance summaries, hyperlinking, bookmarking.

Their positioning statement is worth quoting because it’s the clearest articulation of the human-led model in the market: “We do not offer an AI platform; we deliver trusted, expert-led services powered by AI.”

One practical warning: levelshift.com’s homepage is an enterprise AI consultancy. The medical record review business lives several clicks deep under Business Process Services. You will not find it on the front page.

Pros

• The only vendor offering QC on third-party AI output
• Deep IME/QME/AME specialisation, including workers’ comp specifics
• Documented throughput at genuine scale
• Explicit, unambiguous human-led model

Cons

• No published pricing
• SOC 2 is self-asserted, with no certificate link
• Site architecture actively hides the offering

Best for: IME programs, IROs, and anyone who needs a defensible signature on the deliverable. Skip it if you want a self-serve platform your own team drives.

3. Cohere Health – Best for health plan utilization management

The review. Cohere Health is the only pick here that isn’t primarily a record-review tool—it’s payer utilization management, covering prior auth automation, medical necessity review, appeals, payment integrity, and quality extraction from unstructured records. It earns its place because the record-reading capability is real and the compliance architecture is the strongest in the set.

The non-copyable fact: Cohere is one of six named participants in CMS’s WISeR model, running the Texas region. That means its clinician-final-decision architecture is operating under an active federal demonstration with published requirements – a level of external scrutiny no other vendor here has.

Cohere reports 17 clients and 25 million covered lives, with claims of 85% real-time approvals, 50% faster reviews, and 30% more accurate decisions. Treat the accuracy figure as unaudited. The design principle – “humans in control,” with every non-approval routed to a clinician – is the part that matters for compliance.

Pros

• Clinician-final architecture built in, not bolted on
• Operating inside a federal model with published requirements
• Covers UM, appeals, payment integrity, and quality in one platform
• Genuine scale at 25M covered lives

Cons

• Not a chronology or med-legal tool – wrong fit for IME work
• No certifications published on the site
• Enterprise-only; no pricing, no trial

Best for: health plans and delegated entities modernising utilization management. Skip it if you need med-legal chronologies or IME support.

4. DigitalOwl – Best for life and P&C underwriting and claims

The review. A Datavant company, currently rebranding to ChartSwap Insights, is a signal of where this market is heading, merging record retrieval with record analysis in one platform. The product suite covers AI summaries, chat, audit-style triage reports, decision-tree workflows, and a data API.

DigitalOwl publishes the most specific accuracy claim in the market: “97% accuracy or higher,” with its self-serve page citing third-party testing at over 98%. It’s the only vendor referencing external validation at all—though it names neither the tester nor the metric, so treat it as directional.

The click-to-evidence feature is the meaningful differentiator. Every extracted fact links to its source page, which turns verification from a re-read into a spot-check. That’s a genuine workflow improvement for underwriters, though note it puts the human-in-the-loop burden on your staff — DigitalOwl doesn’t advertise a vendor-side clinician QA layer.

Pros

• Click-to-evidence makes verification fast and auditable
• The only vendor citing third-party accuracy testing
• Backed by Datavant; retrieval and analysis converging in one platform
• Strong life underwriting and P&C bodily injury fit

Cons

• No vendor clinician review – verification is entirely on your team
• Self-serve tier is waitlist-only with no published rate
• Third-party testing is cited but not documented

Best for: life and P&C carriers with in-house clinical or underwriting staff. Skip it if you need the vendor to own clinical sign-off.

5. InQuery – Best for SIU and defense claims teams

The review. Backed by Y Combinator, General Catalyst, and DRW, InQuery is the most payer- and defense-native of the newer entrants. Its framing is sharper than the category norm: rather than “we summarise records,” it organises around four questions – what happened, what’s missing, what’s inconsistent, what to do next.

The SIU Review Desk is the differentiator. Inconsistency detection across a record set is a materially different problem from summarisation, and it’s aimed squarely at a payer pain point that generic chronology tools don’t touch. The Demand Review Desk and IME coordination round out a genuinely defense-side product.

InQuery states it has processed over a million pages and describes its model as “AI does the heavy reading, people check the work.” What it doesn’t do is publish its certifications, which, for a payer procurement process, is a gap you’ll need to close in the security review.

Pros

• SIU and inconsistency detection genuinely differentiated
• Managed desks combine software with staffed review
• Well-capitalised with credible investors
• Explicit human QA layer

Cons

• No specific certifications published – expect a longer security review
• No accuracy metrics of any kind
• Younger and less proven than Wisedocs or ExamWorks

Best for: SIU teams and defense claims operations. Skip it if your procurement requires documented SOC 2 or HITRUST up front.

6. ExamWorks – Best for fully outsourced IME with accreditation

The review. ExamWorks is the incumbent, and it’s on this list for one reason: it has the strongest certification stack of any vendor here – URAC accreditation for independent medical examinations, HITRUST CSF, and SOC. In a market where most vendors offer a HIPAA badge image and little else, that’s decisive for regulated buyers.

This is not an AI product. It’s a national IME, peer review, and bill review service with an enterprise platform and referral portals attached. Physicians are the deliverable. If your compliance posture requires an accredited entity and a named clinician on every determination, this is the safe answer.

The trade-off is equally clear: no AI-driven speed gains, no published pricing, and negotiated per-exam rates that will exceed what the AI-first vendors charge per page. You are buying defensibility, not efficiency.

Note the accreditation expiry – URAC accreditation valid to 12/01/2026 – worth confirming at renewal.

Pros

• URAC accredited for IME; HITRUST CSF certified
• National physician network at scale
• The most defensible option for regulated payer work
• Established referral and portal infrastructure

Cons

• No AI-driven cost or speed advantage
• No published pricing; negotiated per-exam rates
• Slowest turnaround of anything in this comparison

Best for: carriers whose compliance function requires an accredited vendor. Skip it if cost per page or turnaround time is your binding constraint.

7. MediScan – Best for individual physician evaluators

The review. MediScan is the only vendor here you can sign up for and start using this afternoon. Starter is $169/month for 1,200 pages, then 10¢ per page; Pro is $445 for 3,500 pages at 7¢; Team is $665 for 10,000 pages at 5¢. Fifteen-day free trial, no sales call.

The product is a physician-facing workspace — upload PDFs, get editable chronologies and summaries, query them through MediChat. The design principle is deliberately anti-BPO: MediScan markets itself as working “without relying on unseen reviewers,” which is precisely the objection some evaluators have to outsourced services handling their records.

Here is the detail that earned it a place ahead of better-funded competitors. Asked to state an accuracy rate, MediScan declines, saying the tool “organizes without adding, altering, or interpreting.” In a market where four vendors advertise 97–99.8% with no methodology, the vendor refusing to invent a number is the one making the most credible claim.

The gap is real, though: no SOC 2. For an individual evaluator that may be acceptable. For a health plan procurement, it’s usually disqualifying.

Pros

• Fully published pricing and genuine self-serve signup
• 15-day free trial with no credit card
• Intellectually honest about what the tool does and doesn’t do
• No third-party reviewers touch your records

Cons

• No SOC 2 – likely to fail enterprise security review
• No vendor clinical QA; you are the entire human layer
• Page allowances are modest for high-volume programs

Best for: solo IME/QME physicians and small evaluator groups. Skip it if you’re procuring a health plan with a formal security review.

8. LezDo TechMed – Best for high volume with transparent per-page pricing

The review. LezDo publishes a full pricing table, which in this market is close to a competitive advantage on its own. Monthly volume tiers run from $0.40/page (10,000–50,000 pages) down to $0.25/page above 200,000. Casewise pricing starts at $100 flat for 0–100 pages and scales to $0.20/page above 2,000. Add-ons are individually priced: narrative summaries $0.05–0.10/page, deposition summaries $1.00–1.50/page, timelines $35–100.

Watch the floor: there’s a $4,500/month minimum below 100,000 pages, and expedited work carries a 20% surcharge. That minimum makes it a poor fit for low-volume buyers despite the attractive headline rate.

The certification stack — SOC 2 Type II, ISO 27001, ISO 9001:2015, GDPR, with a public trust center — is the best of any AI-first vendor here and will clear most payer security reviews. Dedicated IME and QME landing pages indicate the audience is served deliberately rather than incidentally.

The one thing to discount is the footer claim of a “99.8% accuracy guarantee.” No methodology accompanies it. Ask what’s actually being guaranteed and what the remedy is.

Pros

• Fully published, granular pricing across every service line
• SOC 2 Type II + ISO 27001 + ISO 9001 – clears most security reviews
• Free pilot with self-signup
• Dedicated IME/QME service lines

Cons

• $4,500/month minimum below 100,000 pages
• The 99.8% accuracy guarantee is unsubstantiated
• 20% expedited surcharge adds up on rush work

Best for: programs processing 100,000+ pages a month that want predictable per-page costs. Skip it if your volume is inconsistent or below the minimum.

9. Medical Insightz – Best for small caseloads and à la carte pricing

The review. Medical Insightz publishes the most granular pricing we found anywhere: $0.15/page for organization, $0.40 for a chronology, $0.60 for case intelligence, $0.35 for narrative, $0.30 for deposition summaries, and $500 per case for a physician opinion. A manual tier runs at $25/hour for most services and $50/hour for medical opinions. Volume discounts of 5/10/15% kick in at 20/50/100 hours per month.

There’s no minimum, and the first case up to 500 pages is free with no credit card. For a program with variable caseloads, that flexibility beats LezDo’s lower per-page rate once you account for the $4,500 monthly floor.

Every AI output is MD-validated before release, which is the right architecture for the compliance environment described above.

One thing to press on before signing: the site states “SOC 2 aligned” on one page and “SOC 2 Type II certified” on another. Those are materially different claims. Ask for the certificate.

Pros

• The most transparent à la carte pricing available
• Free first case up to 500 pages, no card required
• 100% MD validation on AI output
• No monthly minimum

Cons

• Contradictory SOC 2 claims across its own site
• The 98% accuracy claim has no published methodology
• Smaller operation than Wisedocs or ExamWorks

Best for: small to mid-size IME programs and variable caseloads. Skip it if procurement requires verified SOC 2 documentation up front.

10. MOS ReviewGenX – Best for utilization review and clinical quality audit

The review. MOS ReviewGenX is the only platform here that explicitly names utilization review, clinical quality audits, and clinical documentation improvement as target use cases alongside med-legal work. For a payer, that alignment is unusual.

The technical differentiator is ICR extraction on handwritten records. Most platforms handle typed PDFs well and degrade badly on handwriting — still common in older records, workers’ comp files, and rural provider documentation. If your record sets include handwritten notes, this materially changes the economics.

MOS runs a dedicated Human-In-The-Loop page with multilevel QA documented, and it sells both the platform and the outsourced service, so you can shift the human layer in-house or out over time.

The pricing page is a problem. It’s a 2019 blog stub titled “Reasonable Pricing” containing no prices — effectively a dead page. Combined with no published accuracy figures, it makes MOS harder to evaluate than its capabilities deserve.

Pros

• Explicitly built for utilization review and clinical audit, not just med-legal
• ICR handwriting extraction is a genuine capability gap-filler
• Free trial available, plus a free GPT tool
• Buy the platform, the service, or both

Cons

• The pricing page is a dead 2019 stub with no rates
• No accuracy metrics published
• Lower brand visibility than the leaders

Best for: UR and clinical audit teams, especially with handwritten records. Skip it if you need published pricing to build a business case.

Who didn’t make the list, and why

EZ-Medical AI – a credible IME-focused tool founded by a retired orthopedic surgeon, with HIPAA and SOC 2 Type II acompliance nd private GPU servers. Left off only because it’s narrower than MediScan at a similar profile with no published pricing. Worth a look for IME examiners.

Amaise – a capable agentic platform serving European carriers, but publishes no accuracy figures, no pricing, and no specific certifications on its IME pages. Too little verifiable information.

recordreview.ai – ⚠️ We could not verify this as an independent product. Its homepage counters render as “0+ Active Users, 0M+ Records Processed, 0% Time Savings, 0/5 Customer Rating” in the static HTML. Testimonials are anonymous. HIPAA and ISO badges appear as images with no certificate links. Its only call to action is a Calendly link tied to an offshore BPO. The underlying operation may be real; the front-end is not evaluable.

vaquill.ai – not a medical company. It’s a US legal statutes and regulations API. It appears in this SERP by error.

medvoiceinc.com – primarily a medical billing and RCM company. Record review is a side service line.

themcsgroup.com – a records retrieval and litigation support firm, not AI record review. Relevant as an upstream retrieval vendor.

Buyer’s guide: Which one fits your operation

By use case

Health plan utilization management and prior authorization Start with Cohere Health. Its clinician-final architecture is the closest match to the state laws in the table above, and WISeR participation means it operates under published federal requirements. MOS ReviewGenX is the alternative if you need UR plus clinical audit and CDI in one place.

IME, QME, and AME programs LevelShift if you want expert-led service with a named reviewer on the deliverable. MediScan if your physicians want to run the review themselves without outsourcing. ExamWorks if your compliance function requires an accredited vendor.

Claims, SIU, and insurance defense InQuery for inconsistency detection and SIU workflows. Wisedocs if you need scale and an API into existing claims systems.

Life and P&C underwriting DigitalOwl, on the strength of click-to-evidence verification and its Datavant retrieval integration.

High-volume, cost-driven programs: LezDo TechMed above 100,000 pages/month; Medical Insightz below it, where LezDo’s $4,500 minimum stops making sense.

By procurement constraint

Your security review requires SOC 2 Type II or better → Wisedocs, LezDo TechMed, ExamWorks (HITRUST), EZ-Medical A.You need to start this week without procurement → MediScan, Medical Insightz, LezDo (free pilot), MOS (free trial). You operate in California, Texas, or Washington → the clinician-final architecture is mandatory, not optional. Wisedocs, LevelShift, Cohere, Medical Insightz, MOS. You need a defensible signature for deposition or appeal → LevelShift, ExamWorks, Medical Insight.z Your records include handwriting → MOS ReviewGenX

Five questions to ask any vendor before you sign

1. “Who signs off on the output, and are they licensed in the relevant state?” In California, Texas, Washington, and six other states, a medical necessity determination must come from a licensed clinician. If the vendor can’t name the role, they aren’t compliant.
   
2. “Show me the SOC 2 report, not the badge.” Three vendors in this market display badges with no linked certificate, and one states two different SOC 2 statuses on its own site.
   
3. “What is your accuracy figure measuring, and who tested it?” Sentence-level error rate and document-level hallucination rate differ by more than an order of magnitude. A number without a denominator is marketing.
   
4. “Does your BAA prohibit training models on our PHI?” HIPAA does not require this. If it’s not written in, it’s not restricted – except in states with SB 1120-style data-purpose limits.
   
5. “What happens when the AI is wrong?” Ask for the escalation path, the correction SLA, and who carries liability. If there’s no documented process, the human-in-the-loop layer is decorative.
   

How we evaluated

Be transparent here – do not overclaim. This ranking is based on a review of documented evidence, not hands-on product testing. We assessed each vendor against:

• Regulatory fit – does the architecture support a clinician-final decision, and does the vendor say so explicitly?
• Verifiable certifications – HIPAA, SOC 2 Type II, HITRUST, ISO 27001, URAC. Badge images without certificate links were treated as unverified.
• Pricing transparency – published rates scored higher than “contact sales.”
• Accuracy claim quality – we penalised unsourced percentages and credited vendors who declined to state one.
• Audience fit – payer utilization management and IME/QME, not plaintiff-side personal injury.

We reviewed roughly 20 vendors and shortlisted 10. Three were disqualified for being marketing front-ends rather than products, or for serving a different audience entirely — see Who didn’t make the list.

Note for SoftSnoop editorial: If you want to claim hands-on testing, you need to actually run cases through at least the four vendors with free trials (MediScan, LezDo, Medical Insightz, MOS). Otherwise, keep this methodology section as written. Do not invent testing hours.

The verdict

Best overall for payers and carriers: Wisedocs – the deepest insurance-native platform with verified SOC 2 Type II and an explicit clinician QA layer.

Best for IME and QME: LevelShift – expert-led by design, and the only vendor that will QC the AI you already own.

Best for utilization management: Cohere Health – clinician-final architecture operating under active federal scrutiny.

Best value: MediScan at $169/month for solo evaluators; LezDo TechMed at $0.25/page for programs above 100,000 pages monthly.

Best free option to start with: Medical Insightz – a genuinely free first case up to 500 pages, no credit card.

Whichever you choose, the compliance requirement is the same, and it isn’t going away: the AI can read the record, but a licensed human has to make the call. Buy the architecture that assumes this, not the one that treats it as an optional add-on.

Updated August 2026: Added CMS WISeR model participants and the July 2026 Senate CRA vote outcome. Added Washington SB 5395, Utah SB 319, Alabama SB 63, and Indiana HB 1271 to the state law table. Added URAC’s first three accredited organizations (August 3, 2026). Verified pricing for MediScan, LezDo TechMed, and Medical Insightz. Removed vaquill.ai and recordreview.ai from consideration.

Frequently asked questions

Can AI legally deny a medical claim? 

In most cases, no. At least nine states restrict it, and California’s SB 1120 prohibits AI from denying, delaying, or modifying care based on medical necessity—y – only a licensed clinician may. Federally, 42 CFR § 422.566(d) requires a physician or appropriate professional to review adverse medical necessity determinations in Medicare Advantage before they’re issued.

Did CMS ban AI in Medicare Advantage coverage decisions? 

No. CMS’s February 2024 FAQ permits AI to assist with coverage determinations but prohibits basing them on population datasets rather than individual circumstances, and bars AI-alone decisions for post-acute care termination and inpatient denials. CMS declined to finalize broader AI guardrails in the CY 2026 final rule.

What is the WISeR model? 

A CMS Innovation Center demonstration running from January 2026 to December 2031 in six states, testing AI-assisted prior authorization in Original Medicare for a defined list of services. It requires that all non-payment recommendations be determined by appropriately licensed clinicians. It does not apply to Medicare Advantage.

How accurate is AI at reading medical records? 

It depends heavily on the task. A 2025 npj Digital Medicine study found a 1.47% hallucination rate at the sentence level in a tuned pipeline. A 2025 PLOS Digital Health study of real ED encounters found that 42% of GPT-4 summaries contained hallucinations and 47% omitted clinically relevant information. No peer-reviewed study establishes parity with human abstractors for coverage determinations.

What does AI medical record review cost? 

Verified published rates run roughly $0.15–$0.60 per page depending on the deliverable, with volume pricing down to $0.20–$0.25. SaaS subscriptions start around $169/month. Most enterprise vendors publish no pricing at all.

Is an AI record review vendor a HIPAA business associate? 

Yes. CMS confirmed in the WISeR Federal Register notice that entities performing prior authorization functions involving PHI on a plan’s behalf serve as business associates under 45 CFR 160.103, requiring a BAA compliant with 45 CFR 164.502(e) and 164.504(e).

Does HIPAA stop vendors from training AI on our patient data? 

No. There is no HIPAA provision prohibiting it, and no OCR guidance specific to AI as of August 2026. It is restricted only if your BAA says so, or if you’re covered by a state law like California’s SB 1120, which requires patient data not to be used beyond its intended and stated purpose.

Do NCQA or URAC allow AI to make denial decisions? 

NCQA’s UM standards do not permit AI to make medical necessity denials or appeal decisions. Its proposed 2027 accreditation standards would make this explicit, though they remained in draft as of August 2026. URAC launched a Health Care AI Accreditation program in September 2025; the first three organizations were accredited in August 2026.